{"as_of":"2026-08-09T09:34:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:77d409ecdf181fadda94b4e10ed0d2e906b6be18394e7338f63bec536058f60a","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":38,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":38,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":38,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":38,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T17:02:47.290970Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T17:30:00.600665Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-14T01:35:50.992477Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2410.09024"},"observation_digest":"sha256:1c666f6329c6fe49b911fa7c12536bec07e548e0cdb2b283e773a476442435fd","observation_id":"00f3009b-b943-4e6c-a81e-c9876dd4efe8","resolution":{"observed_at":"2026-05-14T01:35:51.196729Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-08T17:02:47.290970Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.09638","last_updated":"2025-05-29T06:12:00Z","snapshot_observed_at":"2026-08-09T01:40:08.338849Z","submitted_at":"2025-02-09T20:49:16Z","title":"Jailbreaking to Jailbreak","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-08T17:02:47.290970Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2502.09638"},"observation_digest":"sha256:b267e9544a57cc8c51d425875ccda124257f9675057b5de5365abaf7a3597e57","observation_id":"e498973f-982f-4427-82d7-4087f05a47f0","resolution":{"observed_at":"2026-08-08T17:02:47.290970Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T19:32:24.045500Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.10487","last_updated":"2025-02-14T11:15:27Z","snapshot_observed_at":"2026-08-08T15:50:26.926490Z","submitted_at":"2025-02-14T11:15:27Z","title":"Fast Proxies for LLM Robustness Evaluation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T19:32:24.045500Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2502.10487"},"observation_digest":"sha256:a67441a4b9494b4b9169e7bb848bf4b71062e8105730a2fd94a630e7eb36e2bf","observation_id":"c9d9c45c-9194-4078-a496-571e02d37ab6","resolution":{"observed_at":"2026-08-07T19:32:24.045500Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T15:09:58.868771Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.17147","last_updated":"2025-05-22T08:22:57Z","snapshot_observed_at":"2026-08-08T03:05:46.469319Z","submitted_at":"2025-05-22T08:22:57Z","title":"MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teaming","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-07T15:09:58.868771Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2505.17147"},"observation_digest":"sha256:2c61d5357a1a831b9db18c0733be6a5b7c2b0ba5e1d84d425ef96967051e8613","observation_id":"d3962040-2111-4a15-87eb-fd55a83b7fa1","resolution":{"observed_at":"2026-08-07T15:09:58.868771Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T14:26:35.050363Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18893","last_updated":"2025-05-30T14:09:51Z","snapshot_observed_at":"2026-08-09T08:24:03.844078Z","submitted_at":"2025-05-24T22:35:32Z","title":"Reality Check: A New Evaluation Ecosystem Is Necessary to Understand AI's Real World Effects","version":4},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T14:26:35.050363Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2505.18893"},"observation_digest":"sha256:46d89476a7f00bd93e1315a8f3ef6b604f0b514c047695654ed64c07532de4a2","observation_id":"025da3cb-08c6-465b-bc04-ee7fc410a902","resolution":{"observed_at":"2026-08-07T14:26:35.050363Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T12:04:46.808275Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.00668","last_updated":"2025-05-31T18:38:23Z","snapshot_observed_at":"2026-08-08T14:13:24.402413Z","submitted_at":"2025-05-31T18:38:23Z","title":"SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-07T12:04:46.808275Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.00668"},"observation_digest":"sha256:a8a46acaab45bf823e63f01a333341febc1e6f10257b373f2555bcc7cad6f964","observation_id":"af5baf9c-24f2-4c7e-bfbf-4d60fce44742","resolution":{"observed_at":"2026-08-07T12:04:46.808275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T12:05:55.420996Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.00688","last_updated":"2025-05-31T19:43:00Z","snapshot_observed_at":"2026-08-09T08:02:09.988324Z","submitted_at":"2025-05-31T19:43:00Z","title":"Existing Large Language Model Unlearning Evaluations Are