{"as_of":"2026-08-15T13:17:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:022499aa179f4fceecf63694211d5b70f2d3602882fd7fc2bc3f93f4e4f44282","coverage":[{"denominator":114,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-11T16:59:11.757096Z","state":"measured"},{"denominator":112,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":112,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":12,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":12,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T15:43:30.275006Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-07T15:43:30.275006Z","title":"Mechanistic anomaly dataset huggingface repository, December 2024 b","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.14300","last_updated":"2026-07-10T00:11:31Z","snapshot_observed_at":"2026-08-14T13:56:20.363458Z","submitted_at":"2025-05-20T12:49:58Z","title":"Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors","version":2},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-07T15:43:30.275006Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2505.14300"},"observation_digest":"sha256:d257ff4b07b15e765dbadb1c554117447e4e820e92256c06839b211ec0114143","observation_id":"5149911b-abee-4c46-9cbc-ff6d294fcf87","resolution":{"observed_at":"2026-08-07T15:43:30.275006Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2506.06414","last_updated":"2026-04-20T20:58:30Z","snapshot_observed_at":"2026-08-10T17:13:42.931667Z","submitted_at":"2025-06-06T17:33:33Z","title":"Benchmarking Misuse Mitigation Against Covert Adversaries","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-19T10:29:05.104520Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2506.06414"},"observation_digest":"sha256:542e2bd81ca0978415198d410ad2dc5dd03e8f5c5b2251c80b36a352ab09943c","observation_id":"f01be2eb-e74d-4b8f-9da1-cc63708d255d","resolution":{"observed_at":"2026-05-19T10:32:14.724366Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-04T17:46:12.058846Z","title":"Obfus- cated activations bypass LLM latent-space defenses,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.10682","last_updated":"2025-09-12T20:26:16Z","snapshot_observed_at":"2026-08-12T22:01:07.249587Z","submitted_at":"2025-09-12T20:26:16Z","title":"LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-04T17:46:12.058846Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2509.10682"},"observation_digest":"sha256:57d019f983a2d6448b6f27980b596526b027831a2277e7e3cb021f2cee787223","observation_id":"d7993807-29b9-48f0-8d70-8d292f805944","resolution":{"observed_at":"2026-08-04T17:46:12.058846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-02T17:39:41.404497Z","title":"Obfuscated activations bypass LLM latent-space defenses.arXiv preprint arXiv:2412.09565,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2603.23171","last_updated":"2026-07-29T15:06:33Z","snapshot_observed_at":"2026-08-13T20:48:34.746911Z","submitted_at":"2026-03-24T13:13:23Z","title":"Adaptively Robust LLM Monitoring via Activation Watermarking","version":3},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-02T17:39:41.404497Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2603.23171"},"observation_digest":"sha256:5cb75299fa70f7a85d3672504def16ccedd5e54c42abb226eba887ef5ef08c40","observation_id":"24a9af66-5191-471a-93b5-341c475e8be1","resolution":{"observed_at":"2026-08-02T17:39:41.404497Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2605.00269","last_updated":"2026-04-30T22:06:02Z","snapshot_observed_at":"2026-08-11T13:23:49.981581Z","submitted_at":"2026-04-30T22:06:02Z","title":"How Language Models Process Out-of-Distribution Inputs: A Two-Pathway Framework","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-05-09T19:45:36.021741Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2605.00269"},"observation_digest":"sha256:59e2e76c3c23fb1474896b5762caac2706fb1a338817532221dae4127d53453c","observation_id":"0f76f3ef-2629-44f6-9793-bb977860a5e1","resolution":{"observed_at":"2026-05-11T15:31:20.974832Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2605.12813","last_updated":"2026-05-31T17:51:51Z","snapshot_observed_at":"2026-07-06T23:24:27.821980Z","submitted_at":"2026-05-12T23:13:50Z","title":"REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-05-14T20:13:10.814899Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2605.12813"},"observation_digest":"sha256:b2975b959dea474478d2c22e61f7c49bb57c1f0d59e3366c0f40dbfc72589089","observation_id":"1055259d-3caf-4889-b05b-f6b58a07d7bb","resolution":{"observed_at":"2026-05-14T20:17:56.463644Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2605.27958","last_updated":"2026-05-27T04:51:55Z","snapshot_observed_at":"2026-08-02T18:48:51.771659Z","submitted_at":"2026-05-27T04:51:55Z","title":"Pressure-Testing Deception Probes in LLMs: Scaling, Robustness, and the Geometry of Deceptive Representations","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-06-29T12:40:13.092199Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2605.27958"},"observation_digest":"sha256:c5364d970a219ce40c4c570b8deb5b4596b91060c8ed3e4657363b66f2250e2f","observation_id":"4279c4b0-7e2d-4e2c-890f-fa7e9480e83a","resolution":{"observed_at":"2026-06-29T12:43:25.519189Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2606.08044","last_updated":"2026-08-04T12:50:00Z","snapshot_observed_at":"2026-08-07T23:11:38.433528Z","submitted_at":"2026-06-06T08:10:56Z","title":"When Behavioral Safety Evaluation Fails: A Representation-Level Perspective","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-06-27T20:04:17.744876Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2606.08044"},"observation_digest":"sha256:687b904ccf1be44a9561b1e49448b7f59d0c0d9e87927c16f29cdc8699720cc1","observation_id":"194e3e3a-075a-4ea0-aec6-f7a04bf0650a","resolution":{"observed_at":"2026-07-02T20:57:23.093705Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2606.09563","last_updated":"2026-06-08T14:37:46Z","snapshot_observed_at":"2026-08-01T00:37:11.487032Z","submitted_at":"2026-06-08T14:37:46Z","title":"PRISM: Recovering Instruction Sets from Language Model Activations","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-06-27T16:52:02.948457Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2606.09563"},"observation_digest":"sha256:1a8a917c75d79144ccf31f932056149a63b8636a02dbd055be0c2ec18fb211f1","observation_id":"91e4960d-93a5-4b8a-babc-a4acafe21e27","resolution":{"observed_at":"2026-07-03T00:57:30.654273Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2606.12360","last_updated":"2026-06-10T17:31:16Z","snapshot_observed_at":"2026-08-15T04:26:22.769006Z","submitted_at":"2026-06-10T17:31:16Z","title":"Anatomy of Post-Training: Using Interpretability to Characterize Data and Shape the Learning Signal","version":1},"reference_index":170,"source":"arxiv_source","source_observed_at":"2026-06-27T10:32:57.295159Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2606.12360"},"observation_digest":"sha256:256c38c57186b2b9aa0663d5989148a25c63d44abec39338c78d997e8c811cb3","observation_id":"a1c880b8-3b52-4ca2-a2af-03007f1531cf","resolution":{"observed_at":"2026-07-03T09:07:47.924841Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":"2412.09565","doi":"10.48550/arxiv.2412.09565","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Obfuscated activations bypass llm latent-space defenses","venue":"arXiv (Cornell University)","work_id":"ceea2856-7bfb-421e-882f-afe9c83894fd","year":2025},"citing_paper":{"arxiv_id":"2606.18284","last_updated":"2026-06-10T02:04:29Z","snapshot_observed_at":"2026-08-14T01:56:24.853455Z","submitted_at":"2026-06-10T02:04:29Z","title":"Breaking the Solver Bottleneck: Training Task Generators at the Learnable Frontier","version":1},"reference_index":104,"source":"arxiv_source","source_observed_at":"2026-06-27T10:36:09.211639Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2606.18284"},"observation_digest":"sha256:5079e785c67139ac5e81b091d8807f40f047ad8ea4fb3be3100f72f805847e3d","observation_id":"48df94a6-2358-4964-b02f-611e4753c21f","resolution":{"observed_at":"2026-07-03T08:57:48.255219Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.09565","snapshot_observed_at":"2026-08-02T06:53:50.342415Z","title":"Bailey, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.13087","last_updated":"2026-07-13T14:20:06Z","snapshot_observed_at":"2026-08-07T20:29:34.196284Z","submitted_at":"2026-07-13T14:20:06Z","title":"GDM AI Control