{"as_of":"2026-08-11T06:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:c4fd8bbd6b0f90dea6f6c60dfdc34be44e261720854ff7d57d7b114424891cd6","coverage":[{"denominator":84,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":84,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T22:12:00.198263Z","state":"measured"},{"denominator":85,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":85,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T18:05:35.316487Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-05T18:05:36.436186Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"cited_work":{"arxiv_id":"2501.02629","doi":null,"metadata_source":"pith","pith_arxiv_id":"2501.02629","snapshot_observed_at":"2026-08-05T18:05:36.436186Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","venue":"cs.CR","work_id":"76023ef1-c85b-42e3-b19b-b930c62cc936","year":2025},"citing_paper":{"arxiv_id":"2508.15182","last_updated":"2025-08-21T02:39:14Z","snapshot_observed_at":"2026-08-08T01:21:32.994965Z","submitted_at":"2025-08-21T02:39:14Z","title":"SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-05T18:05:35.316487Z"},"links":{"cited_paper":"/paper/2501.02629","citing_paper":"/paper/2508.15182"},"observation_digest":"sha256:124c81bd2c85b7ea22b8611ddad294df452d6d950b62d1fcd64bee309348741b","observation_id":"f617707b-9fa4-4d6c-a559-f94ac80b69f1","resolution":{"observed_at":"2026-08-05T18:05:36.550269Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2501.02629/citation-record","integrity":"/paper/2501.02629/integrity","json":"/paper/2501.02629/citation-record.json","paper":"/paper/2501.02629"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-10T22:11:59.594541Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.594541Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:7cf31b3aa56bcbca974cf4466a70e6d10e8d2094c91f7a6b87610006bf10ec8b","observation_id":"817d811a-bea9-4fe1-b273-ff1dcdfe163d","resolution":{"observed_at":"2026-08-10T22:11:59.594541Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.600755Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.600755Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:30da1f001f0adb80b9c64f9e5dcd59cb0430e4401fa147e34e3e5d399ba6c952","observation_id":"5a9e95b9-c2b2-4e17-8c3c-f595d9c0d4e4","resolution":{"observed_at":"2026-08-10T22:11:59.600755Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.14132","last_updated":"2023-11-07T03:30:15Z","snapshot_observed_at":"2026-07-06T16:10:54.723336Z","submitted_at":"2023-08-27T15:20:06Z","title":"Detecting Language Model Attacks with Perplexity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.14132","snapshot_observed_at":"2026-08-10T22:11:59.604783Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.604783Z"},"links":{"cited_paper":"/paper/2308.14132","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4bfea81c40fd325ebc4bb331c45238b2641e80fc697fef1dbaf09152e338bda7","observation_id":"356aceb4-71db-41d3-b880-1cd1814e0392","resolution":{"observed_at":"2026-08-10T22:11:59.604783Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-10T22:11:59.610569Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.610569Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:311a41db1919597484e16dc6d4a4a5ed258f48c21be8904c626512f6d09169ed","observation_id":"15828501-0fed-494c-9fa3-c892699c1fbd","resolution":{"observed_at":"2026-08-10T22:11:59.610569Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.634527Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.634527Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d49b9d08b13ddd92635bb8222e514fdf801a82279a6c58ac9f9b3c3721f9f48f","observation_id":"5e16a1ca-33e8-44ff-a6bf-b369f1ca77b5","resolution":{"observed_at":"2026-08-10T22:11:59.634527Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2104.08164","last_updated":"2021-09-08T20:44:44Z","snapshot_observed_at":"2026-08-07T07:18:37.623241Z","submitted_at":"2021-04-16T15:24:42Z","title":"Editing Factual Knowledge in Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.08164","snapshot_observed_at":"2026-08-10T22:11:59.639096Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.639096Z"},"links":{"cited_paper":"/paper/2104.08164","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c48087f61899f3cc26614c5892002fac8cf5b95590fc894970d277bf15ca4c91","observation_id":"ef17cfbb-4df1-40e0-8152-4d379e61a309","resolution":{"observed_at":"2026-08-10T22:11:59.639096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02181","last_updated":"2024-07-09T11:59:01Z","snapshot_observed_at":"2026-08-09T22:31:51.167662Z","submitted_at":"2024-03-04T16:23:58Z","title":"Not All Layers of LLMs Are Necessary During Inference","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02181","snapshot_observed_at":"2026-08-10T22:11:59.658968Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.658968Z"},"links":{"cited_paper":"/paper/2403.02181","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:60de8d758b074fe09474d01e63efad2416813a747e84a7315780bc8f19898716","observation_id":"12a3ef82-b907-4768-929f-d1a0b43aae87","resolution":{"observed_at":"2026-08-10T22:11:59.658968Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.14680","last_updated":"2022-10-12T18:01:23Z","snapshot_observed_at":"2026-08-03T05:22:23.916601Z","submitted_at":"2022-03-28T12:26:00Z","title":"Transformer Feed-Forward Layers Build Predictions by Promoting Concepts in the Vocabulary Space","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.14680","snapshot_observed_at":"2026-08-10T22:11:59.667865Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.667865Z"},"links":{"cited_paper":"/paper/2203.14680","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4b848e8e3d7941ade8c57d6d2c870ed3b31c5ea880bd827a03e4eee4a65f4ed6","observation_id":"35c6f668-1b55-442d-9112-f632d59b0cc9","resolution":{"observed_at":"2026-08-10T22:11:59.667865Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2012.14913","last_updated":"2021-09-05T17:32:27Z","snapshot_observed_at":"2026-08-07T23:50:29.977330Z","submitted_at":"2020-12-29T19:12:05Z","title":"Transformer