{"as_of":"2026-08-11T22:10:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:455198863a0e8a47d11accdbcec5335aad04e6a9f8271cae0da25143ab95f222","coverage":[{"denominator":65,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":65,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T19:44:46.904083Z","state":"measured"},{"denominator":68,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":68,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":3,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":3,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:27:03.532090Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-11T13:11:05.821591Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.09798","snapshot_observed_at":"2026-08-07T14:27:03.532090Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18889","last_updated":"2025-08-24T03:15:13Z","snapshot_observed_at":"2026-08-11T16:13:52.746814Z","submitted_at":"2025-05-24T22:22:43Z","title":"Security Concerns for Large Language Models: A Survey","version":5},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:27:03.532090Z"},"links":{"cited_paper":"/paper/2501.09798","citing_paper":"/paper/2505.18889"},"observation_digest":"sha256:5102605d3aa1f3ff9f16cbd7a385edb16cb632de321a2c5fd0031ab50cd691fb","observation_id":"30fba0b6-0662-48c2-9a97-08c7f135c1c9","resolution":{"observed_at":"2026-08-07T14:27:03.532090Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"cited_work":{"arxiv_id":"2501.09798","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2501.09798","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Pandya, Ashish Hooda, Xiaohan Fu, and Earlence Fernandes","venue":null,"work_id":"0989ea79-414e-410f-a173-c189f2b46df3","year":2025},"citing_paper":{"arxiv_id":"2604.16845","last_updated":"2026-04-18T05:28:53Z","snapshot_observed_at":"2026-08-11T02:13:22.969221Z","submitted_at":"2026-04-18T05:28:53Z","title":"DART: Mitigating Harm Drift in Difference-Aware LLMs via Distill-Audit-Repair Training","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T07:18:49.076088Z"},"links":{"cited_paper":"/paper/2501.09798","citing_paper":"/paper/2604.16845"},"observation_digest":"sha256:9750466e616aa4b64fda8270de7f0f47782f903866c0cc7e9037d2d52e6166a0","observation_id":"b58182b9-d6e6-4d72-b42b-41026ce39bb6","resolution":{"observed_at":"2026-05-10T07:26:59.924242Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"cited_work":{"arxiv_id":"2501.09798","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2501.09798","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Pandya, Ashish Hooda, Xiaohan Fu, and Earlence Fernandes","venue":null,"work_id":"0989ea79-414e-410f-a173-c189f2b46df3","year":2025},"citing_paper":{"arxiv_id":"2604.19657","last_updated":"2026-04-21T16:45:30Z","snapshot_observed_at":"2026-07-06T23:06:16.972438Z","submitted_at":"2026-04-21T16:45:30Z","title":"An AI Agent Execution Environment to Safeguard User Data","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-10T02:14:40.639143Z"},"links":{"cited_paper":"/paper/2501.09798","citing_paper":"/paper/2604.19657"},"observation_digest":"sha256:0854fcfc6de6598e5883080c984c919bd7744b1dd62f3111b08b91a03f2f2298","observation_id":"08f49dd7-b7c0-4594-b5ef-a7477a85f05f","resolution":{"observed_at":"2026-05-11T13:11:05.825940Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2501.09798/citation-record","integrity":"/paper/2501.09798/integrity","json":"/paper/2501.09798/citation-record.json","paper":"/paper/2501.09798"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2305.14965","last_updated":"2024-03-27T04:38:44Z","snapshot_observed_at":"2026-08-07T01:32:47.981682Z","submitted_at":"2023-05-24T09:57:37Z","title":"Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14965","snapshot_observed_at":"2026-08-10T19:44:46.639882Z","title":"Tricking llms into disobedience: Understanding, analyzing, and preventing jailbreaks,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.639882Z"},"links":{"cited_paper":"/paper/2305.14965","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:4125a60d80bb6091f8f60324b6d518ae35ef729cfc5b469e94789a9243d9cca5","observation_id":"f531fd8f-6dbc-4390-b07b-5a4622807b87","resolution":{"observed_at":"2026-08-10T19:44:46.639882Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-07-06T15:31:18.144952Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-10T19:44:46.645200Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.645200Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:2eb98e902d0c1f5b28d4f1e6becccdd96e49601e61d176b8dc9946f2b59e36de","observation_id":"60d09271-fd20-4f5d-b816-75ddb9df7c7b","resolution":{"observed_at":"2026-08-10T19:44:46.645200Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:46.653268Z","title":"Baseline