Roadmap","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-02T06:53:50.342415Z"},"links":{"cited_paper":"/paper/2412.09565","citing_paper":"/paper/2607.13087"},"observation_digest":"sha256:8e367b0fe1211d0cf63f113ca6206c5eec1a9e0605b2ccc492e9c89e85b617ef","observation_id":"3ecf09f9-6aba-4b0c-aa42-7b87e27aba39","resolution":{"observed_at":"2026-08-02T06:53:50.342415Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2412.09565/citation-record","integrity":"/paper/2412.09565/integrity","json":"/paper/2412.09565/citation-record.json","paper":"/paper/2412.09565"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.405016Z","title":"Adversarial Example Detection Using Latent Neighborhood Graph","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.405016Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:0a1fea915121440e45551f7e0b44e0c657951f6ad93775b1014123b9c084c6d1","observation_id":"68e024db-1330-4e5a-bfcf-67b34c5a4177","resolution":{"observed_at":"2026-08-11T16:59:11.405016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1610.01644","last_updated":"2018-11-22T23:40:00Z","snapshot_observed_at":"2026-08-09T22:50:03.459615Z","submitted_at":"2016-10-05T20:59:01Z","title":"Understanding intermediate layers using linear classifier probes","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1610.01644","snapshot_observed_at":"2026-08-11T16:59:11.409609Z","title":"Understanding intermediate layers using linear classifier probes","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.409609Z"},"links":{"cited_paper":"/paper/1610.01644","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:4b1b293e873e888a923f35e83222d39b2e73f181c5664239b21016858515a6cb","observation_id":"a15f435f-53d3-4836-9e1b-7165bb085139","resolution":{"observed_at":"2026-08-11T16:59:11.409609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.413504Z","title":"Trace and Detect Adversarial Attacks on CNNs Using Feature Response Maps","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.413504Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:0919d8edd4fdec29a68c397cebb3e1531f00a890834323f44bf9775b018bd44f","observation_id":"cf1a5bce-f3b6-451a-ad7b-0dceb4d66add","resolution":{"observed_at":"2026-08-11T16:59:11.413504Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-13T00:39:04.444350Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-11T16:59:11.417219Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.417219Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:0103f1b299408566f5c34645ac8122af752b9310ba2565c29210db30c35b09a9","observation_id":"3240d49e-82f2-419e-bd48-bfa035f25a40","resolution":{"observed_at":"2026-08-11T16:59:11.417219Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.421310Z","title":"Many-shot jailbreaking","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.421310Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:d9af22abecfaacaf48ae779d0a01f03ebeb77c03e1bc67eea822890c83dfc533","observation_id":"06df9536-17a1-4d1d-b201-d6e04cd5807c","resolution":{"observed_at":"2026-08-11T16:59:11.421310Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.09932","last_updated":"2024-09-06T00:46:40Z","snapshot_observed_at":"2026-08-14T08:45:20.216780Z","submitted_at":"2024-04-15T16:58:28Z","title":"Foundational Challenges in Assuring Alignment and Safety of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.09932","snapshot_observed_at":"2026-08-11T16:59:11.424767Z","title":"Foundational Challenges in Assuring Alignment and Safety of Large Language Models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.424767Z"},"links":{"cited_paper":"/paper/2404.09932","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ca7a7f2e02dfcc2a4af0f000dc86fb4b7b05efb8572899f0d0af0db53395a33e","observation_id":"97645858-2052-4b3a-9109-d47e732b2347","resolution":{"observed_at":"2026-08-11T16:59:11.424767Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.11717","last_updated":"2024-10-30T18:57:07Z","snapshot_observed_at":"2026-08-15T09:21:47.572546Z","submitted_at":"2024-06-17T16:36:12Z","title":"Refusal in Language Models Is Mediated by a Single Direction","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.11717","snapshot_observed_at":"2026-08-11T16:59:11.428975Z","title":"Refusal in Language Models Is Mediated by a Single Direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.428975Z"},"links":{"cited_paper":"/paper/2406.11717","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ead7bccf06eca5c28fa42b5db43bf63761f04a18067f0aa59a6b66c7ab84e145","observation_id":"519b6e9c-ebb2-4eb6-a6b1-13471d8a5e85","resolution":{"observed_at":"2026-08-11T16:59:11.428975Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1802.00420","last_updated":"2018-07-31T00:09:56Z","snapshot_observed_at":"2026-08-14T19:49:46.769530Z","submitted_at":"2018-02-01T18:20:05Z","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1802.00420","snapshot_observed_at":"2026-08-11T16:59:11.432401Z","title":"Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.432401Z"},"links":{"cited_paper":"/paper/1802.00420","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:20dc3eff6ac74ef901fde9ca0e6e505822f2d45fcbc18da03377201f2823bc61","observation_id":"71d468cf-5ecc-4165-878b-bcb8161445b8","resolution":{"observed_at":"2026-08-11T16:59:11.432401Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.436270Z","title":"sql-create-context Dataset , 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.436270Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:f11458647065cf369933cb75dd38f452c832777b96ffd249a9c6b83370385eb3","observation_id":"64ce84d3-843d-44f8-abed-738d2280498d","resolution":{"observed_at":"2026-08-11T16:59:11.436270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09289","last_updated":"2024-10-05T19:56:20Z","snapshot_observed_at":"2026-08-12T23:43:25.218808Z","submitted_at":"2024-06-13T16:26:47Z","title":"Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09289","snapshot_observed_at":"2026-08-11T16:59:11.439328Z","title":"Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.439328Z"},"links":{"cited_paper":"/paper/2406.09289","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:7c42a152e9db582543cfc3f8bca154aef3a47133af9eb0b69a5052c66afdad1b","observation_id":"65eae594-778f-44e5-b6be-372c71ee8da4","resolution":{"observed_at":"2026-08-11T16:59:11.439328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.442625Z","title":"Probing Classifiers: Promises, Shortcomings, and Advances","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.442625Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:a712f681d22868be466031140f223c51308cd0b0e91420276a7816d0bfd86c63","observation_id":"c94f3d3e-9e2a-4317-8b26-45639e4690ba","resolution":{"observed_at":"2026-08-11T16:59:11.442625Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08112","last_updated":"2025-11-11T01:13:28Z","snapshot_observed_at":"2026-08-14T11:50:41.917778Z","submitted_at":"2023-03-14T17:47:09Z","title":"Eliciting Latent Predictions from Transformers with the Tuned Lens","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08112","snapshot_observed_at":"2026-08-11T16:59:11.445716Z","title":"Eliciting Latent Predictions from Transformers with the Tuned Lens","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.445716Z"},"links":{"cited_paper":"/paper/2303.08112","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:18883bdf7a2bf27fc1bd1867e104d3e31958c54b8543152d2cb972e40b033659","observation_id":"197b6a51-0ff5-4e50-9f2f-05d50839b840","resolution":{"observed_at":"2026-08-11T16:59:11.445716Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.12241","last_updated":"2024-05-24T13:16:32Z","snapshot_observed_at":"2026-08-14T04:38:42.916801Z","submitted_at":"2024-05-17T17:03:46Z","title":"Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.12241","snapshot_observed_at":"2026-08-11T16:59:11.448935Z","title":"Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.448935Z"},"links":{"cited_paper":"/paper/2405.12241","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:65f33518e950a8f95a83b29645d57f5af4b1483205c0571ae242936b3f6a2342","observation_id":"08a2e4f6-395b-4409-bea1-9f34b18d69c4","resolution":{"observed_at":"2026-08-11T16:59:11.448935Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.452487Z","title":"A Sober Look at Steering Vectors for LLMs","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.452487Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:1690be6b1d1493aa89f277f990539d1f531bcb45836cfec591f5051dc9568489","observation_id":"ffce4e76-104b-434c-a5ef-1ad91f34c22f","resolution":{"observed_at":"2026-08-11T16:59:11.452487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.455588Z","title":"Towards Monosemanticity: Decomposing