{"as_of":"2026-08-19T11:26:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:cecadc74626d1c1479106eaa42b7423c5cd044da730b6eb1b09e6b3938b60747","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-11T05:02:26.737170Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-19T06:32:44.657259+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2412.18171/citation-record","integrity":"/paper/2412.18171/integrity","json":"/paper/2412.18171/citation-record.json","paper":"/paper/2412.18171"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.204826Z","title":"Jailbreak chat, 2023","venue":null,"work_id":"7b361b0a-e4d1-44ec-af94-740fb93de557","year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.602837Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:ea25f86b0e7c072e0c3ab51256ed3113432e32d36b45e9e60cfe40362f282490","observation_id":"c677173e-3af0-4e00-9e18-99c5cee50232","resolution":{"observed_at":"2026-08-11T05:02:27.210335Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.187837Z","title":"Many-shot jailbreaking","venue":null,"work_id":"cb7e83ba-a06c-4cb1-81df-cc67d59d6921","year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.608044Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:3cca1c97d24dd4667b010926817846309f01fa8103affa97b8056131dd5c6c6a","observation_id":"2bdcac9a-1dcc-40fa-a639-35a2edad71c8","resolution":{"observed_at":"2026-08-11T05:02:27.193034Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2112.00861","last_updated":"2021-12-09T21:40:22Z","snapshot_observed_at":"2026-08-10T12:03:10.373653Z","submitted_at":"2021-12-01T22:24:34Z","title":"A General Language Assistant as a Laboratory for Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.00861","snapshot_observed_at":"2026-08-11T05:02:26.612486Z","title":"Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.612486Z"},"links":{"cited_paper":"/paper/2112.00861","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:8dc7094909a5d9d6f7c63f496b2b66ddfd777b09e12102292b0d12ab7c68bf14","observation_id":"ed4625c8-4b10-4fcf-99c2-8e9cd67c9e9f","resolution":{"observed_at":"2026-08-11T05:02:26.612486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-11T05:02:26.617889Z","title":"Brown, Jack Clark, Sam McCandlish, Chris Olah, Benjamin Mann, and Jared Kaplan","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.617889Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:d7cf1b30daf2d605b2a73de4a2e3724dc84222f7fd05d0c30bb0dbf316105802","observation_id":"56408827-6197-47a7-9f04-0525fcbcc1d5","resolution":{"observed_at":"2026-08-11T05:02:26.617889Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-16T13:08:51.920120Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-11T05:02:26.622921Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.622921Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:a5a6b64d66541a75da30e103964668fec6b551905ed0443ee37ea3c765b98b8b","observation_id":"ff102511-77bf-4ea2-baf5-28278e09193d","resolution":{"observed_at":"2026-08-11T05:02:26.622921Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.628462Z","title":"Zico Kolter","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.628462Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:5a2b06f1acd1d70c88b14987e6249f30ed03fd42698220336b4311f9734c3c2f","observation_id":"e67b2e6f-940d-4cd7-b311-a9fea92fd7ea","resolution":{"observed_at":"2026-08-11T05:02:26.628462Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.00867","last_updated":"2024-11-07T15:41:38Z","snapshot_observed_at":"2026-08-16T17:36:38.507595Z","submitted_at":"2024-03-01T03:29:54Z","title":"Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.00867","snapshot_observed_at":"2026-08-11T05:02:26.636480Z","title":"Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.636480Z"},"links":{"cited_paper":"/paper/2403.00867","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:4d6920a0d2fa24b095f162ad91bc2bfbd9737bd9159f73c53f827e140f22f460","observation_id":"8650b5b1-c9da-4ab9-a493-c439f712182c","resolution":{"observed_at":"2026-08-11T05:02:26.636480Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-11T05:02:26.641984Z","title":"Baseline defenses for adversarial attacks against aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.641984Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:20e48503ce1581685263bb1335b9c1ca8ea878bb42333ab0d366dcf909052fcc","observation_id":"645c60a9-f761-4276-8439-7c42712e7687","resolution":{"observed_at":"2026-08-11T05:02:26.641984Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16192","last_updated":"2024-02-28T23:11:33Z","snapshot_observed_at":"2026-08-19T03:06:30.029191Z","submitted_at":"2024-02-25T20:36:03Z","title":"Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16192","snapshot_observed_at":"2026-08-11T05:02:26.647309Z","title":"Pappas, Hamed Hassani, Yang Zhang, Eric Wong, and Shiyu Chang","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.647309Z"},"links":{"cited_paper":"/paper/2402.16192","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:e9f24394685726216d9861ef4ee3bb20a540bb83ca3fe14a2eec3b1ada26f0ff","observation_id":"3d791c1c-8193-4918-8d71-e8b36fb2084b","resolution":{"observed_at":"2026-08-11T05:02:26.647309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.00731","last_updated":"2022-12-21T10:15:52Z","snapshot_observed_at":"2026-08-17T03:04:22.561631Z","submitted_at":"2022-09-01T21:16:47Z","title":"In