Feed-Forward Layers Are Key-Value Memories","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2012.14913","snapshot_observed_at":"2026-08-10T22:11:59.674481Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.674481Z"},"links":{"cited_paper":"/paper/2012.14913","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:31bb26fbed3de28754b62cc2c23eb1d9a54b84ee6bf8886977f1897666049595","observation_id":"ebd03847-c403-4c5c-9031-fa97a68b597e","resolution":{"observed_at":"2026-08-10T22:11:59.674481Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.14375","last_updated":"2022-09-28T19:04:43Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-09-28T19:04:43Z","title":"Improving alignment of dialogue agents via targeted human judgements","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.14375","snapshot_observed_at":"2026-08-10T22:11:59.681514Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.681514Z"},"links":{"cited_paper":"/paper/2209.14375","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:0fdd8f6b43ebbff8075de6e251b4f4cb17afccf9ff0d9fdaae9fc676cae6f832","observation_id":"1d2263ee-0315-4b3f-bce9-9cbb2f6ab265","resolution":{"observed_at":"2026-08-10T22:11:59.681514Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.17887","last_updated":"2025-03-03T17:02:05Z","snapshot_observed_at":"2026-08-11T02:47:04.813368Z","submitted_at":"2024-03-26T17:20:04Z","title":"The Unreasonable Ineffectiveness of the Deeper Layers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.17887","snapshot_observed_at":"2026-08-10T22:11:59.686596Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.686596Z"},"links":{"cited_paper":"/paper/2403.17887","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:dc956fff2879901327ef27ea436e115139e6652332a95ffdf089f1d5ffa17206","observation_id":"22194cb1-e6ea-4170-a41c-3769b162b14e","resolution":{"observed_at":"2026-08-10T22:11:59.686596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12329","last_updated":"2024-12-07T23:09:49Z","snapshot_observed_at":"2026-08-11T03:10:02.344730Z","submitted_at":"2024-02-19T18:01:36Z","title":"Query-Based Adversarial Prompt Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.12329","snapshot_observed_at":"2026-08-10T22:11:59.692798Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.692798Z"},"links":{"cited_paper":"/paper/2402.12329","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:14ad3b9dc6d09cb6649d27de9951ff8be1875306e6ed9064998435469092580b","observation_id":"0553aeac-d3a9-4cf6-9bee-1c1c41c8048d","resolution":{"observed_at":"2026-08-10T22:11:59.692798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-07T07:43:16.294957Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-10T22:11:59.718374Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.718374Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:060f22367311f1584f1d09afa372c6b99a159827c00554a808c366289ccf1fdd","observation_id":"bd15270f-8537-4644-bf2f-f99df611725c","resolution":{"observed_at":"2026-08-10T22:11:59.718374Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.730055Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.730055Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:6fb39ff1bba34049b0d3b4e07a6c8caaf6c46a321158c458a75aaa95a8c1cfc5","observation_id":"5cd34feb-c71b-4dc9-b5c1-ef275e0aebde","resolution":{"observed_at":"2026-08-10T22:11:59.730055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-10T22:11:59.768157Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.768157Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8958d9944583c422000ccb04f8ddeaa3fe28db79fef57ef6d9d318b700aab3ea","observation_id":"99c66fc9-e32c-46df-b5cc-8929810e5d1d","resolution":{"observed_at":"2026-08-10T22:11:59.768157Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.12785","last_updated":"2022-04-27T09:11:16Z","snapshot_observed_at":"2026-07-06T13:04:13.261577Z","submitted_at":"2022-04-27T09:11:16Z","title":"Plug-and-Play Adaptation for Continuously-updated QA","version":1},"cited_work":{"arxiv_id":"2204.12785","doi":null,"metadata_source":"pith","pith_arxiv_id":"2204.12785","snapshot_observed_at":"2026-08-10T22:12:01.202223Z","title":"Plug-and-Play Adaptation for Continuously-updated QA","venue":"cs.CL","work_id":"59d1fe16-64ec-4f0b-88b2-121b3ff22ff6","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.773806Z"},"links":{"cited_paper":"/paper/2204.12785","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:499285ed706ff4e49c936c78110704aa3ab2a3fff249f1ab43141e22731e9c5e","observation_id":"0779ee9c-1b6a-46dc-b905-f7ac00642a34","resolution":{"observed_at":"2026-08-10T22:12:01.234923Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.01552","last_updated":"2023-12-04T00:46:11Z","snapshot_observed_at":"2026-08-07T00:42:49.627314Z","submitted_at":"2023-12-04T00:46:11Z","title":"The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.01552","snapshot_observed_at":"2026-08-10T22:11:59.790507Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.790507Z"},"links":{"cited_paper":"/paper/2312.01552","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:402b39300cbeac8a51280c6179ffe04cdb88a52b6b2635cca3e4391a44e2211a","observation_id":"ceef9326-51bc-4f94-bee1-53e504c68cf3","resolution":{"observed_at":"2026-08-10T22:11:59.790507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.798454Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.798454Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bf22d3661a3c18cf5cb4a5a6582c641f1462c774f19638804c6824766c49bcb9","observation_id":"d7cb2709-dc9f-46f6-bee9-565192c4fad0","resolution":{"observed_at":"2026-08-10T22:11:59.798454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.05827","last_updated":"2024-10-25T13:24:58Z","snapshot_observed_at":"2026-08-01T09:06:01.068131Z","submitted_at":"2024-02-08T17:06:45Z","title":"On