Language Models With Dictionary Learning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.455588Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:76499310faf8004ceda4caeb6dd7c9f5b13aaf318a35850c99b9fb9408b214f3","observation_id":"45050759-71dc-4317-9a46-bb5668b90c15","resolution":{"observed_at":"2026-08-11T16:59:11.455588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.458685Z","title":"Using Dictionary Learning Features as Classifiers , October 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.458685Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:9717dd69805a13103d3435d73f04e07dc73dcb4cda9aded1d0154728411f1c57","observation_id":"8819b7ad-8e30-4e95-a02c-f2b8238a7934","resolution":{"observed_at":"2026-08-11T16:59:11.458685Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.07213","last_updated":"2024-11-11T18:36:17Z","snapshot_observed_at":"2026-08-12T22:03:00.587921Z","submitted_at":"2024-11-11T18:36:17Z","title":"Comparing Bottom-Up and Top-Down Steering Approaches on In-Context Learning Tasks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.07213","snapshot_observed_at":"2026-08-11T16:59:11.462084Z","title":"Comparing Bottom-Up and Top-Down Steering Approaches on In-Context Learning Tasks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.462084Z"},"links":{"cited_paper":"/paper/2411.07213","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:1793cf496a05410dae048675f590d049c35330074ee3c16fe8cda1eb8538165b","observation_id":"cb396376-fd62-4751-b087-2c1cda20bd0c","resolution":{"observed_at":"2026-08-11T16:59:11.462084Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.03827","last_updated":"2024-03-02T21:33:53Z","snapshot_observed_at":"2026-08-10T11:37:23.229129Z","submitted_at":"2022-12-07T18:17:56Z","title":"Discovering Latent Knowledge in Language Models Without Supervision","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.03827","snapshot_observed_at":"2026-08-11T16:59:11.465433Z","title":"Discovering Latent Knowledge in Language Models Without Supervision","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.465433Z"},"links":{"cited_paper":"/paper/2212.03827","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:db6633ec504f0f7a90d1aaee08b1f811df6a1ba742a4369e60a74c55784363f0","observation_id":"b87dc70c-aa49-4ea9-95b5-505af1aba19a","resolution":{"observed_at":"2026-08-11T16:59:11.465433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.468864Z","title":"Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.468864Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:92903c38457caef3b96c93f1a80d8202431ac5bc23722b7c102ceeefde1454d2","observation_id":"94d62af0-14e1-4c89-8257-1b6bede1170e","resolution":{"observed_at":"2026-08-11T16:59:11.468864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.472009Z","title":"Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.472009Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:89e9ede5f11ac6dd76c2c01a17cd831a44a79804c3b916097e5627e3642c07d7","observation_id":"b6214e8e-c1ab-455f-93f3-baca9257afdd","resolution":{"observed_at":"2026-08-11T16:59:11.472009Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05030","last_updated":"2025-07-29T09:44:14Z","snapshot_observed_at":"2026-08-14T03:13:05.686604Z","submitted_at":"2024-03-08T04:22:48Z","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05030","snapshot_observed_at":"2026-08-11T16:59:11.475833Z","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.475833Z"},"links":{"cited_paper":"/paper/2403.05030","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:9ecb915b48f1c1acf54b89bf7c3cc2a1fda12320a9900999af85eb58462cf92e","observation_id":"a2c190ff-a895-4917-b1a8-5f0dec926f57","resolution":{"observed_at":"2026-08-11T16:59:11.475833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.479701Z","title":"A is for Absorption: Studying Feature Splitting and Absorption in Sparse Autoencoders","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.479701Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:8bc881cdea96bfc19630160bcbed92132f5a0124de0cc1c538a73f2620afd2a0","observation_id":"f58b91f1-5a00-4ec5-b371-89dcf355a42e","resolution":{"observed_at":"2026-08-11T16:59:11.479701Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-12T12:29:45.113982Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-11T16:59:11.482921Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.482921Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:e639d14b4636ae4e7621a43fcf5623254e70699e6add7b667453672060620ba0","observation_id":"9ce3b649-da44-426e-b3d4-a55a84d87665","resolution":{"observed_at":"2026-08-11T16:59:11.482921Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.486569Z","title":"Code Alpaca: An Instruction-following LLaMA model for code generation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.486569Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:5bad2f2359ea4927162131ea797983c635d059d3e4522d0ceb7c106d07ccf8cc","observation_id":"5847f4b0-f741-4eb6-92f2-120231a1d30e","resolution":{"observed_at":"2026-08-11T16:59:11.486569Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.490133Z","title":"Srivastava","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.490133Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:0f95d5909f6c1f93df135e0f34547db44718afcaf49afd037aa183c8854e61ff","observation_id":"e02dce06-f80f-453a-817e-c42acaef0390","resolution":{"observed_at":"2026-08-11T16:59:11.490133Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.494756Z","title":"Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.494756Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:b4a1506e947ec466d87a224fbcaedcd37c7bee93970ceb027a2640240425c187","observation_id":"3920e612-80c2-46a9-b7e9-6b9fc7469e2d","resolution":{"observed_at":"2026-08-11T16:59:11.494756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1712.05526","last_updated":"2017-12-15T04:26:26Z","snapshot_observed_at":"2026-07-06T06:14:30.795326Z","submitted_at":"2017-12-15T04:26:26Z","title":"Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.05526","snapshot_observed_at":"2026-08-11T16:59:11.498355Z","title":"Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.498355Z"},"links":{"cited_paper":"/paper/1712.05526","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:a6973c4fc1df433062fa10dbd2a9b869ef59e2819e9b319043963c4187accb44","observation_id":"c8d70fba-391f-483a-b470-b4af80013364","resolution":{"observed_at":"2026-08-11T16:59:11.498355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.05466","last_updated":"2024-05-11T04:45:59Z","snapshot_observed_at":"2026-08-13T00:11:57.018313Z","submitted_at":"2024-05-08T23:44:08Z","title":"Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.05466","snapshot_observed_at":"2026-08-11T16:59:11.501870Z","title":"Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.501870Z"},"links":{"cited_paper":"/paper/2405.05466","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:86a65d309492644031ce56d5b108768518e83035736e1b10061b1326fb9366d5","observation_id":"4b24aece-0821-4cc7-8831-a68c3773d40b","resolution":{"observed_at":"2026-08-11T16:59:11.501870Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.08600","last_updated":"2023-10-04T13:17:38Z","snapshot_observed_at":"2026-08-11T07:21:14.568175Z","submitted_at":"2023-09-15T17:56:55Z","title":"Sparse Autoencoders Find Highly Interpretable Features in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.08600","snapshot_observed_at":"2026-08-11T16:59:11.505152Z","title":"Sparse Autoencoders Find Highly Interpretable Features in Language Models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.505152Z"},"links":{"cited_paper":"/paper/2309.08600","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:698d01132661ecd66d705500f20fc26535963ba8e6067483026ca6e2e20dfcd5","observation_id":"4e8e58a9-7bc7-42f5-9dd1-d59622dfbfc5","resolution":{"observed_at":"2026-08-11T16:59:11.505152Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.508683Z","title":"Bias in Bios: A Case Study of Semantic Representation Bias in a High-Stakes Setting","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.508683Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:38b673fbb9f62b6f73f8f8e5ceff06d9eef722835611a6cc5460006be0fc0182","observation_id":"0eaf2520-952d-4e82-bd08-1b03eda895bb","resolution":{"observed_at":"2026-08-11T16:59:11.508683Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14233","last_updated":"2023-05-23T16:49:14Z","snapshot_observed_at":"2026-08-14T22:24:15.551461Z","submitted_at":"2023-05-23T16:49:14Z","title":"Enhancing Chat Language Models