defenses for adversarial attacks against aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.653268Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:8e93197f1e78ae5e46cca3a40fe432ac1605646a19984a3d50c84240d35c51a9","observation_id":"eeec835c-6ae5-4b0c-a97f-7b7d69dfebcc","resolution":{"observed_at":"2026-08-10T19:44:46.653268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.723203Z","title":"Jailbroken: How does llm safety training fail?","venue":null,"work_id":"e6578251-31c8-4fdb-aa6e-87dc425c4891","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.657461Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:7609ba3dcdc2793b2c76c46a339774f33555983796068283e24d786923089de4","observation_id":"041d97c1-425e-47e7-b234-81c55f437710","resolution":{"observed_at":"2026-08-10T19:44:47.727265Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.10253","last_updated":"2024-06-27T16:01:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-19T02:19:48Z","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.10253","snapshot_observed_at":"2026-08-10T19:44:46.661476Z","title":"Gptfuzzer: Red teaming large lan- guage models with auto-generated jailbreak prompts,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.661476Z"},"links":{"cited_paper":"/paper/2309.10253","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:3e6763e4343de80adfbb8905006bed69500af0f148a9107d099634452a56941a","observation_id":"69555f02-a8a2-4014-b92a-30e4fb5a17d8","resolution":{"observed_at":"2026-08-10T19:44:46.661476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.02309","last_updated":"2024-02-04T01:29:24Z","snapshot_observed_at":"2026-08-07T07:47:20.838090Z","submitted_at":"2024-02-04T01:29:24Z","title":"Jailbreaking Attack against Multimodal Large Language Model","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.02309","snapshot_observed_at":"2026-08-10T19:44:46.665840Z","title":"Jailbreaking attack against multimodal large language model,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.665840Z"},"links":{"cited_paper":"/paper/2402.02309","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:5bf63bcf304314bcefff2e2db1715ac0260841d3d63d1f97e77e92903bc1fe84","observation_id":"fbd0cc9b-3d60-4f52-8199-55df590bd38f","resolution":{"observed_at":"2026-08-10T19:44:46.665840Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-08-10T13:50:03.897892Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-10T19:44:46.670433Z","title":"Artprompt: Ascii art-based jailbreak attacks against aligned llms,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.670433Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:715dbbe6b50eec90fd4500bebd7ce8212023133168635852e36b959716b7cde3","observation_id":"0582cb30-de7d-42d4-9823-b62a3b495006","resolution":{"observed_at":"2026-08-10T19:44:46.670433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.711461Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":"4236c00e-a666-44ca-b0aa-debca7d56d86","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.673956Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:adf53bf712517e348055f0159d6e1858f9f504a39feeeca735b67c9c1c8aeac7","observation_id":"284bb75e-10f3-4186-a285-4502491a817c","resolution":{"observed_at":"2026-08-10T19:44:47.715548Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-10T19:44:46.677085Z","title":"Prompt injection attack against llm-integrated applications,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.677085Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:424d75a562bf5d818fdbc203c9b9bfbcc6bca5a61b83d5041e396860a9162506","observation_id":"9e50f171-f624-4d50-8d07-0ab676d86fb3","resolution":{"observed_at":"2026-08-10T19:44:46.677085Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.699733Z","title":"New prompt injection attack on chatgpt web version. markdown images can steal your chat