the Robustness of Editing Large Language Models","version":2},"cited_work":{"arxiv_id":"2402.05827","doi":null,"metadata_source":"pith","pith_arxiv_id":"2402.05827","snapshot_observed_at":"2026-08-10T22:12:01.039916Z","title":"On the Robustness of Editing Large Language Models","venue":"cs.CL","work_id":"50214ad0-a5b8-4d84-ad3a-b212df4a21a3","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.815814Z"},"links":{"cited_paper":"/paper/2402.05827","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:7436ad8cd3f6faafc09634c4317270c9595c7f7a11231945f26eb071ef7ce823","observation_id":"0ca0d8b5-c1e1-4d0b-a2a5-6d13fe1f7823","resolution":{"observed_at":"2026-08-10T22:12:01.048813Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03853","last_updated":"2024-10-11T09:43:32Z","snapshot_observed_at":"2026-08-03T01:48:18.654934Z","submitted_at":"2024-03-06T17:04:18Z","title":"ShortGPT: Layers in Large Language Models are More Redundant Than You Expect","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03853","snapshot_observed_at":"2026-08-10T22:11:59.820103Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.820103Z"},"links":{"cited_paper":"/paper/2403.03853","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:55b3177d8c80e42093ab85aecd02784cd8fd3bc0fa8bbe47519d3475beddccca","observation_id":"3102223b-5883-4723-ad9e-2fd0e0253ba4","resolution":{"observed_at":"2026-08-10T22:11:59.820103Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.824423Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.824423Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:6a2e9ace348fdd6963e6456bd12b3841e8f3f07ad13e8f7fa0a5f555e7f050bb","observation_id":"6fbb7cd6-774e-4785-814e-42b2d7aca953","resolution":{"observed_at":"2026-08-10T22:11:59.824423Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.829094Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.829094Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:a2653a7641969830aed19c308e0b93b6e8600e772dfd0a1a6a349a61c9a44031","observation_id":"7b821143-cf40-4637-91ef-88067a9c947d","resolution":{"observed_at":"2026-08-10T22:11:59.829094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.985610Z","title":null,"venue":null,"work_id":"08ac8cd4-dc56-4dbc-a34c-c6635a06a454","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.833215Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:decb224903ef9cd118646fabced659747e5f299487a9cce0bf1e55f86c394851","observation_id":"30461f3c-299c-4b7b-b36e-83593699ea0f","resolution":{"observed_at":"2026-08-10T22:12:02.003560Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.964871Z","title":null,"venue":null,"work_id":"638e13a6-f1ae-4e75-87de-a16525d4c3b5","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.842194Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4852c208b62234d1e1250854f7aee8d69e669211e767c06d681a207336658d35","observation_id":"1c2d77eb-34e2-4113-8980-e7dd83afa6f6","resolution":{"observed_at":"2026-08-10T22:12:01.976778Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.08011","last_updated":"2024-02-16T15:49:42Z","snapshot_observed_at":"2026-08-08T15:42:57.199847Z","submitted_at":"2023-11-14T09:12:40Z","title":"Forgetting before Learning: Utilizing Parametric Arithmetic for Knowledge Updating in Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.08011","snapshot_observed_at":"2026-08-10T22:11:59.846476Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.846476Z"},"links":{"cited_paper":"/paper/2311.08011","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:32ccda954f3f61a44c8c45ec3eec96232e246dbac0a435d5f01ac159969daeb8","observation_id":"7b8e90e0-e7b7-4591-b5b1-5fc99e542ced","resolution":{"observed_at":"2026-08-10T22:11:59.846476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.951153Z","title":null,"venue":null,"work_id":"4daa44f8-8f08-4f3b-b0b1-cfa9b58edc17","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.850710Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bbabd220c3185c775cb70a46e18c096b2ac46a03ee4af7a6f2d49621c69761f0","observation_id":"95e064bc-f242-40fe-8c41-b18b89942d3a","resolution":{"observed_at":"2026-08-10T22:12:01.956566Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.854924Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.854924Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:0b8d697b89c0b9943d5d92308a95c59e160d00727a36ed9cf2a0ce68807cef29","observation_id":"d6cd602b-3a5b-4c6a-8e75-18a887a53159","resolution":{"observed_at":"2026-08-10T22:11:59.854924Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.04897","last_updated":"2023-11-08T18:56:35Z","snapshot_observed_at":"2026-08-06T05:52:56.931849Z","submitted_at":"2023-11-08T18:56:35Z","title":"Future Lens: Anticipating Subsequent Tokens from a Single Hidden