{"as_of":"2026-08-11T11:07:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:1c3f8aba45b61998d484afe6f17ab565e584387513eddd4c225264ffd1f0eaed","coverage":[{"denominator":56,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":56,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T20:35:52.915101Z","state":"measured"},{"denominator":56,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":56,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2501.07959/citation-record","integrity":"/paper/2501.07959/integrity","json":"/paper/2501.07959/citation-record.json","paper":"/paper/2501.07959"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.697345Z","title":"Llama 3 model card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.697345Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:57e9315f7b4bd6a922808924526babf9105d1393274a174ca9bd996aff40a57b","observation_id":"51987e9b-db86-4e42-85d4-7ed965eb8c5d","resolution":{"observed_at":"2026-08-10T20:35:52.697345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.14132","last_updated":"2023-11-07T03:30:15Z","snapshot_observed_at":"2026-07-06T16:10:54.723336Z","submitted_at":"2023-08-27T15:20:06Z","title":"Detecting Language Model Attacks with Perplexity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.14132","snapshot_observed_at":"2026-08-10T20:35:52.701802Z","title":"Detecting language model attacks with perplexity","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.701802Z"},"links":{"cited_paper":"/paper/2308.14132","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b40529619612e72c0d15ab81f06e3f3aadf2623238af8ad1c75cf9cd30ad0391","observation_id":"0e399931-dc77-41bf-a8d0-8557088251a1","resolution":{"observed_at":"2026-08-10T20:35:52.701802Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-10T11:04:18.421023Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-10T20:35:52.705776Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.705776Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:d68afe0a6823ce0a9649bfc8f6ed9f8d19a2f754d1327909ceab431633b670a6","observation_id":"3af79303-da0c-41c9-affa-cbf70b6b7e2c","resolution":{"observed_at":"2026-08-10T20:35:52.705776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.568699Z","title":"Many-shot jailbreaking","venue":null,"work_id":"c8e45c52-6060-4fcc-9307-1337f49da776","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.710220Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b23d29625a9f438ad861ed5eee75cac3560a88862b7bc3783a0b17fe4cb27920","observation_id":"094b98a7-515f-4d18-b11a-c305be6ca13e","resolution":{"observed_at":"2026-08-10T20:35:53.573329Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.09932","last_updated":"2024-09-06T00:46:40Z","snapshot_observed_at":"2026-07-06T18:00:30.424554Z","submitted_at":"2024-04-15T16:58:28Z","title":"Foundational Challenges in Assuring Alignment and Safety of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.09932","snapshot_observed_at":"2026-08-10T20:35:52.714194Z","title":"Foundational challenges in assuring alignment and safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.714194Z"},"links":{"cited_paper":"/paper/2404.09932","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b0a1e0d6e226ba658a546ea1eb0edd9d1868ccab447de2c42b9f6add3a386bc8","observation_id":"6bb033e1-ce8e-48c9-a83d-809d6234bd9a","resolution":{"observed_at":"2026-08-10T20:35:52.714194Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07875","last_updated":"2024-03-19T16:50:50Z","snapshot_observed_at":"2026-08-06T23:45:57.910675Z","submitted_at":"2023-09-14T17:23:37Z","title":"Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07875","snapshot_observed_at":"2026-08-10T20:35:52.719204Z","title":"Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.719204Z"},"links":{"cited_paper":"/paper/2309.07875","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:96b30e79e168b0402259db8328be7f651f64a1e6f7ee99d9e50000aa78427685","observation_id":"b95c695c-de00-4f27-8d69-e1594b0a73d9","resolution":{"observed_at":"2026-08-10T20:35:52.719204Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.724012Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.724012Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b793ad147c33ffbb7b861051fe99e82cc63f4956c616697ff2f7fe1fe9f338e3","observation_id":"bb0f603f-c2e7-4512-bf45-3b8ccb3bf130","resolution":{"observed_at":"2026-08-10T20:35:52.724012Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00027","last_updated":"2024-06-09T03:27:40Z","snapshot_observed_at":"2026-08-02T19:45:28.046468Z","submitted_at":"2023-11-15T23:52:05Z","title":"Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00027","snapshot_observed_at":"2026-08-10T20:35:52.727788Z","title":"Stealthy