by Scaling High-quality Instructional Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14233","snapshot_observed_at":"2026-08-11T16:59:11.511560Z","title":"Enhancing Chat Language Models by Scaling High-quality Instructional Conversations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.511560Z"},"links":{"cited_paper":"/paper/2305.14233","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2ff651aad7c861ef664f8e601af41af62adc1b6dcf984002cb65942abf870416","observation_id":"f29247ee-e7fb-4180-a7eb-b8ad1cdfddde","resolution":{"observed_at":"2026-08-11T16:59:11.511560Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.515812Z","title":"Backdoor Attack with Imperceptible Input and Latent Modification","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.515812Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:1423b34de16dabb0fc12d57348e6669e3bed9250b699d722625a8052d65c557f","observation_id":"ca21f569-dbf6-48ec-aead-d1d372431b20","resolution":{"observed_at":"2026-08-11T16:59:11.515812Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1703.00410","last_updated":"2017-11-15T23:31:59Z","snapshot_observed_at":"2026-08-14T21:14:04.215100Z","submitted_at":"2017-03-01T17:43:10Z","title":"Detecting Adversarial Samples from Artifacts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1703.00410","snapshot_observed_at":"2026-08-11T16:59:11.519305Z","title":"Curtin, Saurabh Shintre, and Andrew B","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.519305Z"},"links":{"cited_paper":"/paper/1703.00410","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:87ef4ac750eb028415d5458351e19fe46e7e96eaa2a079348fdb8fdb6407079b","observation_id":"a7848329-05a0-4ac2-94bb-a317b014d96d","resolution":{"observed_at":"2026-08-11T16:59:11.519305Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.05446","last_updated":"2024-08-08T14:21:16Z","snapshot_observed_at":"2026-08-12T23:06:32.548337Z","submitted_at":"2024-08-08T14:21:16Z","title":"Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.05446","snapshot_observed_at":"2026-08-11T16:59:11.522790Z","title":"Ensemble everything everywhere: Multi-scale aggregation for adversarial robustness","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.522790Z"},"links":{"cited_paper":"/paper/2408.05446","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:bd2abcf1ca9623497eae8e7052d3f0b6c48276f5834769a1434d17e15e5eccf7","observation_id":"7a2707ae-d2d4-476b-ae45-71f39a7017a6","resolution":{"observed_at":"2026-08-11T16:59:11.522790Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.03656","last_updated":"2024-06-05T15:03:37Z","snapshot_observed_at":"2026-08-13T05:08:31.751227Z","submitted_at":"2023-12-06T18:25:53Z","title":"Interpretability Illusions in the Generalization of Simplified Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.03656","snapshot_observed_at":"2026-08-11T16:59:11.526314Z","title":"Interpretability Illusions in the Generalization of Simplified Models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.526314Z"},"links":{"cited_paper":"/paper/2312.03656","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:c5d325faf8b0a61f5a1f33163c763f4d00c26bd71687689d8764433edccdb423","observation_id":"6116d3e7-b668-47a1-b5ab-62ef0ec4e3bb","resolution":{"observed_at":"2026-08-11T16:59:11.526314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02760","last_updated":"2025-07-21T21:03:45Z","snapshot_observed_at":"2026-08-12T22:31:21.984502Z","submitted_at":"2024-10-03T17:59:30Z","title":"Erasing Conceptual Knowledge from Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02760","snapshot_observed_at":"2026-08-11T16:59:11.529629Z","title":"Erasing Conceptual Knowledge from Language Models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.529629Z"},"links":{"cited_paper":"/paper/2410.02760","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:19dc2a7537bc6f364977bf69d37332c69e2a974c95828a125c0ce8e8ae104d1b","observation_id":"98bd1a90-addd-46e8-8b3e-c924b1990fa4","resolution":{"observed_at":"2026-08-11T16:59:11.529629Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04093","last_updated":"2024-06-06T14:10:12Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-06T14:10:12Z","title":"Scaling and evaluating sparse autoencoders","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04093","snapshot_observed_at":"2026-08-11T16:59:11.533084Z","title":"Scaling and evaluating sparse autoencoders","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.533084Z"},"links":{"cited_paper":"/paper/2406.04093","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:6fd9f14e7445f13339db11ba27594bc328f878c5f0ea9872eabda015ed4945b9","observation_id":"860f0c13-9fde-4212-9dd7-df8718b74178","resolution":{"observed_at":"2026-08-11T16:59:11.533084Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.536844Z","title":"STRIP: a defence against trojan attacks on deep neural networks","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.536844Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:0cd91cfa55ac067d01742a374756be4943cfba54f4730a369581b3a0a255cec3","observation_id":"dde99bc3-fe29-495b-80c5-0f79fb43780c","resolution":{"observed_at":"2026-08-11T16:59:11.536844Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14020","last_updated":"2024-02-21T18:59:13Z","snapshot_observed_at":"2026-08-13T04:13:27.147849Z","submitted_at":"2024-02-21T18:59:13Z","title":"Coercing LLMs to do and reveal (almost) anything","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14020","snapshot_observed_at":"2026-08-11T16:59:11.540064Z","title":"Coercing LLMs to Do and Reveal (Almost) Anything","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.540064Z"},"links":{"cited_paper":"/paper/2402.14020","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:16bb305d0aa30f9e3fa23ce7c04f989602708f3a306952949f4ed7a90373250f","observation_id":"71325723-ed92-47ed-b556-ae14f38b4bc1","resolution":{"observed_at":"2026-08-11T16:59:11.540064Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.06974","last_updated":"2024-11-09T18:58:35Z","snapshot_observed_at":"2026-08-13T16:02:20.731500Z","submitted_at":"2022-04-14T13:55:21Z","title":"Planting Undetectable Backdoors in Machine Learning Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.06974","snapshot_observed_at":"2026-08-11T16:59:11.543468Z","title":"Kim, Vinod Vaikuntanathan, and Or Zamir","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.543468Z"},"links":{"cited_paper":"/paper/2204.06974","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ae1838024064da1cd0509bc100deeaa4c76d6a6dd917e73cc24a4011eee0a24e","observation_id":"aadfe69c-ffee-4088-8934-c09dd1de9cb6","resolution":{"observed_at":"2026-08-11T16:59:11.543468Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1702.06280","last_updated":"2017-10-17T11:12:44Z","snapshot_observed_at":"2026-08-14T21:15:34.436979Z","submitted_at":"2017-02-21T07:03:11Z","title":"On the (Statistical) Detection of Adversarial Examples","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1702.06280","snapshot_observed_at":"2026-08-11T16:59:11.547667Z","title":"On the (Statistical) Detection of Adversarial Examples","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.547667Z"},"links":{"cited_paper":"/paper/1702.06280","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:fc0fb9be38e65fe957148ed01bc55048ba3370d04200a4943ddec097869badfa","observation_id":"6bb9200b-ef2d-423a-8ae8-a97217837e3c","resolution":{"observed_at":"2026-08-11T16:59:11.547667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.552170Z","title":"Automated Multi-Turn Red-Teaming with Cascade , October 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.552170Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:b39eb3eae02df6b37ef3515d975c9f968b68fd6d2ed1e017713e1c5be6093947","observation_id":"e1aebca0-e941-4ae0-ad46-6c4b341e1fbb","resolution":{"observed_at":"2026-08-11T16:59:11.552170Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.555495Z","title":"SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.555495Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:baa40b19d2392da371dc3a4897934b95c35c23cf58ece43bc8de47304cee539f","observation_id":"72dc18e0-40be-43c5-b389-02f6512f8397","resolution":{"observed_at":"2026-08-11T16:59:11.555495Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.558780Z","title":"Backdoors as an analogy for deceptive alignment , 