State","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.04897","snapshot_observed_at":"2026-08-10T22:11:59.863949Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.863949Z"},"links":{"cited_paper":"/paper/2311.04897","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2d1b96b8b45f378925a71aad20fc285a3f6485a16f77ad2ca51477ba89f89453","observation_id":"b6974c78-c451-4c89-9606-34c198f39c7d","resolution":{"observed_at":"2026-08-10T22:11:59.863949Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.17410","last_updated":"2023-09-29T17:12:43Z","snapshot_observed_at":"2026-07-06T16:25:38.571377Z","submitted_at":"2023-09-29T17:12:43Z","title":"Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.17410","snapshot_observed_at":"2026-08-10T22:11:59.868902Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.868902Z"},"links":{"cited_paper":"/paper/2309.17410","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:43e7833bafb759c3220cda6742a5daa5be4eb8a106c8d746d386bffa46537941","observation_id":"f60ed1c7-daaa-4e24-9582-259364f8a016","resolution":{"observed_at":"2026-08-10T22:11:59.868902Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.873605Z","title":null,"venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.873605Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c5a8702b4e69a3ef64ab010ad2576a7fc2e41b923afa82509a06311ceb985027","observation_id":"ca6c4054-59cc-4e16-932c-5f4eb776b32d","resolution":{"observed_at":"2026-08-10T22:11:59.873605Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-10T22:11:59.877974Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.877974Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e47cfe7382516f3e4f2991156e728bb25effe8edea0a8bdaa246332f14bb8474","observation_id":"04c69872-25fc-44d8-8909-b931c82a464d","resolution":{"observed_at":"2026-08-10T22:11:59.877974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-10T22:11:59.882281Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.882281Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:31561078e3408cedfbada56c29976fec550bcef3e20410d8fe328b98d0eae56c","observation_id":"a6d1322f-e659-4553-bdd2-4a6727c9e481","resolution":{"observed_at":"2026-08-10T22:11:59.882281Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.12966","last_updated":"2023-07-24T17:44:58Z","snapshot_observed_at":"2026-07-06T15:57:57.167169Z","submitted_at":"2023-07-24T17:44:58Z","title":"Aligning Large Language Models with Human: A Survey","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.12966","snapshot_observed_at":"2026-08-10T22:11:59.904662Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.904662Z"},"links":{"cited_paper":"/paper/2307.12966","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8d073ada6fb0330691a9edeb71876bc48afc02625ba9474d34899d2411447159","observation_id":"8fb260a5-b4ad-42fe-acb9-685cd9b14112","resolution":{"observed_at":"2026-08-10T22:11:59.904662Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-10T22:11:59.912758Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.912758Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:cc079d2d2d9218137ae2ce4af0c0d0c524bb03bbcb40454a56a1a092f3a1ec4b","observation_id":"6d605eed-3151-4592-a9e4-07be3a451d65","resolution":{"observed_at":"2026-08-10T22:11:59.912758Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20138","last_updated":"2023-12-05T16:14:24Z","snapshot_observed_at":"2026-07-06T16:40:55.334347Z","submitted_at":"2023-10-31T03:09:36Z","title":"DEPN: Detecting and Editing Privacy Neurons in Pretrained Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20138","snapshot_observed_at":"2026-08-10T22:11:59.917002Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.917002Z"},"links":{"cited_paper":"/paper/2310.20138","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:39b195e75341e649526ea0caeb5c88d19e2b823ea9f64bb03c7b9f545da76e8f","observation_id":"12d0d064-c725-415b-9838-b80a30507259","resolution":{"observed_at":"2026-08-10T22:11:59.917002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.873621Z","title":null,"venue":null,"work_id":"09af27cd-10ca-49e3-8d52-8e0cc6b0cf2f","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.921213Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c12c9a45840c972eacf7157ab798faf8545e2c28ec53a04d9e812d17162d5296","observation_id":"ddc528ee-c740-47d2-be32-3db6854f155d","resolution":{"observed_at":"2026-08-10T22:12:01.884760Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.10253","last_updated":"2024-06-27T16:01:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-19T02:19:48Z","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.10253","snapshot_observed_at":"2026-08-10T22:11:59.934274Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.934274Z"},"links":{"cited_paper":"/paper/2309.10253","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:ad253e879b0f92d2ce76ac92477731cbb993b5c23e2f939659d287fc45b3ba4d","observation_id":"e6614dbe-caeb-41e4-a2db-b7e2b8dc2927","resolution":{"observed_at":"2026-08-10T22:11:59.934274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-10T11:13:59.778209Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-10T22:11:59.939507Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.939507Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:1de74b81c3a9eead1b355d9d3fdf17ab348b9df720a393cb3ad3cb58f0b1795b","observation_id":"c396f214-5a25-4f17-8294-9a7f92d9d9d3","resolution":{"observed_at":"2026-08-10T22:11:59.939507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.07876","last_updated":"2023-12-13T03:35:43Z","snapshot_observed_at":"2026-07-06T17:00:53.532910Z","submitted_at":"2023-12-13T03:35:43Z","title":"Causality Analysis for Evaluating the Security of Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.07876","snapshot_observed_at":"2026-08-10T22:11:59.943595Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.943595Z"},"links":{"cited_paper":"/paper/2312.07876","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d73d4873b0b9e819a7dbc113f44aa7a34da0f7b69c0007becb9508144efac739","observation_id":"8a48cb0e-d279-4f54-b9c8-6f606ad9b48d","resolution":{"observed_at":"2026-08-10T22:11:59.943595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.948432Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.948432Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d3d75a36a62751020d58b27800b5596fa80fbc13a01785a7dea58f45d5f97dcb","observation_id":"f493bcbd-bf32-4a15-88ab-665e9dff68bc","resolution":{"observed_at":"2026-08-10T22:11:59.948432Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.954757Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.954757Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:780f95506f30bfeaef4fe66ac7340a35ab382a37c63353005225a3c3dfb38fb1","observation_id":"429e7db1-9b7e-417f-8894-4e69f54a42f4","resolution":{"observed_at":"2026-08-10T22:11:59.954757Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2012.00363","last_updated":"2020-12-01T09:39:13Z","snapshot_observed_at":"2026-08-10T15:59:10.397359Z","submitted_at":"2020-12-01T09:39:13Z","title":"Modifying