and persistent unalignment on large language models via backdoor injections","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.727788Z"},"links":{"cited_paper":"/paper/2312.00027","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:7c0705b36f60799b8c1ca1c0d0527db9f5305a2a0b881fa5957be755cc45118b","observation_id":"62be13bd-c7b2-43f6-9867-100bd8c422fa","resolution":{"observed_at":"2026-08-10T20:35:52.727788Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-10T20:35:52.733088Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.733088Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3435440efc82bfec1e506b44ad416ec1a990ca5272bee7f69e9212d1909854d6","observation_id":"ddfa3eb9-4a42-48a3-abe4-935f61abb4e2","resolution":{"observed_at":"2026-08-10T20:35:52.733088Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-02T14:59:12.115203Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01318","snapshot_observed_at":"2026-08-10T20:35:52.737657Z","title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.737657Z"},"links":{"cited_paper":"/paper/2404.01318","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:7959121bd80fa760390be794bf39111dd596456d71305a059ed4161790d623c8","observation_id":"b6413099-72d0-4e21-b4d8-71bf0ae35d1e","resolution":{"observed_at":"2026-08-10T20:35:52.737657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.742128Z","title":"Combating misinformation in the age of llms: Opportunities and challenges","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.742128Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:9efd4140a7644f8c48972264b802321528ebba28c9bbf0e71119ba49d146c83b","observation_id":"2138c5fa-c552-429f-a962-5fed6f1913ae","resolution":{"observed_at":"2026-08-10T20:35:52.742128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.12773","last_updated":"2023-10-19T14:22:03Z","snapshot_observed_at":"2026-08-02T16:56:38.535065Z","submitted_at":"2023-10-19T14:22:03Z","title":"Safe RLHF: Safe Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.12773","snapshot_observed_at":"2026-08-10T20:35:52.746178Z","title":"Safe rlhf: Safe reinforcement learning from human feedback","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.746178Z"},"links":{"cited_paper":"/paper/2310.12773","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8755c1507a672a7f1a82fbdc9ce33aabffcb7467abedaa1a1a9714e94aec896c","observation_id":"3d825ee4-f14e-40cc-a7dd-8430b73b6ff0","resolution":{"observed_at":"2026-08-10T20:35:52.746178Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06474","last_updated":"2024-03-04T04:03:54Z","snapshot_observed_at":"2026-08-08T01:21:39.731592Z","submitted_at":"2023-10-10T09:44:06Z","title":"Multilingual Jailbreak Challenges in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06474","snapshot_observed_at":"2026-08-10T20:35:52.750811Z","title":"Multilingual jailbreak chal- lenges in large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.750811Z"},"links":{"cited_paper":"/paper/2310.06474","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:ebbd4a9549e48bdaceb5d0eb38b99be2be124d64c71197e6afefb494c8fcf7a0","observation_id":"5a5e26a7-1a84-457a-9088-1aecc83d8781","resolution":{"observed_at":"2026-08-10T20:35:52.750811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09283","last_updated":"2024-03-27T13:55:14Z","snapshot_observed_at":"2026-08-09T16:06:53.947436Z","submitted_at":"2024-02-14T16:14:03Z","title":"Attacks, Defenses and Evaluations for LLM Conversation Safety: A Survey","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09283","snapshot_observed_at":"2026-08-10T20:35:52.755719Z","title":"Attacks, defenses and evaluations for llm conversation safety: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.755719Z"},"links":{"cited_paper":"/paper/2402.09283","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8fe9c7758d20e3d1c393937c46cb59d57416569f019eea5b9a551144479c0c05","observation_id":"7a878be1-1938-426c-8f49-4cc7ed5d7ebb","resolution":{"observed_at":"2026-08-10T20:35:52.755719Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-10T16:40:37.411115Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-10T20:35:52.760004Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.760004Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:26029428a689608d76a6bd29fe56b5693cd380ffdecd452f76cf84e747087636","observation_id":"fc414b65-0879-4503-8536-00c59249ef86","resolution":{"observed_at":"2026-08-10T20:35:52.760004Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.539105Z","title":"Red- teaming for generative ai: Silver bullet or security