conversation with Artificial Intelligence: aligning language models with human values","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.00731","snapshot_observed_at":"2026-08-11T05:02:26.652362Z","title":"In conversation with artificial intelligence: aligning language models with human values","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.652362Z"},"links":{"cited_paper":"/paper/2209.00731","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:72d4a77ca91ba5dfbcf72483bc950b6ec7825ac6799682d4645ee511af17fc96","observation_id":"97e0fba1-631f-4d0a-8258-a37b74dfb516","resolution":{"observed_at":"2026-08-11T05:02:26.652362Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-16T15:02:58.647281Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T05:02:26.657326Z","title":"Certifying LLM safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.657326Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:00818f8d67c45b9150a8359339fa09d82a0aea51edabbd6ed28e742eaef64e44","observation_id":"1c8e2bfd-f142-4877-9547-c03c44f799ff","resolution":{"observed_at":"2026-08-11T05:02:26.657326Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.662444Z","title":"Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.662444Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:ca1cbc3044c07b2e59c62ebf1c2e58d46926fbe5df0db8eb2974ca093ca1b8ab","observation_id":"7b140455-dd06-4910-b29d-8ab790cfb8e2","resolution":{"observed_at":"2026-08-11T05:02:26.662444Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-16T14:36:14.029419Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-11T05:02:26.666965Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.666965Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:983b3905537091da2adfea5676d21416971b00f2eaba00bbb5de23d8c210717c","observation_id":"075521c8-5206-4dc9-8aef-627e16dff426","resolution":{"observed_at":"2026-08-11T05:02:26.666965Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.02119","last_updated":"2024-10-31T15:57:42Z","snapshot_observed_at":"2026-08-18T18:32:32.343266Z","submitted_at":"2023-12-04T18:49:23Z","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.02119","snapshot_observed_at":"2026-08-11T05:02:26.671653Z","title":"Tree of attacks: Jailbreaking black-box llms automatically","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.671653Z"},"links":{"cited_paper":"/paper/2312.02119","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:869a447c2d35411e1d0e0ecb595fbed60e41f4569690406dfe290fa0c7a6d51e","observation_id":"a911f54d-ba12-4e5b-8d85-e511243ac224","resolution":{"observed_at":"2026-08-11T05:02:26.671653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-17T09:58:46.058102Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-11T05:02:26.676403Z","title":"GPT-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.676403Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:5270049df083409ed4b3adb0493c6014819ec7196ee83f70297f452b78e4b083","observation_id":"9ad325b4-1779-4699-9b1e-c7a1caff0cd2","resolution":{"observed_at":"2026-08-11T05:02:26.676403Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.680836Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.680836Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:45769e392febf7039307d107b61fead362e130aceec6f0a2e5a10a32a0be8dfc","observation_id":"ee63dac9-75b2-40a1-a3c9-fc2b32be6e06","resolution":{"observed_at":"2026-08-11T05:02:26.680836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-08-17T15:25:03.596568Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-11T05:02:26.685499Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.685499Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:fc44eb11093fc4a1245e5d031a02731e7332fe8fea4748130449b8945a9c8ae9","observation_id":"6a547d90-4968-4506-bec3-884520f865a9","resolution":{"observed_at":"2026-08-11T05:02:26.685499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.138791Z","title":"Meta llama guard 2","venue":null,"work_id":"e252de84-f693-4b64-9147-59166d184591","year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.690411Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:fac259b9a10f3a3c649070689a3fc7e9b662839c009f966c18ffdcf2f0b743fe","observation_id":"f71874a8-ebff-49e2-9cef-d38c56c5993a","resolution":{"observed_at":"2026-08-11T05:02:27.143996Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-11T05:02:26.694550Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.694550Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:c928d28bdc0c355e8430e79d60e5640cf26f65124fe0f341a8052a9563a3e540","observation_id":"f3ed272b-8902-4467-8ba7-cbc6f834e443","resolution":{"observed_at":"2026-08-11T05:02:26.694550Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.120308Z","title":"On adaptive attacks to adversarial example