Memories in Transformer Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2012.00363","snapshot_observed_at":"2026-08-10T22:11:59.965609Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.965609Z"},"links":{"cited_paper":"/paper/2012.00363","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:de5cd6b5fc6eb0597c99f9cd94b409ff8aac3a6b06e566d81e3b1d5de1c4739c","observation_id":"f22a627c-6552-4140-b8b4-1d66b26cc76e","resolution":{"observed_at":"2026-08-10T22:11:59.965609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14857","last_updated":"2024-06-18T19:22:19Z","snapshot_observed_at":"2026-08-06T10:55:38.873690Z","submitted_at":"2024-02-20T17:39:40Z","title":"Is the System Message Really Important to Jailbreaks in Large Language Models?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14857","snapshot_observed_at":"2026-08-10T22:11:59.976519Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.976519Z"},"links":{"cited_paper":"/paper/2402.14857","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:6a51767aee27fe961dfcaa4f92af7dd65809f1a3dd0d56ac81eba6a658f6b93c","observation_id":"ccd6187b-74d8-4d14-8759-126059ee0d5e","resolution":{"observed_at":"2026-08-10T22:11:59.976519Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.981056Z","title":"online\" 'onlinestring :=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.981056Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2ece198039bc17eb5067587d3ac2c257fcaa585f0145124d8a26cae2f921fdfd","observation_id":"58340c30-63fc-4b84-85a7-fc8062765266","resolution":{"observed_at":"2026-08-10T22:11:59.981056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.986312Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.986312Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4761d1c44bd86ab25f7ed5b52e6b16ef2b7ca42b3812ce994be923c75e5f575d","observation_id":"821e50fa-ce4a-4d15-95d3-6f876f92fde8","resolution":{"observed_at":"2026-08-10T22:11:59.986312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.14348","last_updated":"2024-06-12T00:27:06Z","snapshot_observed_at":"2026-07-06T16:23:26.584450Z","submitted_at":"2023-09-18T02:07:22Z","title":"Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.14348","snapshot_observed_at":"2026-08-10T22:11:59.990893Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.990893Z"},"links":{"cited_paper":"/paper/2309.14348","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:7d5d9d84634dde3cc4917706c75bc888e74d6b9f87934fb12b882da2e6161e8b","observation_id":"405640b3-808d-4b6a-8593-04648e624cc7","resolution":{"observed_at":"2026-08-10T22:11:59.990893Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.994933Z","title":null,"venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.994933Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:9c1a977385855703ac4b03c5ccbd7d2bc1a1e96263e565bda4f1e793d34ce5ab","observation_id":"609cf4a7-5b35-4199-b635-f8175ca136eb","resolution":{"observed_at":"2026-08-10T22:11:59.994933Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-10T22:12:00.001874Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.001874Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:42b422d1692f414d54884dea4324dca943358a3ca8634363e485dac7ce1326c3","observation_id":"eeb30ab9-e8a8-46d3-ba0a-5864db3ddf45","resolution":{"observed_at":"2026-08-10T22:12:00.001874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-08-11T04:58:43.785083Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-10T22:12:00.008280Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.008280Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:27336000d570c47f6933e1ba6e49ab3522bf6516f466937bcd69b82d61baf82c","observation_id":"4907ea61-c84c-4ea3-8014-89b12d0fb983","resolution":{"observed_at":"2026-08-10T22:12:00.008280Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07308","last_updated":"2024-05-02T14:28:39Z","snapshot_observed_at":"2026-08-10T17:53:09.843403Z","submitted_at":"2023-08-14T17:54:10Z","title":"LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.07308","snapshot_observed_at":"2026-08-10T22:12:00.012228Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.012228Z"},"links":{"cited_paper":"/paper/2308.07308","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:1018144e7525e35be3009ee05ba89f67d12f17a03341851a8d3fa052c283e0d2","observation_id":"8f58f70f-7983-4a1b-a01a-d5f1a40e772f","resolution":{"observed_at":"2026-08-10T22:12:00.012228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.018197Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.018197Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8b1d28d8b43be1792926ac40d2cee1bfa8285c25dd67ee443b4d234e78cc74d1","observation_id":"87820e7a-a0e3-4bd8-87c6-ad7f1086e605","resolution":{"observed_at":"2026-08-10T22:12:00.018197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06987","last_updated":"2023-10-10T20:15:54Z","snapshot_observed_at":"2026-07-06T16:30:46.321160Z","submitted_at":"2023-10-10T20:15:54Z","title":"Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06987","snapshot_observed_at":"2026-08-10T22:12:00.022595Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.022595Z"},"links":{"cited_paper":"/paper/2310.06987","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4ee5b6f8bb5d02bb4949ebb81a289e6e995787c1e226abbcbee8efe6f80d8df8","observation_id":"7cbd6292-f52e-4d9e-8ea0