theater? In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 421–437, 2024","venue":null,"work_id":"ef0285b0-d64c-45fb-952c-94dbaa42bbe5","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.763569Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8a1de8033941e957956445bcf56e03496d2cafba382ad6538cea5ef54591610d","observation_id":"bc2925ad-506c-4846-a1f8-ed75d3afb945","resolution":{"observed_at":"2026-08-10T20:35:53.543563Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.526270Z","title":"Badllama: cheaply removing safety fine-tuning from llama 2-chat 13b, 2024","venue":null,"work_id":"565c0554-1c8f-4c59-bae3-084a9d097d8e","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.767401Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:23682dbdbb74f622d406b8d2ed477cc21f1370dfe38b4de547eb5fddf6d8f50b","observation_id":"86a9f30c-9aee-4579-b0b6-5d765cd04cf8","resolution":{"observed_at":"2026-08-10T20:35:53.531168Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-07-06T17:00:00.321552Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-10T20:35:52.770507Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.770507Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:4b8b0f6cbc3f16529c89cf686a6007e955c6797922d305d90d819d807c8b1c94","observation_id":"4aebbcbf-ea7f-4815-80f5-81b755a6aee6","resolution":{"observed_at":"2026-08-10T20:35:52.770507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-10T20:35:52.774210Z","title":"Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.774210Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:e4b5152bf3d81bc0ffa1d65074d416cec786727d93ab498b8cf3fc57ddbadf8f","observation_id":"1a230f98-a27f-41a7-9c84-bd66a97c4009","resolution":{"observed_at":"2026-08-10T20:35:52.774210Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.513931Z","title":"Perplexity—a measure of the difficulty of speech recognition tasks","venue":null,"work_id":"5285c46c-ac6f-4894-bc56-e22e16f77649","year":1977},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.777767Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:af02b5a68a2dd9e3e38d35a5f5aab6dfe383dc939cbd8ca129a422220b8c6721","observation_id":"641c1b60-bddc-48c9-aeeb-6d8c3eeda8db","resolution":{"observed_at":"2026-08-10T20:35:53.517940Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-10T20:35:52.781447Z","title":"Mistral 7b","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.781447Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a7b0066c05e0c8e030eaed85f9714c1994a314758b81a4f436f6f1e1dde719ba","observation_id":"b52040c0-11c3-4c80-9989-2315068e87fa","resolution":{"observed_at":"2026-08-10T20:35:52.781447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-08-10T13:50:03.897892Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-10T20:35:52.785478Z","title":"Artprompt: Ascii art-based jailbreak attacks against aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.785478Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:bf2f4a3486250a52db709321b60a325b88c7237e18c1d0959efae280cebaa65a","observation_id":"a1af48f6-8b91-426a-b038-02fffdf6b462","resolution":{"observed_at":"2026-08-10T20:35:52.785478Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20624","last_updated":"2024-05-22T08:39:46Z","snapshot_observed_at":"2026-08-02T03:56:52.247351Z","submitted_at":"2023-10-31T16:55:06Z","title":"LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20624","snapshot_observed_at":"2026-08-10T20:35:52.788923Z","title":"Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.788923Z"},"links":{"cited_paper":"/paper/2310.20624","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:22ca52eeb9001d52d34137a813a0377f0ba2005258afc6b9423285e5b6573c8d","observation_id":"b5580c03-ad9d-4d82-a648-b82d36d9a824","resolution":{"observed_at":"2026-08-10T20:35:52.788923Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.00530","last_updated":"2024-06-07T20:28:36Z","snapshot_observed_at":"2026-08-09T09:08:37.888988Z","submitted_at":"2024-02-01T11:57:53Z","title":"Superfiltering: Weak-to-Strong Data Filtering for Fast Instruction-Tuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.00530","snapshot_observed_at":"2026-08-10T20:35:52.792439Z","title":"Superfiltering: Weak-to-strong data filtering for fast