{"as_of":"2026-08-09T06:34:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:7aeda37656798de025f1e9d850959c4f52867005d76f3ad1c4c65bc31c26aa9d","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":24,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":24,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":24,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":24,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-09T04:22:00.481354Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":3,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-15T02:20:44.368219Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2407.04295"},"observation_digest":"sha256:cd18d1bf2e945efc5a46987c1b49696646b8cb269b3c6fa872e8344598585d89","observation_id":"69f8b7c4-46ed-478b-915b-d3aa6d6d92af","resolution":{"observed_at":"2026-05-15T02:20:44.730853Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-09T04:22:00.481354Z","title":"DrAttack : Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers , March 2024 b","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05223","last_updated":"2025-02-05T21:50:34Z","snapshot_observed_at":"2026-08-09T05:14:54.791831Z","submitted_at":"2025-02-05T21:50:34Z","title":"KDA: A Knowledge-Distilled Attacker for Generating Diverse Prompts to Jailbreak LLMs","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-09T04:22:00.481354Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2502.05223"},"observation_digest":"sha256:8a467abc2d8f92e1bc7d06623ad755a259db4463c97d89a692e02246fc514287","observation_id":"0c83e0ae-e84b-4d66-aa77-d32bf75a8b52","resolution":{"observed_at":"2026-08-09T04:22:00.481354Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-08T12:25:30.613261Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.07557","last_updated":"2025-02-11T13:50:50Z","snapshot_observed_at":"2026-08-09T03:24:13.351555Z","submitted_at":"2025-02-11T13:50:50Z","title":"JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-08T12:25:30.613261Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2502.07557"},"observation_digest":"sha256:588ffaf1d09c665bc26c1044d12e021317747d4283ae867a38ec263395011e73","observation_id":"22cabf06-0865-4a26-b598-885d7c8a2b06","resolution":{"observed_at":"2026-08-08T12:25:30.613261Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-08T17:02:47.346647Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.09638","last_updated":"2025-05-29T06:12:00Z","snapshot_observed_at":"2026-08-09T01:40:08.338849Z","submitted_at":"2025-02-09T20:49:16Z","title":"Jailbreaking to Jailbreak","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T17:02:47.346647Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2502.09638"},"observation_digest":"sha256:005d56fab52125f1c1edecce1fea3b00060c035f3d15de0c21e3b1f7a25aba62","observation_id":"58197cf4-a898-48e8-a7ed-4b90456f2831","resolution":{"observed_at":"2026-08-08T17:02:47.346647Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-07T14:48:16.908261Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.17598","last_updated":"2025-05-23T08:02:38Z","snapshot_observed_at":"2026-08-08T05:50:23.787611Z","submitted_at":"2025-05-23T08:02:38Z","title":"One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-07T14:48:16.908261Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2505.17598"},"observation_digest":"sha256:9bcfd0121aba1cac71c8a68918939e8d41435ecfdce60cde597fbc4a036d69a4","observation_id":"9ed957d2-2887-409b-bdcb-8842dc65627e","resolution":{"observed_at":"2026-08-07T14:48:16.908261Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-07T12:34:35.024627Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers.arXiv preprint arXiv:2402.16914, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.24232","last_updated":"2025-05-30T05:48:50Z","snapshot_observed_at":"2026-08-09T05:32:27.316840Z","submitted_at":"2025-05-30T05:48:50Z","title":"From Hallucinations to Jailbreaks: Rethinking the Vulnerability of Large Foundation Models","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T12:34:35.024627Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2505.24232"},"observation_digest":"sha256:b5ba0e1caff8672908cf221d480b73050bb3e53dd2742d8e023252cccefd241a","observation_id":"bdcec99b-775e-4fe4-8083-8ac83e1925fc","resolution":{"observed_at":"2026-08-07T12:34:35.024627Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2506.06414","last_updated":"2026-04-20T20:58:30Z","snapshot_observed_at":"2026-08-03T02:03:44.971897Z","submitted_at":"2025-06-06T17:33:33Z","title":"Benchmarking Misuse Mitigation Against Covert Adversaries","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-19T10:29:05.104520Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2506.06414"},"observation_digest":"sha256:b68b2bf4a3d865b3761d0a16d65b80e262bd0bbb49ea315d4afd32e84f9ce887","observation_id":"6111a5ee-8cf9-4dd6-95c9-dd4bd41c45f8","resolution":{"observed_at":"2026-05-19T10:32:14.751197Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-07T01:02:29.162442Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.12274","last_updated":"2025-06-13T23:03:11Z","snapshot_observed_at":"2026-08-09T00:29:06.890225Z","submitted_at":"2025-06-13T23:03:11Z","title":"InfoFlood: Jailbreaking Large Language Models with Information