-906c150e645a","resolution":{"observed_at":"2026-08-10T22:12:00.022595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.727267Z","title":null,"venue":null,"work_id":"66be6191-0ed7-4c51-ae05-2a98f20280d7","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.029572Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:812db8918192464c4c7a3248889af7488dbb5727219d6204e40fdc4f1f262d8a","observation_id":"ea4bdcad-85ea-48ec-9658-3a9c69c6e72f","resolution":{"observed_at":"2026-08-10T22:12:01.733386Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-10T22:12:00.038446Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.038446Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4a80bc1ab3af99e3d47d04f9382ed85a2873f62a1586cc2bfc46f66bffdb8dc8","observation_id":"3c5354cd-83ed-47a9-abe2-7d24d4d00b05","resolution":{"observed_at":"2026-08-10T22:12:00.038446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.043077Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.043077Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:673a2cafecf0197605667d070bb8581d1a184192ff156e963447fff091d5261d","observation_id":"313787b1-5638-439f-8030-e1bee329838d","resolution":{"observed_at":"2026-08-10T22:12:00.043077Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-07-06T16:15:00.517258Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T22:12:00.047226Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.047226Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2862f7ef417c80e3b28a6dc18ee73acfebfa827eb62177eecc4b89c636a97f5e","observation_id":"8dccb1ad-7a00-4758-8163-e94637e9e88d","resolution":{"observed_at":"2026-08-10T22:12:00.047226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-04T19:12:56.970085Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-10T22:12:00.060734Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.060734Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4799473da700f637a7a4a7f731fda68cc323aaeb9497f9fd26a762b8a5d69769","observation_id":"769d9811-7730-41c3-8663-5a5c632bc3df","resolution":{"observed_at":"2026-08-10T22:12:00.060734Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07124","last_updated":"2023-10-09T03:34:01Z","snapshot_observed_at":"2026-07-06T16:18:06.415304Z","submitted_at":"2023-09-13T17:59:09Z","title":"RAIN: Your Language Models Can Align Themselves without Finetuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07124","snapshot_observed_at":"2026-08-10T22:12:00.065764Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.065764Z"},"links":{"cited_paper":"/paper/2309.07124","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5e0a8b8817b61ecf9d756292276b731a2fc8ce3feec1ee9f45e98b569e0d579c","observation_id":"a8c0d13d-1cb2-4fee-ab23-32fd97d61e10","resolution":{"observed_at":"2026-08-10T22:12:00.065764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.070815Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.070815Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:0d8ade3cc15315c06006406d23c83c8385f75120b32656e2181f272782a6c6c1","observation_id":"1446adb2-08fd-4e25-8eff-8c5b53259345","resolution":{"observed_at":"2026-08-10T22:12:00.070815Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.12817","last_updated":"2022-08-13T23:35:30Z","snapshot_observed_at":"2026-07-06T12:51:51.647366Z","submitted_at":"2022-03-24T02:40:33Z","title":"Continual Learning and Private Unlearning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.12817","snapshot_observed_at":"2026-08-10T22:12:00.074676Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.074676Z"},"links":{"cited_paper":"/paper/2203.12817","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:97601f3203edaa10190758cbe613af3e46497ca6be8b5996f40cc745f3d56729","observation_id":"38831abc-7422-472f-b9e5-3ed9e91f43cf","resolution":{"observed_at":"2026-08-10T22:12:00.074676Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.673496Z","title":null,"venue":null,"work_id":"9e656b1e-c682-4548-8740-35926431be4e","year":2018},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.081177Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2dca25a8dd38b4f008c8026bd9efdaeedf0d5bf3ceb854aab73e394fa2331c1a","observation_id":"a972048a-9b7d-4dc7-8159-6995379306e2","resolution":{"observed_at":"2026-08-10T22:12:01.682616Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-10T22:12:00.087620Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.087620Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:a1166bd16016a3397f51f83436d7c29077ca135587ffbc4869e3a2c5355cabde","observation_id":"4fed2f62-7737-4914-bba4-146f37c96d43","resolution":{"observed_at":"2026-08-10T22:12:00.087620Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.092301Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.092301Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:438e687d80f3ca373daff29230a071acafbbc6fdfcd4348d18ff96af7389cdae","observation_id":"8e5bb156-2976-47d8-87f5-f336cd68bd1d","resolution":{"observed_at":"2026-08-10T22:12:00.092301Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00029","last_updated":"2024-08-18T22:26:13Z","snapshot_observed_at":"2026-08-10T13:04:17.737840Z","submitted_at":"2023-11-16T07:31:18Z","title":"Bergeron: Combating Adversarial Attacks through a Conscience-Based Alignment