Inconclusive","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T12:05:55.420996Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.00688"},"observation_digest":"sha256:73794414fe1ad7d166652167d4473a0a33134f76022228ef392be6502d23efab","observation_id":"0795bf9e-e8f0-4fc9-b33f-0846d3705edb","resolution":{"observed_at":"2026-08-07T12:05:55.420996Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T11:11:40.490378Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.03350","last_updated":"2025-06-03T19:43:58Z","snapshot_observed_at":"2026-08-09T00:38:29.639641Z","submitted_at":"2025-06-03T19:43:58Z","title":"Adversarial Attacks on Robotic Vision Language Action Models","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T11:11:40.490378Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.03350"},"observation_digest":"sha256:7d663a880552fb190678d86dd3bd70cb7e7b6dece3d5712c9f1c8d14da15a033","observation_id":"ea5b7d3f-4fcd-41a9-bb98-f17d2047398d","resolution":{"observed_at":"2026-08-07T11:11:40.490378Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T12:11:20.823652Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.05376","last_updated":"2025-06-09T05:48:22Z","snapshot_observed_at":"2026-08-07T12:39:09.825243Z","submitted_at":"2025-05-30T22:58:54Z","title":"A Red Teaming Roadmap Towards System-Level Safety","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T12:11:20.823652Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.05376"},"observation_digest":"sha256:1148b65621e6424af4f7b9319c3c363a5e2b3f57a72a214ff34875b63962c59c","observation_id":"423fc428-ce25-4c67-86de-47204dbbddfe","resolution":{"observed_at":"2026-08-07T12:11:20.823652Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T00:15:01.464128Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.14922","last_updated":"2025-06-24T19:55:23Z","snapshot_observed_at":"2026-08-07T04:49:42.432527Z","submitted_at":"2025-06-17T19:08:02Z","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T00:15:01.464128Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.14922"},"observation_digest":"sha256:75c2e9e29b217665b3ee3f3af7802c1f029e983db00afa3762f37060ef8b42fa","observation_id":"d5622b38-d1cb-47b7-9f96-0a23a7be94db","resolution":{"observed_at":"2026-08-07T00:15:01.464128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-06T21:50:24.381051Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.02956","last_updated":"2025-06-29T23:28:55Z","snapshot_observed_at":"2026-08-07T23:14:25.004427Z","submitted_at":"2025-06-29T23:28:55Z","title":"A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-06T21:50:24.381051Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2507.02956"},"observation_digest":"sha256:d49b1dd21c3ea39be0fa50a74e5f0aadb4b1a7f82414e2175ea83df352689f73","observation_id":"c6e2f740-a3b4-4596-b545-b38fd8c10bda","resolution":{"observed_at":"2026-08-06T21:50:24.381051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-05T15:53:52.389653Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.19461","last_updated":"2025-08-26T22:29:31Z","snapshot_observed_at":"2026-08-07T19:17:20.900756Z","submitted_at":"2025-08-26T22:29:31Z","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T15:53:52.389653Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2508.19461"},"observation_digest":"sha256:cdd7b935341a682f43fd73a26675c7b7377949947e9117c735d5344a70cd1f20","observation_id":"dc7aef9d-0703-43cf-9d52-107eb2ead49c","resolution":{"observed_at":"2026-08-05T15:53:52.389653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T12:27:28.687570Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.03520","last_updated":"2026-06-10T17:21:57Z","snapshot_observed_at":"2026-08-07T07:08:30.567791Z","submitted_at":"2025-10-03T21:24:41Z","title":"Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-04T12:27:28.687570Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.03520"},"observation_digest":"sha256:be1f90391116d8e5b4cb816637a108ab28fbad8709e6382757f2f254424d441a","observation_id":"0f2e6602-08ca-43d2-9b71-c8070ef34c97","resolution":{"observed_at":"2026-08-04T12:27:28.687570Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T09:40:45.154452Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.14207","last_updated":"2026-06-29T03:28:16Z","snapshot_observed_at":"2026-08-07T22:39:10.403032Z","submitted_at":"2025-10-16T01:27:44Z","title":"Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-04T09:40:45.154452Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.14207"},"observation_digest":"sha256:4e335cde983935f744e0787769cbdaf420a2497158508d492d7a619b46f9be29","observation_id":"309ec9ad-75ad-489f-8785-ee5c42109a05","resolution":{"observed_at":"2026-08-04T09:40:45.154452Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