data","venue":null,"work_id":"80a3a47b-aecf-4d1f-a9de-525372e10f12","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.680598Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:9b2f2fa7de6f9fdc4f3100d535e5fb066bc76cd03b726d5bfe5b5514f6af7213","observation_id":"874fa737-6b6a-454a-8515-af2d00b2b28d","resolution":{"observed_at":"2026-08-10T19:44:47.703708Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-10T19:44:46.684263Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.684263Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ad93fb423cbd8b0d38ebf7e11137f5b036f6eb018cfc95a1eefb607ff63d5b0f","observation_id":"6abfb145-4285-497e-a175-a8f024a47fbb","resolution":{"observed_at":"2026-08-10T19:44:46.684263Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14197","last_updated":"2025-01-27T08:51:16Z","snapshot_observed_at":"2026-08-11T04:13:43.714152Z","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.14197","snapshot_observed_at":"2026-08-10T19:44:46.688359Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.688359Z"},"links":{"cited_paper":"/paper/2312.14197","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:654e31a5652bc066e4ce620e3cf33607c5b4024446e7e6b1bcd7ab54ee86bfb8","observation_id":"c0947bfe-05a8-4e3b-b10c-9625c6923823","resolution":{"observed_at":"2026-08-10T19:44:46.688359Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.688030Z","title":"Agent hijacking: The true impact of prompt injection at- tacks,","venue":null,"work_id":"94591eac-c672-4cda-8dfe-6a46a24faea0","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.692366Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:b3ab00bdff9b4adf6efa1ef6408e7e6d095b0b99397483a661ef42011d39e3e4","observation_id":"bd0138ba-04aa-4a41-bdc3-f2c85c7b16ae","resolution":{"observed_at":"2026-08-10T19:44:47.692359Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.675694Z","title":"Fine-tuning with the Gemini API — Google AI for Devel- opers — ai.google.dev,","venue":null,"work_id":"e7e60089-39c5-4a80-a2ba-067cbce42b13","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.695917Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:6227c9ae43737ce427fe020b18fb6b2d4850a77d274a555fdd2d244e7da0d377","observation_id":"df4d6799-3b1e-45af-bb27-35ae57aa8038","resolution":{"observed_at":"2026-08-10T19:44:47.679867Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.663582Z","title":"Fine-tuning now available for gpt-4o,","venue":null,"work_id":"e4e93ac2-fa4c-480e-8677-0e6deb5e0629","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.699831Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:fb8476a626930f5c4d5a581603ae5f49e000fa5b1817023b6b001f4862811f82","observation_id":"cbd19d35-23e1-4f5b-b030-7eb255f68c41","resolution":{"observed_at":"2026-08-10T19:44:47.667734Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.651571Z","title":"Fine-tune anthropic’s claude 3 haiku in amazon bedrock to boost model accuracy and quality,","venue":null,"work_id":"b61f6bea-62bf-4c5a-9651-3b79c22c3ae9","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.703748Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:f6956e473b36c824fcbca9651dc68853782016c574ca253fa1bb5fad8864dc0c","observation_id":"e5e97e32-ccee-4796-8b1d-8433776b4eaf","resolution":{"observed_at":"2026-08-10T19:44:47.655732Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-10T11:04:18.421023Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-10T19:44:46.707471Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.707471Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:61b7a7b70955fddb11f25ecdc5615ef597c6ec786bef2cbdc5a26645c325c6ca","observation_id":"39b5467a-753a-4989-8449-08335e7142a4","resolution":{"observed_at":"2026-08-10T19:44:46.707471Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.639373Z","title":"ChatGPT-Dan-Jailbreak,","venue":null,"work_id":"9d01040c-dc3f-43ec-963c-149afe12533b","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.711478Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:3e4318903e9e48090f1317681ae3521a8ba35c808ee223242dcec88ec34b37c8","observation_id":"df1b7af3-2a90-49b5-88c2-a10f74a78156","resolution":{"observed_at":"2026-08-10T19:44:47.643361Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-10T19:44:46.715399Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.715399Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:c4c3b4f5b2e3bddd28ed7f934f232e0cec60464cad0b58baebf3ae06aa1755da","observation_id":"830119b9-2f3f-4a2c-8579-0330fb7470d1","resolution":{"observed_at":"2026-08-10T19:44:46.715399Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.627882Z","title":"Tree of attacks: Jailbreaking black-box llms