instruction-tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.792439Z"},"links":{"cited_paper":"/paper/2402.00530","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a5cef697ca9ad72019d16caa9c375f662083dca84ac81b58311e2dd608459bd5","observation_id":"d31ed7c8-b58b-43ea-af7d-f97174656187","resolution":{"observed_at":"2026-08-10T20:35:52.792439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-04T19:12:56.970085Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-10T20:35:52.796233Z","title":"Deepinception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.796233Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:aea9d9378ea9e9171e4835f8c83b11fff4f5ebc4e590a240a4cf93141a55d862","observation_id":"e59b2646-f26c-4178-a01d-b79d06bbc569","resolution":{"observed_at":"2026-08-10T20:35:52.796233Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07124","last_updated":"2023-10-09T03:34:01Z","snapshot_observed_at":"2026-07-06T16:18:06.415304Z","submitted_at":"2023-09-13T17:59:09Z","title":"RAIN: Your Language Models Can Align Themselves without Finetuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07124","snapshot_observed_at":"2026-08-10T20:35:52.799789Z","title":"Rain: Your language models can align themselves without finetuning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.799789Z"},"links":{"cited_paper":"/paper/2309.07124","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:abf97aa6b74f434aa66d9b768840f9f69ed1578233532fee26db75076daf43aa","observation_id":"774b9cd4-2bb3-44be-9d77-7e489c0def0f","resolution":{"observed_at":"2026-08-10T20:35:52.799789Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-10T20:35:52.803418Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.803418Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b8d2a067aff3f4d860a79d2a02e1a6d2f92ee5469d083a3a1d8db03fc72d530d","observation_id":"6d3a996f-7d66-422b-affe-4e8ac9491e96","resolution":{"observed_at":"2026-08-10T20:35:52.803418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-07-06T17:26:23.067923Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-10T20:35:52.807650Z","title":"Harmbench: A standardized evaluation frame- work for automated red teaming and robust refusal, 2024.URL https://arxiv","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.807650Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:1f78e4271b41f0bd57b03178c52fa5ea20ff08c5d31426a4109f508df9dad5ee","observation_id":"5c6e3624-1cf6-460d-a82e-630435d229c8","resolution":{"observed_at":"2026-08-10T20:35:52.807650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.811437Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.811437Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:df8525e383a8d3669dc0babc9f29c7c951dcea28bfce1f80777476ae8d85eee3","observation_id":"f52b7b31-46da-41ec-815f-3d1ac87b91e2","resolution":{"observed_at":"2026-08-10T20:35:52.811437Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07308","last_updated":"2024-05-02T14:28:39Z","snapshot_observed_at":"2026-08-10T17:53:09.843403Z","submitted_at":"2023-08-14T17:54:10Z","title":"LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.07308","snapshot_observed_at":"2026-08-10T20:35:52.814907Z","title":"Llm self defense: By self examination, llms know they are being tricked","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.814907Z"},"links":{"cited_paper":"/paper/2308.07308","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:85b2352c372180b07afc13c768c3c70741e156e4a3e901bb96f2927c7b1b6ff9","observation_id":"e9d98946-ae4a-4eb0-acfd-02da1a80b42a","resolution":{"observed_at":"2026-08-10T20:35:52.814907Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.14455","last_updated":"2024-04-29T12:37:59Z","snapshot_observed_at":"2026-08-06T08:16:16.062348Z","submitted_at":"2023-11-24T13:09:34Z","title":"Universal Jailbreak Backdoors from Poisoned Human Feedback","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.14455","snapshot_observed_at":"2026-08-10T20:35:52.818464Z","title":"Universal jailbreak backdoors from poisoned human feedback","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.818464Z"},"links":{"cited_paper":"/paper/2311.14455","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:22ae9c3884c88eb6a85f82b5bdd10832c81e8813aac44f6c0ec3cdf80f6963c2","observation_id":"ea4c7205-f1b4-4f54-b765-64f8e0121f7e","resolution":{"observed_at":"2026-08-10T20:35:52.818464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1908.10084","last_updated":"2019-08-27T08:50:17Z","snapshot_observed_at":"2026-07-06T08:17:05.681370Z","submitted_at":"2019-08-27T08:50:17Z","title":"Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.10084","snapshot_observed_at":"2026-08-10T20:35:52.822255Z","title":"Sentence-bert: Sentence embeddings using siamese