T09:25:46.079982Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet.CoRR, abs/2408.15221, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-06T02:45:04.316908Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":102,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:46.079982Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:6a95cb1b8d860d4a9427152e32d1ae13e0e523d1cd50af9dfd198e1312b72062","observation_id":"4b3e7a82-fdde-47cc-9155-3044d9651a7f","resolution":{"observed_at":"2026-08-04T09:25:46.079982Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2511.02356","last_updated":"2026-04-20T12:25:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-11-04T08:24:22Z","title":"ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-18T01:54:22.995178Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2511.02356"},"observation_digest":"sha256:09cc51bf6a850fb4f29b1062e8813f58b5d2bbbb6fc486a017b837c092226af6","observation_id":"1a126705-4d3b-41e5-91f1-f56f557d7299","resolution":{"observed_at":"2026-05-18T01:55:38.102301Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.07727","last_updated":"2026-04-09T02:22:44Z","snapshot_observed_at":"2026-07-06T22:57:00.904627Z","submitted_at":"2026-04-09T02:22:44Z","title":"TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-10T18:26:19.922383Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.07727"},"observation_digest":"sha256:955dbb1b4e12154bf6db4a2a8aab9022f59f7fed872f1c1f30750f2b76312003","observation_id":"247a5f25-22ba-4dda-8c19-878517708f42","resolution":{"observed_at":"2026-05-11T00:35:50.926434Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.10326","last_updated":"2026-04-11T19:19:05Z","snapshot_observed_at":"2026-07-06T22:59:01.129724Z","submitted_at":"2026-04-11T19:19:05Z","title":"Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-05-10T15:19:46.920899Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.10326"},"observation_digest":"sha256:af2e227c663be2e00b0fbb07cda7fa24ff0f6875841a3da5de093adbf69ffac4","observation_id":"a0f878cb-8114-447b-940e-cd4f89f64fbb","resolution":{"observed_at":"2026-05-11T10:46:04.298032Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.11309","last_updated":"2026-04-13T11:12:30Z","snapshot_observed_at":"2026-07-30T17:13:57.164751Z","submitted_at":"2026-04-13T11:12:30Z","title":"The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T16:07:31.602378Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.11309"},"observation_digest":"sha256:c8422aabad4ece9a320e2d296ece286b5d002e79bb956a04bc3cc09434a78f43","observation_id":"7536afa1-8f93-42f7-aebb-3233d15663a0","resolution":{"observed_at":"2026-05-11T09:16:04.319458Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.27818","last_updated":"2026-04-30T12:58:57Z","snapshot_observed_at":"2026-08-02T17:42:15.364009Z","submitted_at":"2026-04-30T12:58:57Z","title":"MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-07T05:31:47.682478Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.27818"},"observation_digest":"sha256:a4435e73015586e188ec68fd758bb7cf80e6c1b92f5e5bfd0a7975667cc4ecce","observation_id":"b8f758b8-04bd-4c98-b15a-60c8b6524bd3","resolution":{"observed_at":"2026-05-12T10:36:30.234082Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2605.01687","last_updated":"2026-05-03T02:55:30Z","snapshot_observed_at":"2026-07-06T23:14:52.417213Z","submitted_at":"2026-05-03T02:55:30Z","title":"MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-05-10T16:00:32.413225Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2605.01687"},"observation_digest":"sha256:b9a810c8729a31503b593d209be83e5af00e24303d9f69f22b0a1a42a34b72a3","observation_id":"564491a8-4c05-4997-9103-3bee6e9e20a3","resolution":{"observed_at":"2026-05-11T09:31:01.117969Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2605.27671","last_updated":"2026-05-26T20:48:33Z","snapshot_observed_at":"2026-08-04T03:57:33.093718Z","submitted_at":"2026-05-26T20:48:33Z","title":"Evolving and Detecting Multi-Turn Deception using Geometric Signatures","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-29T15:17:58.804973Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2605.27671"},"observation_digest":"sha256:d407c6ad777214b82c204cb10956120a68500eb980713dec21afed182478033e","observation_id":"dfc78e53-93fb-41db-bf6c-48a286a0781e","resolution":{"observed_at":"2026-06-29T15:23:32.700901Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-13T18:51:10.298187Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.00003","last_updated":"2026-03-25T15:36:15Z","snapshot_observed_at":"2026-07-13T18:51:10.077827Z","submitted_at":"2026-03-25T15:36:15Z","title":"Learning