automatically,","venue":null,"work_id":"59ac2cc2-de7f-46d3-9836-23c1bdb7d8b1","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.719643Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:efaf67c933eb12256f691df8b8e7885fc731586031f4df74013f43cd07c40ba4","observation_id":"1c865d34-941f-4f78-b930-4589adf615af","resolution":{"observed_at":"2026-08-10T19:44:47.632052Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:46.723352Z","title":"Universal and transferable adversarial attacks on aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.723352Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:e8292574650ac2f82413729cfe312dcb790a81ce46709fd27c4d5e12995c9fbd","observation_id":"ad1b6a1a-8ff3-4c77-a6c1-ae048083257e","resolution":{"observed_at":"2026-08-10T19:44:46.723352Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12329","last_updated":"2024-12-07T23:09:49Z","snapshot_observed_at":"2026-08-11T03:10:02.344730Z","submitted_at":"2024-02-19T18:01:36Z","title":"Query-Based Adversarial Prompt Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.12329","snapshot_observed_at":"2026-08-10T19:44:46.731684Z","title":"Query-based adversarial prompt generation,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.731684Z"},"links":{"cited_paper":"/paper/2402.12329","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ad5b80db24a5fc487b3159435d817ade5b7bc798e6e154f6299c6d2aa0988497","observation_id":"979f79fe-c948-4161-a02f-42175b8737b5","resolution":{"observed_at":"2026-08-10T19:44:46.731684Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-10T19:44:46.739609Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.739609Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:c3adb9c9ca05dbf93521ad33ffb084fa295907a701f2dfcc73c3954f74e87680","observation_id":"8ad8aee2-5358-44f7-adba-df9787fb43f8","resolution":{"observed_at":"2026-08-10T19:44:46.739609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.609888Z","title":"Chat create top logprobs — openai api refer- ence,","venue":null,"work_id":"c0a5457a-406d-45de-bda6-a9ce64335ed4","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.743573Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:33fea59cca20ec172e155e73de2130b6ef0b13c9b650eb4e2c45207743808ce3","observation_id":"2b1ea4e5-f017-4a50-9cc3-5173d80d7fcb","resolution":{"observed_at":"2026-08-10T19:44:47.613923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.598806Z","title":"Generating content — Gemini API,","venue":null,"work_id":"910e506f-6b3f-41c3-9c8e-34803e66bdcd","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.747694Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ba5f798dfae1f918f5c089aca8fe2efc88d6795c4cc1fe922263f8a28673acdf","observation_id":"e370eae3-f5b4-45f9-b058-acfa317bf3dc","resolution":{"observed_at":"2026-08-10T19:44:47.602801Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06634","last_updated":"2024-07-09T17:44:00Z","snapshot_observed_at":"2026-08-10T12:12:16.686272Z","submitted_at":"2024-03-11T11:46:12Z","title":"Stealing Part of a Production Language Model","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.06634","snapshot_observed_at":"2026-08-10T19:44:46.751961Z","title":"Stealing part of a production language model,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.751961Z"},"links":{"cited_paper":"/paper/2403.06634","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:7276b99f239153eda5a893f9dc850ae781ce0135cd0ce8df7dfa97228731f44a","observation_id":"5e7e3a1c-59f7-475f-a08d-89bca95f164c","resolution":{"observed_at":"2026-08-10T19:44:46.751961Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.20053","last_updated":"2024-06-28T17:05:46Z","snapshot_observed_at":"2026-08-10T06:52:25.049657Z","submitted_at":"2024-06-28T17:05:46Z","title":"Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.20053","snapshot_observed_at":"2026-08-10T19:44:46.756162Z","title":"Covert malicious finetuning: Challenges in safeguarding llm adaptation,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.756162Z"},"links":{"cited_paper":"/paper/2406.20053","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:6b817221e3e6b026a20f243b8d85f041ebd3564edb1313a6d567748c7649a5ef","observation_id":"889afef5-80b1-443f-a3a6-acb3d07690f1","resolution":{"observed_at":"2026-08-10T19:44:46.756162Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13161","last_updated":"2024-04-19T20:11:12Z","snapshot_observed_at":"2026-08-07T13:01:36.699787Z","submitted_at":"2024-04-19T20:11:12Z","title":"CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13161","snapshot_observed_at":"2026-08-10T19:44:46.760303Z","title":"Cyberseceval 