bert-networks","venue":null,"work_id":null,"year":1908},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.822255Z"},"links":{"cited_paper":"/paper/1908.10084","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:6de5499d0f9456e9f4e8dfbc5d0e0035a71c6285ba92c7bd8d826d88df608ff1","observation_id":"8b8d9d38-736e-4310-821b-d742885177bc","resolution":{"observed_at":"2026-08-10T20:35:52.822255Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.07865","last_updated":"2024-09-14T11:41:49Z","snapshot_observed_at":"2026-08-10T03:17:35.544423Z","submitted_at":"2024-03-12T17:55:38Z","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.07865","snapshot_observed_at":"2026-08-10T20:35:52.825816Z","title":"Ex- ploring safety generalization challenges of large language models via code","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.825816Z"},"links":{"cited_paper":"/paper/2403.07865","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a64443dd1d552568b0972ff5773930bcaa88e096384e07ae922685542389ba62","observation_id":"4146389d-132b-4bd6-8081-1fe955e307fc","resolution":{"observed_at":"2026-08-10T20:35:52.825816Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-10T20:35:52.829433Z","title":"Smoothllm: Defending large language models against jailbreaking attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.829433Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:f6b62eb27ecc65e320afd3b0ddbab48d8f7d2ef0e6cd0813a8ede4aa3cbcb050","observation_id":"44356f20-045e-4da2-9e84-8b14a768a0dc","resolution":{"observed_at":"2026-08-10T20:35:52.829433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.833240Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.833240Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:f5c29c34046d2190d118d76340ace900029cfa4ed8a91f5f3eab2058dd90676e","observation_id":"33988b2a-c35b-48c8-b3ec-b58bdf2dea45","resolution":{"observed_at":"2026-08-10T20:35:52.833240Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.837049Z","title":"Qwen2.5: A party of foundation models, September 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.837049Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:74d9c63259fd3875abb1cd37fd93a151c14be690509c49adb698302fb3f89ad9","observation_id":"7c72ef52-306c-49f2-815e-41f77be8cc23","resolution":{"observed_at":"2026-08-10T20:35:52.837049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-10T20:35:52.840899Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.840899Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8772c01bc5e79ada5b7aa6e0125bad6a316a5cc51cfeba4c820dc3f47f9dd67f","observation_id":"ff03216b-92ee-4574-83e4-69f22ea01aba","resolution":{"observed_at":"2026-08-10T20:35:52.840899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.11235","last_updated":"2024-03-16T04:32:25Z","snapshot_observed_at":"2026-08-07T05:19:58.002826Z","submitted_at":"2023-09-20T11:54:40Z","title":"OpenChat: Advancing Open-source Language Models with Mixed-Quality Data","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.11235","snapshot_observed_at":"2026-08-10T20:35:52.844524Z","title":"Open- chat: Advancing open-source language models with mixed-quality data","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.844524Z"},"links":{"cited_paper":"/paper/2309.11235","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a8e48b4903c2e03bf7f6d4bc864bc3c619c558164c290d5bed9a70a93c451382","observation_id":"eeec823e-f6ed-45c5-9d6c-b5e2ec9ce37e","resolution":{"observed_at":"2026-08-10T20:35:52.844524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-08-11T00:45:48.191177Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-10T20:35:52.848329Z","title":"Backdoor activation attack: Attack large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.848329Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:cdac9532adf1079538aaef0d6e2e89cf339b68500fbfee49a509f5a544ba8e26","observation_id":"8a8eaf54-aad6-4d17-9a68-39953e2e431d","resolution":{"observed_at":"2026-08-10T20:35:52.848329Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.852850Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.852850Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:472637457dcda312bc62a86e867843772bbf981c81db1bc2067d9e5c6a605a54","observation_id":"524a50a4-a35c-481a-ac54-2ececa3686b3","resolution":{"observed_at":"2026-08-10T20:35:52.852850Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-10T20:35:52.856473Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.856473Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:4e46730461260dbb302808bf32678a850888216bb99ca97779a36ae1b22b32ce","observation_id":"ed581a41-2e19-4c3a-93a0-50d01a279b19","resolution":{"observed_at":"2026-08-10T20:35:52.856473Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.472566Z","title":"Defending chatgpt against jailbreak attack via