Overload","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-07T01:02:29.162442Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2506.12274"},"observation_digest":"sha256:d897407276b783527afafef7c96811b988a01ba46159ea329015a1c6369be28f","observation_id":"65c9f057-029c-4115-b33d-15030852ea12","resolution":{"observed_at":"2026-08-07T01:02:29.162442Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-06T04:47:25.566053Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.03054","last_updated":"2025-08-05T03:58:15Z","snapshot_observed_at":"2026-08-08T05:44:09.712429Z","submitted_at":"2025-08-05T03:58:15Z","title":"Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning","version":1},"reference_index":163,"source":"arxiv_source","source_observed_at":"2026-08-06T04:47:25.566053Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.03054"},"observation_digest":"sha256:9692dd17608728236c119f95804da961fa96de885d0d4b4c530f66f449211c0c","observation_id":"63ff88c9-2fe1-477a-bfc4-a26e7a7ff2b1","resolution":{"observed_at":"2026-08-06T04:47:25.566053Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-06T01:03:50.785477Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.03933","last_updated":"2025-08-05T21:55:14Z","snapshot_observed_at":"2026-08-07T23:14:31.511391Z","submitted_at":"2025-08-05T21:55:14Z","title":"Towards terahertz nanomechanics","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T01:03:50.785477Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.03933"},"observation_digest":"sha256:c9160cd7acad01fd925c292d78f5152570e080120e62f6141e656a499b7033e0","observation_id":"794a4aee-da99-493c-bdb2-f259682c4ea4","resolution":{"observed_at":"2026-08-06T01:03:50.785477Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-06T01:04:34.437507Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.03936","last_updated":"2025-08-05T21:57:52Z","snapshot_observed_at":"2026-08-08T12:25:04.397522Z","submitted_at":"2025-08-05T21:57:52Z","title":"ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistants","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-06T01:04:34.437507Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.03936"},"observation_digest":"sha256:085c84e124c58854b3a47b04c93cf8dac4f39e6c705a5538c73256067f46a974","observation_id":"f7dd2d6d-07a6-4e11-bcc4-66ccb503affb","resolution":{"observed_at":"2026-08-06T01:04:34.437507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T20:31:40.480555Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-08T02:31:17.622343Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.480555Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:3f17d83fb3dd3c425f9d2613dbb111fa91453914ec762294cf76e46fc53c8e76","observation_id":"79ee3035-118a-407b-8085-916f7b3b6269","resolution":{"observed_at":"2026-08-05T20:31:40.480555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2508.20325","last_updated":"2026-05-11T14:12:43Z","snapshot_observed_at":"2026-07-06T22:19:48.389341Z","submitted_at":"2025-08-28T00:07:10Z","title":"GUARD: Guideline Upholding Test through Adaptive Role-play and Jailbreak Diagnostics for LLMs","version":3},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-18T21:34:51.665401Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.20325"},"observation_digest":"sha256:95282967d09c69b54d708a347c3413864f829dd8d11e5849d658e34fdcb673a1","observation_id":"5c51fca5-3ace-4ed8-aead-76b29948150c","resolution":{"observed_at":"2026-05-18T21:36:52.445155Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-04T09:25:46.386991Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful LLM jailbreakers.CoRR, abs/2402.16914, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-06T02:45:04.316908Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":103,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:46.386991Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:48c3c753fadcbf2c364569e518f6e7719283d077e6e08eab8c7342f0a57e304a","observation_id":"05f5aa85-235d-4b43-83a1-80be2b3a3484","resolution":{"observed_at":"2026-08-04T09:25:46.386991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2511.02356","last_updated":"2026-04-20T12:25:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-11-04T08:24:22Z","title":"ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-18T01:54:22.995178Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2511.02356"},"observation_digest":"sha256:721fc4c6018fb5b5713746018b1c8c97a99b729de984f03b73376d811de4acf9","observation_id":"1358916c-c128-4aaa-952c-d057c3118ff8","resolution":{"observed_at":"2026-05-18T01:55:38.022340Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2604.01473","last_updated":"2026-05-28T05:44:14Z","snapshot_observed_at":"2026-08-02T17:40:16.491905Z","submitted_at":"2026-04-01T23:29:12Z","title":"SelfGrader: LLM Jailbreak Detection via Anchored Token-Level