2: A wide-ranging cybersecurity evaluation suite for large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.760303Z"},"links":{"cited_paper":"/paper/2404.13161","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:8310a7193d98154703b31fb202619a18e69d7906d08beea90ed56d016f285305","observation_id":"76ea2f15-2dda-4a04-90a1-5214d73678b1","resolution":{"observed_at":"2026-08-10T19:44:46.760303Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09674","last_updated":"2024-02-15T02:54:49Z","snapshot_observed_at":"2026-08-08T08:35:43.230201Z","submitted_at":"2024-02-15T02:54:49Z","title":"PAL: Proxy-Guided Black-Box Attack on Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09674","snapshot_observed_at":"2026-08-10T19:44:46.764390Z","title":"Pal: Proxy- guided black-box attack on large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.764390Z"},"links":{"cited_paper":"/paper/2402.09674","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:30084edb0ef64bc09edd2abefa4662228d831b3e7334c9d6a8f4fbf97da89b4d","observation_id":"70f2dad5-0b57-4929-a353-aebc6abe5965","resolution":{"observed_at":"2026-08-10T19:44:46.764390Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-11T03:37:22.279261Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-10T19:44:46.768410Z","title":"Struq: Defending against prompt injection with structured queries,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.768410Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:caab1cbdf112d0db5b8dd73e28f44e881d18846bcaeb8c78c794b452f2a22309","observation_id":"5d8c0595-1804-41eb-85a2-36422b8644b0","resolution":{"observed_at":"2026-08-10T19:44:46.768410Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.586935Z","title":"Finetuned language models are zero-shot learners,","venue":null,"work_id":"4d66104b-55ca-4258-ae34-ec9922ddc433","year":2022},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.772019Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:f34a9c47931d9dd3b88286fd6804b5125bd71fc382cd31b23057514fa672f715","observation_id":"4e8fca0e-a0c3-4ad1-9b9a-e17578678e08","resolution":{"observed_at":"2026-08-10T19:44:47.591077Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.17193","last_updated":"2024-02-27T04:18:49Z","snapshot_observed_at":"2026-08-10T16:54:55.723491Z","submitted_at":"2024-02-27T04:18:49Z","title":"When Scaling Meets LLM Finetuning: The Effect of Data, Model and Finetuning Method","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.17193","snapshot_observed_at":"2026-08-10T19:44:46.775775Z","title":"When scaling meets llm finetuning: The effect of data, model and finetuning method,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.775775Z"},"links":{"cited_paper":"/paper/2402.17193","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:d24d0b0241db1922d2e197ea1ba3195db76b6ceb8ab118fbc866471c543ff369","observation_id":"d8e020f0-331e-440f-8dba-ddacd42d4c06","resolution":{"observed_at":"2026-08-10T19:44:46.775775Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.575494Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions,","venue":null,"work_id":"abee4223-b387-4896-ab38-c050bcd53c69","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.779420Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:38352600beebb008f1c140496faed78af031877320da11edcbff15ef67d940ea","observation_id":"f3ff758f-92c9-437a-9fc5-8ef4890a85fe","resolution":{"observed_at":"2026-08-10T19:44:47.579417Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.564287Z","title":"Llm research insights: Instruction masking and new lora finetuning experiments,","venue":null,"work_id":"a5b498d2-6307-48df-86c1-f73a2efbd249","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.782798Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:122b8f3b27c8b190bbc740c53324622e48a1836d321426c9044b316f0c246846","observation_id":"a702172c-200f-4800-a189-51c164886adc","resolution":{"observed_at":"2026-08-10T19:44:47.568392Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.14394","last_updated":"2024-10-02T20:36:11Z","snapshot_observed_at":"2026-07-06T18:18:30.066741Z","submitted_at":"2024-05-23T10:12:03Z","title":"Instruction Tuning With Loss Over Instructions","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.14394","snapshot_observed_at":"2026-08-10T19:44:46.786002Z","title":"Instruction tuning with loss over instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.786002Z"},"links":{"cited_paper":"/paper/2405.14394","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:5fcd1d432e9045155ec7823606bc85c744a57f85bfcc4c9665deadfcb009404e","observation_id":"909ba9a7-ef16-40ae-b98b-793c3da831d8","resolution":{"observed_at":"2026-08-10T19:44:46.786002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06927","last_updated":"2023-10-13T13:47:44Z","snapshot_observed_at":"2026-08-09T19:43:52.208487Z","submitted_at":"2023-10-10T18:28:38Z","title":"Sparse Fine-tuning for Inference Acceleration of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06927","snapshot_observed_at":"2026-08-10T19:44:46.790347Z","title":"Sparse fine-tuning for inference acceleration of large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.790347Z"},"links":{"cited_paper":"/paper/2310.06927","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:36b242094d7ea41d979e35d950f33ee65beffa04cb226cce41ad3fe639011c90","observation_id":"54c4330b-5e63-4bcc-869e-9cd6dfe4d40a","resolution":{"observed_at":"2026-08-10T19:44:46.790347Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.552414Z","title":"Neural exec: Learning (and learning from) execution triggers for prompt injection attacks,","venue":null,"work_id":"cbe908c2-8dde-4652-b75d-afcdca2bbbbf","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.794158Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:cbc11ed88c7142af9110b65a21b44696ad46a7eba4ae6df764013079505cd3a6","observation_id":"956b3e1a-7c97-4f93-9ed8-1d7baf66e39f","resolution":{"observed_at":"2026-08-10T19:44:47.556926Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.540494Z","title":"Gemma 2: Improving open language models at a practical size,","venue":null,"work_id":"cf6562f3-a752-4857-b48f-d8cc36113a15","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.802433Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:6a473c36f037feaadc95b68bdc38a4dff08ee768ed739ec8cbcf1a96cb9766c3","observation_id":"60392b47-f5ed-4ec5-be81-7bfc74e844bc","resolution":{"observed_at":"2026-08-10T19:44:47.544728Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05530","last_updated":"2024-12-16T17:39:39Z","snapshot_observed_at":"2026-07-06T17:41:42.995949Z","submitted_at":"2024-03-08T18:54:20Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05530","snapshot_observed_at":"2026-08-10T19:44:46.806608Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.806608Z"},"links":{"cited_paper":"/paper/2403.05530","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:368a986f5cdb24cb6b92565e205e90187e704969536b07fd44e92abf5261be09","observation_id":"62f003c0-4ac9-4449-ab33-00aea694a805","resolution":{"observed_at":"2026-08-10T19:44:46.806608Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.528001Z","title":"How we estimate the risk from prompt injection attacks on ai sys- tems,","venue":null,"work_id":"cb8e5c8d-c5dd-4bbc-af7a-78c11f8b161e","year":2025},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.811264Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:277d8ee6ac26bd05bde30c2348c1a060d7a56713a1a0ef24642044c1d2b0285e","observation_id":"c49828c7-1f66-41ec-a2e1-b3cf613228c5","resolution":{"observed_at":"2026-08-10T19:44:47.532541Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.513940Z","title":"Fine-tune claude 3 haiku,","venue":null,"work_id":"1e4673c6-1a49-4ec1-9816-c86317a5383b","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.816056Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:c297708023215921dedb81056877a67348228c7d76e1d465a0d631e30a3eb23b","observation_id":"691bd998-7c7e-4e4e-91d5-eaeeab4f4852","resolution":{"observed_at":"2026-08-10T19:44:47.518234Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.501589Z","title":"Model tuning with gemini api,","venue":null,"work_id":"24050e64-85c7-4101-9a29-06d04f7350e7","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.819957Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:b4b32e5b4c8a9b7c8b22faba96f6952f57d1b540effe47a750e0fd82e94a69d5","observation_id":"41e42d8c-0cb0-4a4f-9af1-fd9b8be56bbc","resolution":{"observed_at":"2026-08-10T19:44:47.505794Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.488988Z","title":"Fine-tuning llms: Lora or full parameter? an in-depth analysis with llama 