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.558780Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:7b8fb42ce52ef58772592d7847eb8ed2b332f4be6b5c43b2906805c5c47b852c","observation_id":"c74993d0-9e8e-482f-926f-6cdf3cc75bc3","resolution":{"observed_at":"2026-08-11T16:59:11.558780Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1907.12138","last_updated":"2019-07-28T20:45:02Z","snapshot_observed_at":"2026-08-15T09:07:17.385684Z","submitted_at":"2019-07-28T20:45:02Z","title":"Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples","version":1},"cited_work":{"arxiv_id":"1907.12138","doi":"10.48550/arxiv.1907.12138","metadata_source":"pith","pith_arxiv_id":"1907.12138","snapshot_observed_at":"2026-08-11T18:16:15.004306Z","title":"Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples","venue":"cs.LG","work_id":"91a081a0-42ca-40c3-9404-0d54a0363924","year":2019},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.562219Z"},"links":{"cited_paper":"/paper/1907.12138","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:a2397c76df55eb61c3ebae7cbd2c3332e70327d7bbad66525d27263173c32e45","observation_id":"fe9d3e11-6cee-4b89-a887-085a6ae0cc40","resolution":{"observed_at":"2026-08-11T16:59:12.252118Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-11T08:20:29.798517Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-11T16:59:11.565993Z","title":"Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.565993Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:4e322be06e1d1fdd05fb88a5cb2df20b1ffd229b5e39cab8a493393a0ff23573","observation_id":"2c63efb2-9cdd-4a50-8b2d-3043cbbbd4ae","resolution":{"observed_at":"2026-08-11T16:59:11.565993Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.569320Z","title":"Gradient hacking","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.569320Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:7ae9a12ada9c7a5c50aec27e6648b08442e8af633839d34134d7e12654c1c36c","observation_id":"094286f2-0ad5-47d3-b92f-8a6c53e2d4f5","resolution":{"observed_at":"2026-08-11T16:59:11.569320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05566","last_updated":"2024-01-17T20:26:01Z","snapshot_observed_at":"2026-08-14T17:02:04.115726Z","submitted_at":"2024-01-10T22:14:35Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05566","snapshot_observed_at":"2026-08-11T16:59:11.572303Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.572303Z"},"links":{"cited_paper":"/paper/2401.05566","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:6e869c5c6758c2edf9b2c35b7c2e959d11002ad7bb85aae290b87be170664d2b","observation_id":"f9a2a7a4-ce46-4277-9f75-39cec7a8164d","resolution":{"observed_at":"2026-08-11T16:59:11.572303Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.10264","last_updated":"2024-08-21T15:12:37Z","snapshot_observed_at":"2026-08-14T14:28:33.560676Z","submitted_at":"2024-07-14T16:12:57Z","title":"What Makes and Breaks Safety Fine-tuning? A Mechanistic Study","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.10264","snapshot_observed_at":"2026-08-11T16:59:11.575679Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.575679Z"},"links":{"cited_paper":"/paper/2407.10264","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:45c3d00f5c77b5eff1fc47b16d7bdeeaa4d5fa67e686f54732c33f712e029d08","observation_id":"c093c635-2b6c-4879-8aa7-3b2d805c3683","resolution":{"observed_at":"2026-08-11T16:59:11.575679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2108.00352","last_updated":"2021-08-01T02:22:31Z","snapshot_observed_at":"2026-08-10T23:08:31.043351Z","submitted_at":"2021-08-01T02:22:31Z","title":"BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2108.00352","snapshot_observed_at":"2026-08-11T16:59:11.579221Z","title":"BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.579221Z"},"links":{"cited_paper":"/paper/2108.00352","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:c6b38980eab555b6ff82c41cc863a42d5216965e2552c2458dd4c2c5b2d775d2","observation_id":"2de280a7-46c0-4a80-9330-481447e77ecb","resolution":{"observed_at":"2026-08-11T16:59:11.579221Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.582197Z","title":"Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.582197Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:03a7fe205162f775a1531edf80a88957d4143cf3fc7dbd50e7296f7a60792fa5","observation_id":"160d0496-f335-4607-bffa-7be83ac0c2ef","resolution":{"observed_at":"2026-08-11T16:59:11.582197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.585314Z","title":"Generating Distributional Adversarial Examples to Evade Statistical Detectors","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.585314Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2242affa2fde2717ecb073048be62389c009918d3e66d908f38b546b75b2f3e8","observation_id":"f21a9e4f-f192-4b56-9ac5-3b90093d910f","resolution":{"observed_at":"2026-08-11T16:59:11.585314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1312.6114","last_updated":"2022-12-10T21:04:00Z","snapshot_observed_at":"2026-08-14T23:50:45.029465Z","submitted_at":"2013-12-20T20:58:10Z","title":"Auto-Encoding Variational Bayes","version":11},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1312.6114","snapshot_observed_at":"2026-08-11T16:59:11.589133Z","title":"Kingma and Max Welling","venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.589133Z"},"links":{"cited_paper":"/paper/1312.6114","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2f26e9b2e444bc91ac6aac71320c239810c2834b7640bd2b3278afb3f108ea1f","observation_id":"e79d9321-d92d-4459-9f02-ce14416434a9","resolution":{"observed_at":"2026-08-11T16:59:11.589133Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.592515Z","title":"What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.592515Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:89001b4ecb293d954c2c0e0ed3d1fb09c0517bff2d035dc80c1ac61e7246d338","observation_id":"ee330ea4-a785-4e82-af08-da58f53f3718","resolution":{"observed_at":"2026-08-11T16:59:11.592515Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.595573Z","title":"SAEs (usually) Transfer Between Base and Chat Models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.595573Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:8e346dcfc79ad1cc25737d34526c1728068abedc5e726be34d7a2d08928786b2","observation_id":"36ff46fd-7f63-4936-a35c-3f3f48fdfdeb","resolution":{"observed_at":"2026-08-11T16:59:11.595573Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2104.08691","last_updated":"2021-09-02T17:34:41Z","snapshot_observed_at":"2026-08-06T15:24:34.790850Z","submitted_at":"2021-04-18T03:19:26Z","title":"The Power of Scale for Parameter-Efficient Prompt Tuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.08691","snapshot_observed_at":"2026-08-11T16:59:11.599567Z","title":"The Power of Scale for Parameter-Efficient Prompt Tuning","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.599567Z"},"links":{"cited_paper":"/paper/2104.08691","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:e9377012672adcbc0cdb3d09c86ac6f361553cc29202e9962a2f9b29b77de885","observation_id":"b01c08d5-4388-4694-9a2a-29a141fc57bf","resolution":{"observed_at":"2026-08-11T16:59:11.599567Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-15T07:52:32.620818Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-11T16:59:11.603469Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.603469Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:57c511e73088563afb66c330ea5671438d89cc3b4715ded60d4b93ebd9a91033","observation_id":"5115691c-caaf-4891-9db6-e8b3d5780a03","resolution":{"observed_at":"2026-08-11T16:59:11.603469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.607066Z","title":"Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.607066Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2b835b64784813d7d33d80099bd5431ba19f17ceb77726e1416e55f413bf6b4d","observation_id":"24e45150-6e19-416c-b93d-3936fc5af50b","resolution":{"observed_at":"2026-08-11T16:59:11.607066Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.610276Z","title":"BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.610276Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:75b10dcf2a62ec6c39ee556bbc86eb1914d93aca0656aa47661f63304c81ac1d","observation_id":"cc526e77-b464-4c21-b3d7-569ca5bde8fa","resolution":{"observed_at":"2026-08-11T16:59:11.610276Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.05147","last_updated":"2024-08-19T07:51:05Z","snapshot_observed_at":"2026-08-14T07:41:23.271562Z","submitted_at":"2024-08-09T16:06:42Z","title":"Gemma Scope: Open Sparse Autoencoders Everywhere All At Once on Gemma 2","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.05147","snapshot_observed_at":"2026-08-11T16:59:11.613283Z","title":"Gemma scope: Open sparse autoencoders everywhere all at once on gemma 