from Mistakes: Can LLM Self-Recover after Misalignment?","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-13T18:51:10.298187Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.00003"},"observation_digest":"sha256:0e0e4ee76389d9f6c88587bcaf4efae344a9ca35436ecbea5de41d639692adb2","observation_id":"9946a1cd-f8e2-4ad4-82e5-f7b21607fdff","resolution":{"observed_at":"2026-07-13T18:51:10.298187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.02041","last_updated":"2026-06-01T10:30:08Z","snapshot_observed_at":"2026-08-06T02:57:08.156185Z","submitted_at":"2026-06-01T10:30:08Z","title":"SentGuard: Sentence-Level Streaming Guardrails for Large Language Models","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-06-28T14:51:17.667213Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.02041"},"observation_digest":"sha256:1af538e4e0234ac2cb762b8aa41e8ccd21b320b3d4d28c9b77aa42dd971afade","observation_id":"284104f1-8e15-4221-b954-329445444012","resolution":{"observed_at":"2026-07-01T22:56:20.699869Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.04141","last_updated":"2026-06-02T18:53:17Z","snapshot_observed_at":"2026-08-02T13:02:03.082813Z","submitted_at":"2026-06-02T18:53:17Z","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-28T09:15:57.044886Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.04141"},"observation_digest":"sha256:2e9a8e556621f9fb65cdc594184697e929bc7664a48e449560ad173cf5b5be86","observation_id":"3049dbee-2d34-46df-a22d-a70daf20d4b8","resolution":{"observed_at":"2026-07-02T04:16:36.009627Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.07808","last_updated":"2026-06-05T19:36:48Z","snapshot_observed_at":"2026-07-06T23:47:24.424525Z","submitted_at":"2026-06-05T19:36:48Z","title":"Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T21:51:34.829877Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.07808"},"observation_digest":"sha256:31dce82176d6269509866dd11b40ce5391dd878a6f026b815bef0e83d5eb81e4","observation_id":"a3a43767-df8f-4547-8278-1b7e140699c0","resolution":{"observed_at":"2026-07-02T17:47:18.134705Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.14517","last_updated":"2026-06-16T09:28:39Z","snapshot_observed_at":"2026-07-06T23:52:28.557859Z","submitted_at":"2026-06-12T14:49:00Z","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-27T04:42:05.886984Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.14517"},"observation_digest":"sha256:256e05d04132a9633cfea6e1e5b47f4be62d75d42bb15dbdbc0a1c9489c03f4e","observation_id":"61326c0e-fcbf-4c6e-9818-5e9ed641c4ea","resolution":{"observed_at":"2026-07-03T16:58:43.534360Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.20408","last_updated":"2026-06-19T01:38:27Z","snapshot_observed_at":"2026-08-03T15:44:02.265910Z","submitted_at":"2026-06-18T15:57:53Z","title":"NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T17:13:26.201462Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.20408"},"observation_digest":"sha256:960b16020b265e375665f9e73f55a432a89eacbd91493338097c0a2dca223e27","observation_id":"69b52be5-acb9-44ee-891c-ecefc9fbcba6","resolution":{"observed_at":"2026-07-04T04:09:34.476904Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.24388","last_updated":"2026-06-23T10:20:40Z","snapshot_observed_at":"2026-07-06T23:58:58.854077Z","submitted_at":"2026-06-23T10:20:40Z","title":"PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-25T23:52:02.327522Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.24388"},"observation_digest":"sha256:5c95dc13b970d529c8485930f275b067152518b8439b279b5987f73784cdacb0","observation_id":"621dde8d-66f7-41e2-8abd-fef7d8c646a7","resolution":{"observed_at":"2026-07-04T17:09:59.528094Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.25013","last_updated":"2026-06-23T17:59:01Z","snapshot_observed_at":"2026-08-03T16:39:59.297765Z","submitted_at":"2026-06-23T17:59:01Z","title":"Do Thinking Tokens Help with