Framework","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00029","snapshot_observed_at":"2026-08-10T22:12:00.096522Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.096522Z"},"links":{"cited_paper":"/paper/2312.00029","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:fe4f57ed6fbeb2df3b25c2d02a508497dc2a97d55b5339fa214e72658a00a260","observation_id":"871466a3-1766-4a9a-a112-e67accee42a5","resolution":{"observed_at":"2026-08-10T22:12:00.096522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.100680Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.100680Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:9309f2dd7e072af76c1f3db61d557c342eeb8c23ca1507ded7c84079be737fc3","observation_id":"b36f8b56-654e-495e-9c91-81465a039516","resolution":{"observed_at":"2026-08-10T22:12:00.100680Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.634277Z","title":null,"venue":null,"work_id":"d0db60ea-fab5-4f34-adc2-016ba58b229f","year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.108615Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:7131122f2ee11d77b2d0c8754d65f7e6d3006ed0153dcd6b681ed8ce98fcd2df","observation_id":"f5b7649f-1476-4a73-8a4c-bf646e6c2ef5","resolution":{"observed_at":"2026-08-10T22:12:01.638915Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03825","last_updated":"2024-05-15T12:06:31Z","snapshot_observed_at":"2026-07-06T16:03:34.432602Z","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.03825","snapshot_observed_at":"2026-08-10T22:12:00.113756Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.113756Z"},"links":{"cited_paper":"/paper/2308.03825","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:794e5910d522223684ddfcdd1b2ad9fa29ebbe341b10fb931999eb4cdcf47f54","observation_id":"33fc8aed-559c-4a39-a5e4-964e7b34a414","resolution":{"observed_at":"2026-08-10T22:12:00.113756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.620668Z","title":null,"venue":null,"work_id":"51830d92-6a56-48c7-aebd-0949ceeca6d6","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.120086Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:3056ad880ef37d101cc726eb37b704544361ac740cfc8bbcbb8d87227277616c","observation_id":"fa2f11b2-e212-4694-9b34-fb7e08c16973","resolution":{"observed_at":"2026-08-10T22:12:01.625820Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-10T22:12:00.125110Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.125110Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:f63440bc88c0d1b98d953d110383e94d4a4d502d8b088e738c4de031a159882b","observation_id":"98a32bbc-29f3-47b6-b6bb-fe767a83158a","resolution":{"observed_at":"2026-08-10T22:12:00.125110Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14472","last_updated":"2024-05-28T09:11:25Z","snapshot_observed_at":"2026-07-06T17:48:24.076444Z","submitted_at":"2024-03-21T15:18:30Z","title":"Detoxifying Large Language Models via Knowledge Editing","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14472","snapshot_observed_at":"2026-08-10T22:12:00.130101Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.130101Z"},"links":{"cited_paper":"/paper/2403.14472","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d710016ee3f716f367f2a5d2d8bbee4747e94d9c6b79f378e1ce76d83e30a687","observation_id":"c0383e78-96ff-4219-8b2f-fe014c46f662","resolution":{"observed_at":"2026-08-10T22:12:00.130101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.11182","last_updated":"2025-02-07T01:18:07Z","snapshot_observed_at":"2026-07-06T19:03:43.883872Z","submitted_at":"2024-08-20T20:35:04Z","title":"Hide Your Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Carrier Articles","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.11182","snapshot_observed_at":"2026-08-10T22:12:00.134348Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.134348Z"},"links":{"cited_paper":"/paper/2408.11182","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e6f0c55c0de5dec774af0b2fa137b8a9eb364c1ea5e11022e03e3aca919f3982","observation_id":"83729fab-ed01-4188-8143-48411c326c8d","resolution":{"observed_at":"2026-08-10T22:12:00.134348Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-08T18:11:45.725753Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-10T22:12:00.140146Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.140146Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5e64995cdbbc9aef70d10dd868f282f8a2054218ffb6a1374d25722dbad48a62","observation_id":"bdc802f1-e24e-41c5-9d3a-d17e9e36c5d7","resolution":{"observed_at":"2026-08-10T22:12:00.140146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09127","last_updated":"2024-01-20T18:55:51Z","snapshot_observed_at":"2026-08-09T01:09:44.001852Z","submitted_at":"2023-11-15T17:17:39Z","title":"Jailbreaking GPT-4V via Self-Adversarial Attacks with System Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09127","snapshot_observed_at":"2026-08-10T22:12:00.144197Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.144197Z"},"links":{"cited_paper":"/paper/2311.09127","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8a51f562ffea83cca24ef5d0530e42a52b445618f4d94880058a858e0eb40803","observation_id":"4ac1aeb8-916b-4f5f-b359-c04df564118e","resolution":{"observed_at":"2026-08-10T22:12:00.144197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08983","last_updated":"2024-07-25T22:59:44Z","snapshot_observed_at":"2026-08-06T04:06:56.137869Z","submitted_at":"2024-02-14T06:54:31Z","title":"SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08983","snapshot_observed_at":"2026-08-10T22:12:00.149220Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.149220Z"},"links":{"cited_paper":"/paper/2402.08983","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2f8de29c241bfab5850a914a715ee8aeb2cec4daf841a32a722e1c49e889e11d","observation_id":"7a3ca14b-fb12-45b5-b492-f91c1014ad53","resolution":{"observed_at":"2026-08-10T22:12:00.149220Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.13457","last_updated":"2024-05-17T05:00:24Z","snapshot_observed_at":"2026-08-11T04:52:50.241599Z","submitted_at":"2024-02-21T01:26:39Z","title":"A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.13457","snapshot_observed_at":"2026-08-10T22:12:00.154510Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.154510Z"},"links":{"cited_paper":"/paper/2402.13457","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bdbf54c03f417a45a1a7e4d3542