2","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.613283Z"},"links":{"cited_paper":"/paper/2408.05147","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:d96b3b6fcd6b560b03579970d492a7d451c1f382751912616489a51c0ee38a92","observation_id":"5a353bad-f017-47ec-beb5-637d5233e086","resolution":{"observed_at":"2026-08-11T16:59:11.613283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.616565Z","title":"Neuronpedia: Interactive Reference and Tooling for Analyzing Neural Networks , 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.616565Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:6b0061c0b62acba720148760fe99d603d9af01ae86e416b3ca173d3ba739eb75","observation_id":"84d0be1d-efd5-47e1-80cf-6b0177c47886","resolution":{"observed_at":"2026-08-11T16:59:11.616565Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-11T16:59:11.619662Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.619662Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:63a2f09788f2abc29ea54cb3d46a257a268d366ad54498e54652e16eeef2311f","observation_id":"8fb9a391-e95c-462a-963e-a525e7c51870","resolution":{"observed_at":"2026-08-11T16:59:11.619662Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.623124Z","title":"Piccolo: Exposing Complex Backdoors in NLP Transformer Models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.623124Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2bf89b407f855e62ca9741b4b2c041046a35329e53709474885ba49bcf1ba2e1","observation_id":"972924e2-e936-4619-bc0f-b3e58303615e","resolution":{"observed_at":"2026-08-11T16:59:11.623124Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.11715","last_updated":"2022-12-19T04:02:37Z","snapshot_observed_at":"2026-08-13T14:20:17.148194Z","submitted_at":"2022-09-23T16:47:19Z","title":"The \"Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matrices","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.11715","snapshot_observed_at":"2026-08-11T16:59:11.626531Z","title":"The ``Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matrices","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.626531Z"},"links":{"cited_paper":"/paper/2209.11715","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:1a6918e61e60698c39b10cf3be2b3b73b505e108d945b133d98218696163b5ec","observation_id":"9f89346a-2820-491a-92b0-d56708a8f09e","resolution":{"observed_at":"2026-08-11T16:59:11.626531Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1801.02613","last_updated":"2018-03-14T07:24:10Z","snapshot_observed_at":"2026-08-14T19:56:59.076369Z","submitted_at":"2018-01-08T18:54:40Z","title":"Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1801.02613","snapshot_observed_at":"2026-08-11T16:59:11.630217Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.630217Z"},"links":{"cited_paper":"/paper/1801.02613","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:b9099a7dab96c0bbd6a9ba2af1a4e79efe4637754e8bce9ae304632a48f086dc","observation_id":"eb21202b-0928-4cdb-9708-79ae06d21e29","resolution":{"observed_at":"2026-08-11T16:59:11.630217Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.633396Z","title":"Simple probes can catch sleeper agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.633396Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:a4fab8511871572f8be60aa89b39fcc099f053129474fa602563c9bad715a8d6","observation_id":"0af454d7-7518-439a-b9d9-1c1ee6580c89","resolution":{"observed_at":"2026-08-11T16:59:11.633396Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.636341Z","title":"Deep Causal Transcoding: A Framework for Mechanistically Eliciting Latent Behaviors in Language Models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.636341Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:7dde341fe157ab67c9ef2a18cc60a0eb4e20c1b1107de6c0d7000b5ca464d835","observation_id":"1ac81dae-25c1-4374-a378-f22950205d7d","resolution":{"observed_at":"2026-08-11T16:59:11.636341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.639563Z","title":null,"venue":null,"work_id":null,"year":1936},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.639563Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:5fc5ad28864ce62841f1aabf38f947f6e773a0bc3cc0b9a20936d63b2a572652","observation_id":"d3f132ba-7d39-4524-a8da-f8b6a80a6b02","resolution":{"observed_at":"2026-08-11T16:59:11.639563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.642814Z","title":"Is This the Subspace You Are Looking for? An Interpretability Illusion for Subspace Activation Patching","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.642814Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:8d204ed940d046bfa9907501e669832821eb3c0d446134b3182b7dff6f512058","observation_id":"060896e8-446b-4d6d-95a2-555d291a6863","resolution":{"observed_at":"2026-08-11T16:59:11.642814Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.01037","last_updated":"2024-08-09T17:51:15Z","snapshot_observed_at":"2026-08-15T10:49:16.498414Z","submitted_at":"2023-12-02T05:47:22Z","title":"Eliciting Latent Knowledge from Quirky Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.01037","snapshot_observed_at":"2026-08-11T16:59:11.645830Z","title":"Eliciting Latent Knowledge from Quirky Language Models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.645830Z"},"links":{"cited_paper":"/paper/2312.01037","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:8a3422154976c2fc4664e9e3bfc0f60001df6f066799baad12335abb76e11866","observation_id":"6381687a-f8ba-4fe1-98c4-bfc07fdeca29","resolution":{"observed_at":"2026-08-11T16:59:11.645830Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06824","last_updated":"2024-08-19T01:18:41Z","snapshot_observed_at":"2026-07-06T16:30:37.867641Z","submitted_at":"2023-10-10T17:54:39Z","title":"The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06824","snapshot_observed_at":"2026-08-11T16:59:11.649420Z","title":"The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets , 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.649420Z"},"links":{"cited_paper":"/paper/2310.06824","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:4568cf6668a9d12e43a0ff5d0ac9ecce12663e42114bd59db08a991bdee93f10","observation_id":"8f9b3ec4-de69-4a3d-8543-91cd9cea82ca","resolution":{"observed_at":"2026-08-11T16:59:11.649420Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.19647","last_updated":"2025-03-27T05:44:45Z","snapshot_observed_at":"2026-08-14T07:35:01.333549Z","submitted_at":"2024-03-28T17:56:07Z","title":"Sparse Feature Circuits: Discovering and Editing Interpretable Causal Graphs in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.19647","snapshot_observed_at":"2026-08-11T16:59:11.652846Z","title":"Sparse feature circuits: Discovering and editing interpretable causal graphs in language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.652846Z"},"links":{"cited_paper":"/paper/2403.19647","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:71661c489d4b805a9afce70a599f5ff0d5b8fa63a208d65ce031bbb6c021cdfd","observation_id":"a5381cfd-d3ce-4df9-8b8c-c0397fdf949b","resolution":{"observed_at":"2026-08-11T16:59:11.652846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1702.04267","last_updated":"2017-02-21T06:53:38Z","snapshot_observed_at":"2026-08-14T21:16:31.936442Z","submitted_at":"2017-02-14T15:44:26Z","title":"On Detecting Adversarial Perturbations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1702.04267","snapshot_observed_at":"2026-08-11T16:59:11.656581Z","title":"On Detecting Adversarial Perturbations","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.656581Z"},"links":{"cited_paper":"/paper/1702.04267","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:befac0551c94386b13b1e41f16b704444c1c2772785fa6d7b78feb5ea7486ce5","observation_id":"60eaeec0-91c2-469c-b1cb-9fb6d79a4b1b","resolution":{"observed_at":"2026-08-11T16:59:11.656581Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06681","last_updated":"2024-07-05T15:30:45Z","snapshot_observed_at":"2026-08-15T08:04:06.283165Z","submitted_at":"2023-12-09T04:40:46Z","title":"Steering Llama 2 via Contrastive Activation Addition","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06681","snapshot_observed_at":"2026-08-11T16:59:11.663606Z","title":"Steering Llama 2 via Contrastive Activation Addition","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.663606Z"},"links":{"cited_paper":"/paper/2312.06681","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:17acbc5a966f96fe845e9b035f8694fe076d731cdf62aefb64e73173cee29dce","observation_id":"926200f6-1a52-47bf-acbe-95fadef3d622","resolution":{"observed_at":"2026-08-11T16:59:11.663606Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1609/aaai.v35i15.17612","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:12.103156Z","title":"Revisiting