Safety?","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-06-25T23:37:49.412578Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.25013"},"observation_digest":"sha256:2bde54dc10d4dc86d9f532f322ec296ebe699b51b3596aa56f188308c76fe2df","observation_id":"61d50880-a3b8-44fd-8e0d-baf2b1480e20","resolution":{"observed_at":"2026-07-04T17:30:00.602650Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2607.01277","last_updated":"2026-07-01T06:36:29Z","snapshot_observed_at":"2026-08-05T18:03:53.977353Z","submitted_at":"2026-07-01T06:36:29Z","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-03T20:38:16.610310Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.01277"},"observation_digest":"sha256:b5f07d5dc3bc92cd896b6840988358ccb317f865d9c378aa57ab5083585e017f","observation_id":"c78087e5-adb2-4f36-8087-e8dc34bc18db","resolution":{"observed_at":"2026-07-03T20:38:54.925819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-14T06:40:17.865408Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.11151","last_updated":"2026-07-13T06:46:56Z","snapshot_observed_at":"2026-07-16T23:19:13.693221Z","submitted_at":"2026-07-13T06:46:56Z","title":"AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-14T06:40:17.865408Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.11151"},"observation_digest":"sha256:2e2915db67e766cac9edb893f44767449f9ce4a2cfc6508c4104db957ba6ea40","observation_id":"368139f9-4c32-473b-8a35-3f186dd78d3a","resolution":{"observed_at":"2026-07-14T06:40:17.865408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-01T16:19:08.626130Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":1939,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.626130Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:9a011a017d7b84d22b0ea52d2b130b4c4cea538276c518ca9762291879aef722","observation_id":"52be3610-9d22-4093-b472-d455bb546b5d","resolution":{"observed_at":"2026-08-01T16:19:08.626130Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-01T12:54:34.458741Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19292","last_updated":"2026-07-21T17:02:37Z","snapshot_observed_at":"2026-08-03T15:34:37.424189Z","submitted_at":"2026-07-21T17:02:37Z","title":"The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in modern AI systems","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T12:54:34.458741Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.19292"},"observation_digest":"sha256:b61980a760e023bd9e3349c1c851bee9fd29e41405bf5e79f1d328eaa1879dd7","observation_id":"2b05152e-9391-4fb2-8bf2-2754d6943dd3","resolution":{"observed_at":"2026-08-01T12:54:34.458741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-03T00:55:24.309791Z","title":"arXiv preprint arXiv:2408.15221 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.28636","last_updated":"2026-05-19T13:56:13Z","snapshot_observed_at":"2026-08-06T00:38:04.006327Z","submitted_at":"2026-05-19T13:56:13Z","title":"Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-03T00:55:24.309791Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.28636"},"observation_digest":"sha256:4441a3d3c70c9d2f93245644517af2e90330d93b309cd074fa1b871a65683c99","observation_id":"517c58ae-e33a-4b57-a802-dda793e6ad6d","resolution":{"observed_at":"2026-08-03T00:55:24.309791Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-03T11:50:47.128838Z","title":"Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.29199","last_updated":"2026-07-31T09:18:55Z","snapshot_observed_at":"2026-08-06T16:41:38.516023Z","submitted_at":"2026-07-31T09:18:55Z","title":"Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-03T11:50:47.128838Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.29199"},"observation_digest":"sha256:8194edea7d818473aa45f365f4c099da859a4fe1295b23d2a3fea1b7b82797fc","observation_id":"0067c403-d465-4008-9400-5843a1aea210","resolution":{"observed_at":"2026-08-03T11:50:47.128838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-06T00:32:00.935942Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.935942Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:5f053eded338bbab6266c20cb0ab6c2acb04a125b4c515c398287d461600ade1","observation_id":"51f6832f-3f61-4b2a-8830-0224e9affcb8","resolution":{"observed_at":"2026-08-06T00:32:00.935942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T05:44:22.263222Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02518","last_updated":"2026-08-03T17:15:55Z","snapshot_observed_at":"2026-08-09T07:28:23.042609Z","submitted_at":"2026-08-03T17:15:55Z","title":"Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-04T05:44:22.263222Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2608.02518"},"observation_digest":"sha256:5e5a1aac08efab9a966b9b63e4d1b9ee912e1653e938362e59dbb047a74e6a54","observation_id":"fb46f4d2-7cbb-4a41-ab8f-5d17ec9f892c","resolution":{"observed_at":"2026-08-04T05:44:22.263222Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2408.15221/citation-record","integrity":"/paper/2408.15221/integrity","json":"/paper/2408.15221/citation-record.json","paper":"/paper/2408.15221"},"outbound":[],"paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","latest_version":2,"primary_category":"cs.LG","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 38 inbound Pith citation observations for arXiv:2408.15221."}