2,","venue":null,"work_id":"188dcd99-2216-4208-873e-b0bef6b979ea","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.823878Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:fea84869beafb7ee569ee51261176882a297e4d163c193d9dfa20ff3ac955b0d","observation_id":"42abb410-9fe1-4b6a-b6c3-850f0698ea8b","resolution":{"observed_at":"2026-08-10T19:44:47.493310Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03185","last_updated":"2023-10-04T22:10:01Z","snapshot_observed_at":"2026-08-10T21:58:21.136877Z","submitted_at":"2023-10-04T22:10:01Z","title":"Misusing Tools in Large Language Models With Visual Adversarial Examples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03185","snapshot_observed_at":"2026-08-10T19:44:46.827770Z","title":"Misusing tools in large language mod- els with visual adversarial examples,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.827770Z"},"links":{"cited_paper":"/paper/2310.03185","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:3e2badad3227ef8cd2f99c8009d750c74c82442749dbf792fdee1b2807118f03","observation_id":"04d99e7a-0746-4640-9a3e-8186ffb1655b","resolution":{"observed_at":"2026-08-10T19:44:46.827770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.476698Z","title":"Ai injections: Direct and indirect prompt injections and their implications,","venue":null,"work_id":"592347fc-6fa3-4e87-b336-b91d51a33fcf","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.831706Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:8faa1ee4cf29acf126615dde53477f2a5d38d69ed5ace4f298ac57ab3dda45b2","observation_id":"6ed86468-f91f-46a7-bcdf-c183ca47dce4","resolution":{"observed_at":"2026-08-10T19:44:47.481029Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.464851Z","title":"Prompt injection: What’s the worst that can happen?","venue":null,"work_id":"d9119a17-e7ef-4ebd-941e-dde059bfefe8","year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.835417Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:8bfce5560764724762fb24a692b4f1defefc247d2327627409b248ea7a3205f2","observation_id":"43a931c0-7846-4570-82dd-082507ba66fd","resolution":{"observed_at":"2026-08-10T19:44:47.469176Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:46.839098Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.839098Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:e160a3112bd71a2f7cd47c465f0c3e908c23d4c4c0182183b4f87d5836cc189e","observation_id":"b8f5ea0f-6eeb-4958-9fce-a19939c6fcae","resolution":{"observed_at":"2026-08-10T19:44:46.839098Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.05197","last_updated":"2023-11-01T05:14:01Z","snapshot_observed_at":"2026-08-11T19:00:01.366374Z","submitted_at":"2023-04-11T13:05:04Z","title":"Multi-step Jailbreaking Privacy Attacks on ChatGPT","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.05197","snapshot_observed_at":"2026-08-10T19:44:46.843108Z","title":"Multi-step jailbreaking privacy attacks on chatgpt,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.843108Z"},"links":{"cited_paper":"/paper/2304.05197","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:a9a6da03b7426809a7e1344ab67f1adb2b5b1ae25b41f17d036e97ba98928d95","observation_id":"132c74c1-6904-4ac5-9d06-277f13775b73","resolution":{"observed_at":"2026-08-10T19:44:46.843108Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.445508Z","title":"Many-shot jailbreaking — anthropic.com,","venue":null,"work_id":"e675f8a2-1d1f-468e-9e49-efe2c3caff65","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.847001Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:fbf60ebbc284d1311584970e59bf1b9c9fefcfa5ee6655112a200f610b933b32","observation_id":"cc805c16-701c-4902-91c1-58c597e2b13c","resolution":{"observed_at":"2026-08-10T19:44:47.449893Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.433312Z","title":"OpenAI’s latest model will block the ‘ignore all previous instructions’ loophole,","venue":null,"work_id":"01bc3639-6823-48ab-9248-30b8e6c9913e","year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.850762Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:3b3c2a0c4123c4a414b6d3c3d79732b92f78369fe4bf24b99016bcc7bbb9d057","observation_id":"7daffdd7-ab65-4638-b708-05b26b7d7940","resolution":{"observed_at":"2026-08-10T19:44:47.437664Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15570","last_updated":"2024-02-23T19:12:53Z","snapshot_observed_at":"2026-07-06T17:34:45.072246Z","submitted_at":"2024-02-23T19:12:53Z","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15570","snapshot_observed_at":"2026-08-10T19:44:46.854571Z","title":"Fast adversarial attacks on language models in one gpu