Mahalanobis Distance for Transformer-Based Out-of-Domain Detection","venue":null,"work_id":"ac406169-4776-4732-859d-e4af1134538f","year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.667314Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:b4a07654242191e4582e62114e2659741a85a904b74d731e957e9dd677b67f73","observation_id":"6d81f312-e153-4cf1-b700-1b9e621a2301","resolution":{"observed_at":"2026-08-11T16:59:12.106814Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04108","last_updated":"2024-12-23T19:24:44Z","snapshot_observed_at":"2026-08-13T06:59:40.107733Z","submitted_at":"2024-07-04T18:24:09Z","title":"Future Events as Backdoor Triggers: Investigating Temporal Vulnerabilities in LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04108","snapshot_observed_at":"2026-08-11T16:59:11.670440Z","title":"Future Events as Backdoor Triggers: Investigating Temporal Vulnerabilities in LLMs","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.670440Z"},"links":{"cited_paper":"/paper/2407.04108","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:86cb032646716a2fe324f3d0820fb2286b0e3a19f2e506ed029898112e53f2a0","observation_id":"f26cb0aa-e5c2-403d-bdb1-00ccba7e67ed","resolution":{"observed_at":"2026-08-11T16:59:11.670440Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2205.13613","last_updated":"2023-03-04T03:53:50Z","snapshot_observed_at":"2026-08-13T15:35:44.958472Z","submitted_at":"2022-05-26T20:40:50Z","title":"Circumventing Backdoor Defenses That Are Based on Latent Separability","version":3},"cited_work":{"arxiv_id":"2205.13613","doi":"10.48550/arxiv.2205.13613","metadata_source":"pith","pith_arxiv_id":"2205.13613","snapshot_observed_at":"2026-08-11T18:16:15.004306Z","title":"Circumventing Backdoor Defenses That Are Based on Latent Separability","venue":"cs.LG","work_id":"e0f53cf3-aa27-495d-a67b-05c0cff638bd","year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.673715Z"},"links":{"cited_paper":"/paper/2205.13613","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:3596b2867a69c7474377b1f58ddd89c774e1c1f7d91314f347ea37b32ae5a40c","observation_id":"d011d69b-c5e1-42d3-b97b-182d9f2f4046","resolution":{"observed_at":"2026-08-11T16:59:12.084155Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.677266Z","title":"A General Framework For Detecting Anomalous Inputs to DNN Classifiers","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.677266Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:57e562ae399a0120705e07a8d6c4343a056bd7d82b9ccafe30c3faf70bfff02e","observation_id":"0d515b3b-34d8-4400-af3f-a065dbdc9047","resolution":{"observed_at":"2026-08-11T16:59:11.677266Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.14577","last_updated":"2024-10-30T22:58:40Z","snapshot_observed_at":"2026-08-12T23:59:50.265846Z","submitted_at":"2024-05-23T13:51:55Z","title":"Representation Noising: A Defence Mechanism Against Harmful Finetuning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.14577","snapshot_observed_at":"2026-08-11T16:59:11.680413Z","title":"Representation noising effectively prevents harmful fine-tuning on LLMs","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.680413Z"},"links":{"cited_paper":"/paper/2405.14577","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ed873423b7bd4ffaf339ba7f89e5fb7663ca8750da65f8df952a89f64ae72ef6","observation_id":"94794b8a-9fe5-48aa-937b-9906fb19ad23","resolution":{"observed_at":"2026-08-11T16:59:11.680413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01263","last_updated":"2024-04-01T11:50:35Z","snapshot_observed_at":"2026-08-14T04:19:38.572552Z","submitted_at":"2023-08-02T16:30:40Z","title":"XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01263","snapshot_observed_at":"2026-08-11T16:59:11.685411Z","title":"Xstest: A test suite for identifying exaggerated safety behaviours in large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.685411Z"},"links":{"cited_paper":"/paper/2308.01263","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ebd26971c54485ce97139657f161b15e5e8c202b20c348c36687c00c188ac74c","observation_id":"7b96c86c-c1e5-4224-944f-0a0c50d0ed41","resolution":{"observed_at":"2026-08-11T16:59:11.685411Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.689653Z","title":"Public comment: Robustness evaluation seems invalid , 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.689653Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:e6dc5100a91f6cb9cdf9afc993a0dad56826f549cd1d0d34e12878d433a16c29","observation_id":"b57e636d-449d-4f02-b514-2a7b3bb47cda","resolution":{"observed_at":"2026-08-11T16:59:11.689653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15902","last_updated":"2024-08-02T12:02:47Z","snapshot_observed_at":"2026-08-14T06:20:11.290155Z","submitted_at":"2024-07-22T11:53:48Z","title":"Revisiting the Robust Alignment of Circuit Breakers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.15902","snapshot_observed_at":"2026-08-11T16:59:11.693516Z","title":"Revisiting the Robust Alignment of Circuit Breakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.693516Z"},"links":{"cited_paper":"/paper/2407.15902","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:5455539d18a2ae9a016240f665eb2d33c56923c087302ae394f8acbb6b7e1fa6","observation_id":"07c7a426-0484-4dd1-883e-d3af608ed365","resolution":{"observed_at":"2026-08-11T16:59:11.693516Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.11415","last_updated":"2022-12-21T23:52:42Z","snapshot_observed_at":"2026-08-14T01:16:12.466370Z","submitted_at":"2022-12-21T23:52:42Z","title":"Circumventing interpretability: How to defeat mind-readers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.11415","snapshot_observed_at":"2026-08-11T16:59:11.697137Z","title":"Circumventing interpretability: How to defeat mind-readers","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.697137Z"},"links":{"cited_paper":"/paper/2212.11415","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:761eaf63b361b9247ad99d71380f35bca60d80ca8ce064d9f5fe41e262970f47","observation_id":"b559814d-bf1f-4f1b-ba82-4beb643b4ba5","resolution":{"observed_at":"2026-08-11T16:59:11.697137Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-08-15T06:11:28.424821Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-11T16:59:11.700722Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.700722Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:d583b3afc90b711afd8f107c77d68cfd9902cda566f585a7802dec80f8b5774d","observation_id":"ac3eb96e-f440-4bf5-9fec-23fd00fcebe3","resolution":{"observed_at":"2026-08-11T16:59:11.700722Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.11958","last_updated":"2022-11-22T02:35:12Z","snapshot_observed_at":"2026-08-13T13:37:47.419001Z","submitted_at":"2022-11-22T02:35:12Z","title":"A Survey on Backdoor Attack and Defense in Natural Language Processing","version":1},"cited_work":{"arxiv_id":"2211.11958","doi":"10.48550/arxiv.2211.11958","metadata_source":"pith","pith_arxiv_id":"2211.11958","snapshot_observed_at":"2026-08-11T18:16:15.004306Z","title":"A Survey on Backdoor Attack and Defense in Natural Language Processing","venue":"cs.CL","work_id":"a17ffbbd-162f-44f3-96bb-2421d863c22c","year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.704056Z"},"links":{"cited_paper":"/paper/2211.11958","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:3ffb94dbf87462e43ff47d6aa6374d05ed8b9fb618dfbe327f8fa85e74c210dc","observation_id":"379e0092-c038-46bc-ba94-95b0b9927df2","resolution":{"observed_at":"2026-08-11T16:59:12.032937Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15549","last_updated":"2025-07-29T09:37:22Z","snapshot_observed_at":"2026-08-13T08:22:02.023626Z","submitted_at":"2024-07-22T11:19:14Z","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.15549","snapshot_observed_at":"2026-08-11T16:59:11.707549Z","title":"Targeted latent adversarial training improves robustness to persistent harmful behaviors in llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.707549Z"},"links":{"cited_paper":"/paper/2407.15549","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:453780b8deaf12ff3a60df2d7b5e49780a290d9c91c09516b4b35a7a649f6c7d","observation_id":"bb6e60a6-6a20-40f9-9315-c36b3ce69e79","resolution":{"observed_at":"2026-08-11T16:59:11.707549Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.10260","last_updated":"2024-08-27T03:32:47Z","snapshot_observed_at":"2026-08-04T21:32:35.483431Z","submitted_at":"2024-02-15T18:58:09Z","title":"A