self-reminder","venue":null,"work_id":"55dc4488-082f-417e-a1d6-fea8bdca19cb","year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.860142Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:77d4ccb7891ae52e7da68c9f12eccb2e468ef4704d61f0ecb3264ae7d75dd48a","observation_id":"1738ef74-4719-47c3-8ad8-c8494ed086b2","resolution":{"observed_at":"2026-08-10T20:35:53.477073Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14710","last_updated":"2024-04-03T09:15:15Z","snapshot_observed_at":"2026-08-11T07:29:55.869710Z","submitted_at":"2023-05-24T04:27:21Z","title":"Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14710","snapshot_observed_at":"2026-08-10T20:35:52.863562Z","title":"Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.863562Z"},"links":{"cited_paper":"/paper/2305.14710","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:c0257f3e4eb948ac1c1d69246307e14d049f06499caad4fb55a5b4f3d6a01a7a","observation_id":"493da253-3d00-4cab-9e27-74a02732220c","resolution":{"observed_at":"2026-08-10T20:35:52.863562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.10671","last_updated":"2024-09-10T13:25:53Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-07-15T12:35:42Z","title":"Qwen2 Technical Report","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.10671","snapshot_observed_at":"2026-08-10T20:35:52.867549Z","title":"Qwen2 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.867549Z"},"links":{"cited_paper":"/paper/2407.10671","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:c195c11366e66fa867d950c09af3099d8d4837204710e1cc8056153abda8fa73","observation_id":"4383d3df-5b9c-40cb-9135-33ab224320d0","resolution":{"observed_at":"2026-08-10T20:35:52.867549Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02949","last_updated":"2023-10-04T16:39:31Z","snapshot_observed_at":"2026-08-07T11:20:01.991656Z","submitted_at":"2023-10-04T16:39:31Z","title":"Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02949","snapshot_observed_at":"2026-08-10T20:35:52.870948Z","title":"Shadow alignment: The ease of subverting safely-aligned language models.(2023)","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.870948Z"},"links":{"cited_paper":"/paper/2310.02949","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3f2352e8c90c28540811a912c84d298658a19fc2d0415f74ca8e51f00ba795a9","observation_id":"35f49797-2e6a-4e80-ad93-790aa4ed03df","resolution":{"observed_at":"2026-08-10T20:35:52.870948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.874542Z","title":"A survey on large language model (llm) security and privacy: The good, the bad, and the ugly","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.874542Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:78264f028c18fb427ea0e0230ebb4e55481ef1b3d55c4ede53c93d5e0a956596","observation_id":"99b54b90-02ac-41d0-919d-823d6d7cfc14","resolution":{"observed_at":"2026-08-10T20:35:52.874542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-10T20:35:52.877810Z","title":"Low-resource languages jailbreak gpt-4","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.877810Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:2eeecfbe0080ee54b75b40944cf36df7b3b3989e32ec9675cd149887caa82d3e","observation_id":"e088c2cf-5dc4-4985-8771-c216233db363","resolution":{"observed_at":"2026-08-10T20:35:52.877810Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.06463","last_updated":"2024-03-26T04:23:12Z","snapshot_observed_at":"2026-07-06T16:05:31.757410Z","submitted_at":"2023-08-12T04:05:57Z","title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.06463","snapshot_observed_at":"2026-08-10T20:35:52.881332Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.881332Z"},"links":{"cited_paper":"/paper/2308.06463","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:9ef09633ea6ea334f2ab7a33bee0bc9e0e678414376db59bf4873c92e6f3af37","observation_id":"095ec9a2-ea40-4352-a2c7-27ea35e465f3","resolution":{"observed_at":"2026-08-10T20:35:52.881332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-10T11:13:59.778209Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-10T20:35:52.885191Z","title":"How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.885191Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:c35aef5b76652e86f7c909fa3a2b0ea39200ddf1ef3897584dd8769a2512c090","observation_id":"de2ff848-1cfe-45d1-91dd-fbcea379715e","resolution":{"observed_at":"2026-08-10T20:35:52.885191Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09096","last_updated":"2024-06-12T08:28:15Z","snapshot_observed_at":"2026-08-05T11:53:45.759441Z","submitted_at":"2023-11-15T16:42:29Z","title":"Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09096","snapshot_observed_at":"2026-08-10T20:35:52.889218Z","title":"Defending large language models against jailbreaking attacks through goal