b63268ccf25f7d9ef68c2e583792ebed5e103","observation_id":"292305e5-41b3-4e01-b65b-de621a70054c","resolution":{"observed_at":"2026-08-10T22:12:00.154510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.595812Z","title":null,"venue":null,"work_id":"37a28f8f-f43c-4d8a-9a0a-3ec90b3c2de7","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":91,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.158627Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4229516142ed7808b2c81fef62ba4b4cb598e90346f3623e46fc806c7a6edfcc","observation_id":"848f4694-f3dd-4a14-89e6-89b4cc3f0fa4","resolution":{"observed_at":"2026-08-10T22:12:01.599943Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.162774Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.162774Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:accc3af114315889e85375f198f4077161083624fd2e51e1f02979a763ac3eec","observation_id":"2ce040d5-31ee-4569-87ca-d3b310ac162d","resolution":{"observed_at":"2026-08-10T22:12:00.162774Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10683","last_updated":"2024-02-16T19:47:36Z","snapshot_observed_at":"2026-08-04T08:36:17.664739Z","submitted_at":"2023-10-14T00:32:55Z","title":"Large Language Model Unlearning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10683","snapshot_observed_at":"2026-08-10T22:12:00.167216Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.167216Z"},"links":{"cited_paper":"/paper/2310.10683","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:b6f161d37df8a5a3877700874930aaf8791bcaff9a6206b1ad82572237137a93","observation_id":"4f748aa9-3291-4ca5-bbba-c7ebdeaf1169","resolution":{"observed_at":"2026-08-10T22:12:00.167216Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-10T22:12:00.171521Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":94,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.171521Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5a611be996f9658d9a9d1be1530e74503190501558b5f4eeceb422cb3894931a","observation_id":"2b2bf9e6-ca15-427c-8341-780a20517969","resolution":{"observed_at":"2026-08-10T22:12:00.171521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09096","last_updated":"2024-06-12T08:28:15Z","snapshot_observed_at":"2026-08-05T11:53:45.759441Z","submitted_at":"2023-11-15T16:42:29Z","title":"Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09096","snapshot_observed_at":"2026-08-10T22:12:00.175548Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":95,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.175548Z"},"links":{"cited_paper":"/paper/2311.09096","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:177a7aec2bdf78d07e44ca6eb92f3edf2aecab69bb0b9b529469056155184bc1","observation_id":"54cc01dd-f2fa-4115-a247-eefec3a3e180","resolution":{"observed_at":"2026-08-10T22:12:00.175548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.18166","last_updated":"2024-06-14T07:27:26Z","snapshot_observed_at":"2026-08-09T23:55:57.827623Z","submitted_at":"2024-05-28T13:26:12Z","title":"Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.18166","snapshot_observed_at":"2026-08-10T22:12:00.181315Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":96,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.181315Z"},"links":{"cited_paper":"/paper/2405.18166","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2a44fae2c530f35649f6b659ba12a9b9ce9ac28a99c94793fbd819c3942a825e","observation_id":"ea3b3048-abec-45b6-842e-8574a3f63a75","resolution":{"observed_at":"2026-08-10T22:12:00.181315Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.17256","last_updated":"2025-07-23T18:43:18Z","snapshot_observed_at":"2026-08-10T23:27:47.979166Z","submitted_at":"2024-01-30T18:48:37Z","title":"Weak-to-Strong Jailbreaking on Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.17256","snapshot_observed_at":"2026-08-10T22:12:00.187801Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":97,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.187801Z"},"links":{"cited_paper":"/paper/2401.17256","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:edf58eeda674b3491758998981d3871142b2ee4789ea69c415190ab972497e97","observation_id":"9a343cc1-97f1-43e0-91af-e32e44dc361a","resolution":{"observed_at":"2026-08-10T22:12:00.187801Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12171","last_updated":"2024-03-18T18:39:53Z","snapshot_observed_at":"2026-08-06T21:46:54.063328Z","submitted_at":"2024-03-18T18:39:53Z","title":"EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12171","snapshot_observed_at":"2026-08-10T22:12:00.193445Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":98,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.193445Z"},"links":{"cited_paper":"/paper/2403.12171","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:baa891dea6224ac732313d9f074aab5577d80e1bc9bb2fc9cc864c0fb945fc42","observation_id":"a8037181-c287-40cb-9391-0a56fd8b1240","resolution":{"observed_at":"2026-08-10T22:12:00.193445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-10T22:12:00.198263Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":99,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.198263Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:324da2aa1842596ac9ec89bc1c8e32d603b0535c24a0a225a411cd9ad76a5b41","observation_id":"4a760bc7-3b29-4361-b134-ce47eafafdd0","resolution":{"observed_at":"2026-08-10T22:12:00.198263Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-10T22:06:02.163331Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense"},"reference_resolution":{"displayed":84,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":82,"verified_exact":2,"verified_fuzzy":0},"total_outbound_references":84},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 84 of 84 outbound references and 1 inbound Pith citation observation for arXiv:2501.02629."}