StrongREJECT for Empty Jailbreaks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.10260","snapshot_observed_at":"2026-08-11T16:59:11.711141Z","title":"A StrongREJECT for empty jailbreaks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.711141Z"},"links":{"cited_paper":"/paper/2402.10260","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:182f3bcd09db85c661b9a14800024c44a66d81ac43bb1f242a4b7b12684ae761","observation_id":"ca3f3d39-4dfc-4eba-bcab-548c2544b76f","resolution":{"observed_at":"2026-08-11T16:59:11.711141Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.714736Z","title":"Few-shot out of domain intent detection with covariance corrected Mahalanobis distance , 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.714736Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:efecdaf8b956ea4c66ae22087c2abb1d23dca70815689f76480ef785da3fea1f","observation_id":"01d15feb-b7a8-4d0b-94b8-629a9cb20710","resolution":{"observed_at":"2026-08-11T16:59:11.714736Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.17230","last_updated":"2023-10-26T08:28:48Z","snapshot_observed_at":"2026-08-13T05:40:04.482565Z","submitted_at":"2023-10-26T08:28:48Z","title":"Codebook Features: Sparse and Discrete Interpretability for Neural Networks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.17230","snapshot_observed_at":"2026-08-11T16:59:11.718227Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.718227Z"},"links":{"cited_paper":"/paper/2310.17230","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:aeab6982caccd23b59595774b5125862972f9f88ca9e3afd5eb6cafaeb6dfe2d","observation_id":"008ecee1-61b6-4461-b843-4c969bf2b182","resolution":{"observed_at":"2026-08-11T16:59:11.718227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.12404","last_updated":"2025-05-04T23:07:56Z","snapshot_observed_at":"2026-08-12T23:20:31.291372Z","submitted_at":"2024-07-17T08:32:03Z","title":"Analyzing the Generalization and Reliability of Steering Vectors","version":8},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.12404","snapshot_observed_at":"2026-08-11T16:59:11.722044Z","title":"Analyzing the Generalization and Reliability of Steering Vectors","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":91,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.722044Z"},"links":{"cited_paper":"/paper/2407.12404","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:23267b55ee5d90706320bf058996507fc63f13f62948ebc87ac71d349ca3f7e8","observation_id":"7e3f88a3-6668-48dc-babd-833c6eddda01","resolution":{"observed_at":"2026-08-11T16:59:11.722044Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.726332Z","title":"Bypassing Backdoor Detection Algorithms in Deep Learning","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.726332Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:6df8098d7a637f7b117b9e41b763b089cd2e7094d8262b7bfca60f1b0471d10c","observation_id":"37e91562-d27f-418d-bee3-8df1dd0879e6","resolution":{"observed_at":"2026-08-11T16:59:11.726332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.729476Z","title":"Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.729476Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:2a80e0b58ecb0539a3a807f8be815c769742d7a3d62b4af34b32cf80d53ff369","observation_id":"70a508bc-3cac-44d9-94b9-162770d43f53","resolution":{"observed_at":"2026-08-11T16:59:11.729476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.732772Z","title":"Distribution Preserving Backdoor Attack in Self-supervised Learning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":94,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.732772Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:23463cd7c9d505cf911ea681d2ea91c3b8392a1b926b5ea2531a22b4452f4820","observation_id":"f1c385ed-26c8-44cb-b215-2c25cbc6cb32","resolution":{"observed_at":"2026-08-11T16:59:11.732772Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.735899Z","title":"Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":95,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.735899Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:edddf376137604dd884d6d744bd98b640ed7a2b73d427742bb940ae2be88b522","observation_id":"0eb0af25-1452-455b-a4b0-0cf231e08ac6","resolution":{"observed_at":"2026-08-11T16:59:11.735899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.739009Z","title":"Daniel Freeman, Theodore R","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":96,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.739009Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:10e0312ceb69bb18e5c2d1408b9e9526c32875febbfaf45099daa5ad2c3703bc","observation_id":"be33ab39-7ac7-4f30-a755-e106263caf2a","resolution":{"observed_at":"2026-08-11T16:59:11.739009Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.17447","last_updated":"2024-10-01T17:39:09Z","snapshot_observed_at":"2026-08-12T23:15:27.375645Z","submitted_at":"2024-07-24T17:23:18Z","title":"FLRT: Fluent Student-Teacher Redteaming","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.17447","snapshot_observed_at":"2026-08-11T16:59:11.742385Z","title":"FLRT : Fluent Student-Teacher Redteaming","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":97,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.742385Z"},"links":{"cited_paper":"/paper/2407.17447","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:9923c1cbe6f3407ed6e7d0789d8a3e73236ab84a39812723ef9be0877bc247e4","observation_id":"3dc1bfcd-25ce-4af1-a9aa-a1de9df8383a","resolution":{"observed_at":"2026-08-11T16:59:11.742385Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.15213","last_updated":"2024-02-25T18:32:18Z","snapshot_observed_at":"2026-08-13T05:42:53.020730Z","submitted_at":"2023-10-23T17:55:24Z","title":"Function Vectors in Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.15213","snapshot_observed_at":"2026-08-11T16:59:11.745884Z","title":"Li, Arnab Sen Sharma, Aaron Mueller, Byron C","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":98,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.745884Z"},"links":{"cited_paper":"/paper/2310.15213","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:d7ab7354f1b4bab7024092cec7033ba54f758b0b360431810ee9b4275bb83708","observation_id":"3b7fdaa0-9504-4ad8-8883-50997517749a","resolution":{"observed_at":"2026-08-11T16:59:11.745884Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.750028Z","title":"Spectral Signatures in Backdoor Attacks","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":99,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.750028Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:e1fabfb6cf29427c5a4d44c4c426589b9c6e019f1ab0d8a1c54b93c6cb0542a8","observation_id":"0f68f8ff-ba12-4d2a-91b2-c2f0322f7082","resolution":{"observed_at":"2026-08-11T16:59:11.750028Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.10248","last_updated":"2024-10-10T13:20:13Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-08-20T12:21:05Z","title":"Steering Language Models With Activation Engineering","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.10248","snapshot_observed_at":"2026-08-11T16:59:11.753512Z","title":"Vazquez, Ulisse Mini, and Monte MacDiarmid","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":100,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.753512Z"},"links":{"cited_paper":"/paper/2308.10248","citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:ff94b3ec35cbc2820c9bc4b8ce815825e08d93b9edc5d6124ecf19045b20189c","observation_id":"2da1de87-7f6e-44c0-8648-16b45ab1c789","resolution":{"observed_at":"2026-08-11T16:59:11.753512Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T16:59:11.757096Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","version":2},"reference_index":101,"source":"arxiv_source","source_observed_at":"2026-08-11T16:59:11.757096Z"},"links":{"citing_paper":"/paper/2412.09565"},"observation_digest":"sha256:4218628b634c06e29b8818ddab5813a6abfdcf7fe49de4d7be4995dc1d79a37c","observation_id":"7b69fb0a-f2a8-47f9-94ef-8ac776967154","resolution":{"observed_at":"2026-08-11T16:59:11.757096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2412.09565","last_updated":"2025-02-08T23:58:36Z","latest_version":2,"primary_category":"cs.LG","snapshot_observed_at":"2026-08-12T22:00:21.320460Z","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":96,"verified_exact":4,"verified_fuzzy":0},"total_outbound_references":114},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 15 August 2026, this Paper Citation Record lists 100 of 114 outbound references and 12 inbound Pith citation observations for arXiv:2412.09565."}