defenses","venue":null,"work_id":"f9254189-f9f4-45bb-9406-a631c2925d6f","year":2020},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.699213Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:e246b2f42f6458cf0b7a46da53439bbb521ea68bd39c1e8b84be99eb08d35d6a","observation_id":"24f12a02-e1fd-413c-b2b6-125962a7e667","resolution":{"observed_at":"2026-08-11T05:02:27.127315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.00287","last_updated":"2023-12-30T17:37:06Z","snapshot_observed_at":"2026-08-16T14:30:44.183234Z","submitted_at":"2023-12-30T17:37:06Z","title":"The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensiveness","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.00287","snapshot_observed_at":"2026-08-11T05:02:26.704127Z","title":"The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.704127Z"},"links":{"cited_paper":"/paper/2401.00287","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:1169a09b80cfd24ebf5560f1fe24e2d187fda2ea044d937ff91b36be95191dea","observation_id":"c05bef07-2c6a-456a-982d-140b59fd6193","resolution":{"observed_at":"2026-08-11T05:02:26.704127Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-15T10:16:52.688429Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-11T05:02:26.708733Z","title":"Jailbroken: How does LLM safety training fail? CoRR, abs/2307.02483, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.708733Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:01d0449570844c6b13a16eeae654e7b2a497fd4ad39036a1f55dd57d9d7b31b5","observation_id":"d013308c-9204-477e-baa9-9634be07d53f","resolution":{"observed_at":"2026-08-11T05:02:26.708733Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-16T14:53:33.115609Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-11T05:02:26.713244Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.713244Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:84f8f429a3fe594ec609714327aab3052114d2de838f7c5fa78ba0218c998e10","observation_id":"4cfd5c5e-551a-4de1-8066-5a1b12d2d127","resolution":{"observed_at":"2026-08-11T05:02:26.713244Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.717626Z","title":"Defending chatgpt against jailbreak attack via self-reminders","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.717626Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:bd33c7fb8523328ca28a6b1d5df2f662ea9074f67b1b5867ea134f4d3815338e","observation_id":"ca6d1489-5ced-474a-8e7d-577eed24b3d7","resolution":{"observed_at":"2026-08-11T05:02:26.717626Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06561","last_updated":"2024-12-16T08:43:24Z","snapshot_observed_at":"2026-08-16T14:27:57.381603Z","submitted_at":"2024-01-12T13:15:05Z","title":"Intention Analysis Makes LLMs A Good Jailbreak Defender","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06561","snapshot_observed_at":"2026-08-11T05:02:26.721836Z","title":"Intention analysis prompting makes large language models A good jailbreak defender","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.721836Z"},"links":{"cited_paper":"/paper/2401.06561","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:ff9ac4fa6eb4200625f8937a4047b1c95ed70dea4a972147072ea136eb1ea56c","observation_id":"96517cfd-8eb1-44e3-9180-34792e08cc7a","resolution":{"observed_at":"2026-08-11T05:02:26.721836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.17256","last_updated":"2025-07-23T18:43:18Z","snapshot_observed_at":"2026-08-16T14:23:07.919279Z","submitted_at":"2024-01-30T18:48:37Z","title":"Weak-to-Strong Jailbreaking on Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.17256","snapshot_observed_at":"2026-08-11T05:02:26.726743Z","title":"Weak-to-strong jailbreaking on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.726743Z"},"links":{"cited_paper":"/paper/2401.17256","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:6e0104a60906a1acb52dfc0c949f0768b08fc48234dfc1da727065cc43c3e102","observation_id":"aa3158fe-f488-43ef-95d9-92f6ee752848","resolution":{"observed_at":"2026-08-11T05:02:26.726743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05685","last_updated":"2023-12-24T02:01:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-06-09T05:55:52Z","title":"Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05685","snapshot_observed_at":"2026-08-11T05:02:26.731586Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.731586Z"},"links":{"cited_paper":"/paper/2306.05685","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:71084bcc272b9e056076ca7dac945b9ea8c18bc30a2e070ea563e77aa70312a2","observation_id":"da5016f6-9b03-45a2-9b57-6e64ba5be173","resolution":{"observed_at":"2026-08-11T05:02:26.731586Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-11T05:02:26.737170Z","title":"I´m sorry","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.737170Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:68caf839570208e64a583b09876cfecf4c23ecc309f84c36987144e64b81fb9b","observation_id":"5c61f57e-1e38-46d9-a149-a2537f73272a","resolution":{"observed_at":"2026-08-11T05:02:26.737170Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":24,"verified_exact":0,"verified_fuzzy":4},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"thesis":"As of 19 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2412.18171."}