prioritization","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.889218Z"},"links":{"cited_paper":"/paper/2311.09096","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:52309c990260bd6f48c6a237f323996afc8cb50cc00743efe5bd8d01c8c11c2b","observation_id":"34f0c01b-75ba-442b-891f-23955059e5e6","resolution":{"observed_at":"2026-08-10T20:35:52.889218Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.04223","last_updated":"2025-05-11T03:35:52Z","snapshot_observed_at":"2026-07-06T19:46:24.121362Z","submitted_at":"2024-11-06T19:39:48Z","title":"Diversity Helps Jailbreak Large Language Models","version":3},"cited_work":{"arxiv_id":"2411.04223","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.04223","snapshot_observed_at":"2026-08-10T20:35:52.990680Z","title":"Diversity Helps Jailbreak Large Language Models","venue":"cs.CL","work_id":"1a574b5e-94d2-473b-bd72-e3be57e64848","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.893040Z"},"links":{"cited_paper":"/paper/2411.04223","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:4e7dc02937b505f21ce404e2159ca45985e6a4c2bf7997aa43c320e3c6945a27","observation_id":"2424d0e2-b828-4159-bed6-f8e2cce7f211","resolution":{"observed_at":"2026-08-10T20:35:52.997180Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.01288","last_updated":"2024-10-30T12:08:42Z","snapshot_observed_at":"2026-08-06T18:17:00.986434Z","submitted_at":"2024-06-03T12:59:17Z","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.01288","snapshot_observed_at":"2026-08-10T20:35:52.898323Z","title":"Improved few- shot jailbreaking can circumvent aligned language models and their defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.898323Z"},"links":{"cited_paper":"/paper/2406.01288","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:75601256a1feb5dbc9d51727f68a1f0b05d701c646b0f5e67664b42dfb2b5355","observation_id":"1f9f5f83-9ceb-4d85-b6b7-63b0cdaa32b1","resolution":{"observed_at":"2026-08-10T20:35:52.898323Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12343","last_updated":"2024-06-06T12:54:48Z","snapshot_observed_at":"2026-08-10T22:54:13.233449Z","submitted_at":"2024-02-19T18:16:51Z","title":"Emulated Disalignment: Safety Alignment for Large Language Models May Backfire!","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.12343","snapshot_observed_at":"2026-08-10T20:35:52.902122Z","title":"Emulated disalignment: Safety alignment for large language models may backfire! arXiv preprint arXiv:2402.12343, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.902122Z"},"links":{"cited_paper":"/paper/2402.12343","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b8afbe6767595e582593cb3174aec7b5e65b275342859ef39a8a89c1da1aeac4","observation_id":"ed8e2339-b36c-4fba-a62a-9510ab9119d9","resolution":{"observed_at":"2026-08-10T20:35:52.902122Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.450967Z","title":"Starling-7b: Improving llm helpfulness & harmlessness with rlaif, November 2023","venue":null,"work_id":"2c69e0af-4922-47fc-af8f-9428eb707c31","year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.906616Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:427a3233298b2d96deb41e8282d063a9c37d55886e6e04efd4b47d8ae477547e","observation_id":"b9476d38-a2a4-4bdb-b25d-3c64abba7121","resolution":{"observed_at":"2026-08-10T20:35:53.455117Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-10T20:35:52.910697Z","title":"Sure\" and","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.910697Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:33c4c57f845ad0e1903a1de447abb6ef5508eec99131b3e14b734d21adfdc600","observation_id":"dea701a4-d2cc-4c57-96ba-73755f0076f1","resolution":{"observed_at":"2026-08-10T20:35:52.910697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.434170Z","title":"As shown in Table 10, our method can still achieve remarkable performance on HarmBench [28]","venue":null,"work_id":"e795ce6b-d1aa-4642-9eee-efefd0ac1667","year":null},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.915101Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:529f6d04a64242b38fb87a3e92393789076c20d0ec7f33966a899fda8325ff6e","observation_id":"47c3d999-626e-41cc-8893-c678846a02e7","resolution":{"observed_at":"2026-08-10T20:35:53.439187Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-10T21:11:26.746049Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning"},"reference_resolution":{"displayed":56,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":48,"verified_exact":1,"verified_fuzzy":7},"total_outbound_references":56},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 56 of 56 outbound references and 0 inbound Pith citation observations for arXiv:2501.07959."}