Logits","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-13T21:43:46.728512Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2604.01473"},"observation_digest":"sha256:560fba7ebf43f1c92d0c2b7db5115494feb702dc46e07ab8a66a4e49d4f9562e","observation_id":"2fdb3514-3a79-4c03-adeb-e4f553ad2c83","resolution":{"observed_at":"2026-05-13T21:48:19.357903Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2604.10326","last_updated":"2026-04-11T19:19:05Z","snapshot_observed_at":"2026-07-06T22:59:01.129724Z","submitted_at":"2026-04-11T19:19:05Z","title":"Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-05-10T15:19:46.920899Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2604.10326"},"observation_digest":"sha256:e2f409db04649426cc8ed38a89b65b5c4bedc83be5a7b7d087c08b4b96dfa6c6","observation_id":"56618874-883d-450c-bca1-d6ab31f4e38e","resolution":{"observed_at":"2026-05-11T10:46:04.389761Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2605.17971","last_updated":"2026-05-18T07:27:59Z","snapshot_observed_at":"2026-07-31T07:48:29.975390Z","submitted_at":"2026-05-18T07:27:59Z","title":"Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-20T10:08:07.648295Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2605.17971"},"observation_digest":"sha256:cc7bbc0cbfd4ba8cef51c92edbd0b4df89e0a7a36eff0ccb90f867157e7c70fc","observation_id":"7f80f370-27fb-45cd-a195-dcbfab3574cb","resolution":{"observed_at":"2026-05-20T10:08:11.950847Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2605.21674","last_updated":"2026-05-20T19:31:07Z","snapshot_observed_at":"2026-07-06T23:32:05.693503Z","submitted_at":"2026-05-20T19:31:07Z","title":"Adversarial Reframing: A Framework for Targeted Generation in Language Models","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-22T09:35:51.862736Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2605.21674"},"observation_digest":"sha256:766a7d41eb202defb6198c7234e512b3de8f4bdd83c2ef4ee4e4e50ebf9fea50","observation_id":"804aa57b-651c-4ab0-9cf5-405387b1f017","resolution":{"observed_at":"2026-05-22T09:36:21.023614Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2605.31593","last_updated":"2026-05-29T17:57:00Z","snapshot_observed_at":"2026-08-06T14:55:00.141524Z","submitted_at":"2026-05-29T17:57:00Z","title":"Stateful Online Monitoring Catches Distributed Agent Attacks","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-06-28T21:54:44.072929Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2605.31593"},"observation_digest":"sha256:708e23295d093e9472a0dd6d38e8a1e4f90599752ee056c39925df207abfee66","observation_id":"c0c8629c-bc02-4d69-9b40-8917f8c631d9","resolution":{"observed_at":"2026-06-28T22:02:41.101220Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":"2402.16914","doi":"10.48550/arxiv.2402.16914","metadata_source":"arxiv_reference","pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"arXiv preprint arXiv:2402.16914 (2024)","venue":"arXiv (Cornell University)","work_id":"ea7bde13-246e-40f1-be95-d23e27ab5dc9","year":2024},"citing_paper":{"arxiv_id":"2606.07335","last_updated":"2026-06-05T14:49:26Z","snapshot_observed_at":"2026-07-06T23:47:00.425715Z","submitted_at":"2026-06-05T14:49:26Z","title":"Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-06-27T21:55:48.561400Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2606.07335"},"observation_digest":"sha256:159e16c186786d5e87f8e4a22cbb2c8da250f19127ecf08b84bd991513eb7fa8","observation_id":"36b603ad-917a-4335-93e8-65593a4459bf","resolution":{"observed_at":"2026-07-02T17:37:14.898011Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-07-14T06:40:17.865408Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.11151","last_updated":"2026-07-13T06:46:56Z","snapshot_observed_at":"2026-07-16T23:19:13.693221Z","submitted_at":"2026-07-13T06:46:56Z","title":"AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-14T06:40:17.865408Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2607.11151"},"observation_digest":"sha256:5777fb822764aa0c71504ecbb8cc1f15f1956bd8f5edaf0dc6492c3012003786","observation_id":"70d33fdf-3407-4a96-9b21-f4d32dec0fea","resolution":{"observed_at":"2026-07-14T06:40:17.865408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-07-14T03:26:15.676915Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.11751","last_updated":"2026-07-13T16:08:46Z","snapshot_observed_at":"2026-08-05T03:24:48.408797Z","submitted_at":"2026-07-13T16:08:46Z","title":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-07-14T03:26:15.676915Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2607.11751"},"observation_digest":"sha256:a06daaa3ac3195b87257267cbe7e4181454f42fa3a5ec551d458ed107cd8d9cb","observation_id":"1f1fa684-7095-42ea-8e95-324843271df6","resolution":{"observed_at":"2026-07-14T03:26:15.676915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-02T10:20:56.084051Z","title":"arXiv preprint arXiv:2402.16914 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.22643","last_updated":"2026-06-24T02:40:49Z","snapshot_observed_at":"2026-08-08T03:20:50.943223Z","submitted_at":"2026-06-24T02:40:49Z","title":"Reason Before You Retrieve: Agentic Planning for Multi-modal RAG","version":1},"reference_index":113,"source":"arxiv_source","source_observed_at":"2026-08-02T10:20:56.084051Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2607.22643"},"observation_digest":"sha256:d0d8ad72a7731b28c443b53f71bdd5b9301b88e6160992c8189c7a2f30a2e8f6","observation_id":"1e9e90e8-0057-4eb7-8723-13533a0dad87","resolution":{"observed_at":"2026-08-02T10:20:56.084051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2402.16914/citation-record","integrity":"/paper/2402.16914/integrity","json":"/paper/2402.16914/citation-record.json","paper":"/paper/2402.16914"},"outbound":[],"paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","latest_version":3,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T10:16:33.808623Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 24 inbound Pith citation observations for arXiv:2402.16914."}