minute,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.854571Z"},"links":{"cited_paper":"/paper/2402.15570","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ca77379ca2086c11e01b38ba31860775badbe13b787d80805dee97751ea9b78c","observation_id":"49f88a70-0a9e-490f-898d-375295fb61fd","resolution":{"observed_at":"2026-08-10T19:44:46.854571Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:46.858522Z","title":"Poisoning language models during instruction tuning,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.858522Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ca7dc795bdf4bceb64f338d6d45855420f07540d7500cbbc895352afbe60226e","observation_id":"037aa978-fbf3-465a-b1fb-fc1aadbb19f8","resolution":{"observed_at":"2026-08-10T19:44:46.858522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.12736","last_updated":"2024-07-03T06:13:31Z","snapshot_observed_at":"2026-08-01T22:35:14.271991Z","submitted_at":"2023-12-20T03:18:50Z","title":"Learning and Forgetting Unsafe Examples in Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.12736","snapshot_observed_at":"2026-08-10T19:44:46.862115Z","title":"Learning and forgetting unsafe examples in large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.862115Z"},"links":{"cited_paper":"/paper/2312.12736","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:12d2db832204ed9ca83713e904984366205162cd4c7267b38da3bf0f22eae7ca","observation_id":"e3d6893a-b1a3-42d2-8783-f956295b4005","resolution":{"observed_at":"2026-08-10T19:44:46.862115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05553","last_updated":"2024-04-05T23:30:56Z","snapshot_observed_at":"2026-08-07T23:30:34.877117Z","submitted_at":"2023-11-09T17:54:59Z","title":"Removing RLHF Protections in GPT-4 via Fine-Tuning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05553","snapshot_observed_at":"2026-08-10T19:44:46.865919Z","title":"Removing rlhf protections in gpt-4 via fine-tuning,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.865919Z"},"links":{"cited_paper":"/paper/2311.05553","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:aafef62d162a7d6f25fe0298ac280b3fb651afc0caed5da30e60ee65bd803388","observation_id":"e547205d-9d30-43e7-873b-91ecda930a92","resolution":{"observed_at":"2026-08-10T19:44:46.865919Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03693","last_updated":"2023-10-05T17:12:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-05T17:12:17Z","title":"Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03693","snapshot_observed_at":"2026-08-10T19:44:46.869783Z","title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.869783Z"},"links":{"cited_paper":"/paper/2310.03693","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:f662a72f09b7ac5af7ba4837aa75106666e955cb1949c28bc6f7b5bbdc7db73a","observation_id":"be5c333d-8702-4505-9b94-04e4a47436e4","resolution":{"observed_at":"2026-08-10T19:44:46.869783Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.415017Z","title":"Stealing machine learning models via prediction {APIs},","venue":null,"work_id":"981ac449-f939-43bb-9855-b5dfba9f1491","year":2016},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.873779Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:ce9aa580ac42599ec66fc28910d9cea4b5b3f317f72e0c8cd559cc970dfdaa1f","observation_id":"930678c3-6d00-433f-958e-38e106789db1","resolution":{"observed_at":"2026-08-10T19:44:47.419382Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.402805Z","title":"Leaky dnn: Stealing deep-learning model secret with gpu context-switching side- channel,","venue":null,"work_id":"7efec597-0a2d-41df-929d-9cbde175040e","year":2020},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.877287Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:cba959002db7b338ead5cd039d4fbd8508369b49769c17ef2acf18c5ded681ca","observation_id":"9d987781-e7a1-462d-b8d5-b5710d4c8b5c","resolution":{"observed_at":"2026-08-10T19:44:47.407941Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.391286Z","title":"On the sizes of openai api models,","venue":null,"work_id":"73bdd218-103d-44b9-87a1-06461e11f8cd","year":2021},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.881040Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:11ffa0ebfd6e10e63945e0c92c2b31c60385109109d1a706a433072d73b455fd","observation_id":"7dcb638b-0c09-42fb-924f-565972851c8a","resolution":{"observed_at":"2026-08-10T19:44:47.395424Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.380096Z","title":"Anthropic tokenizer,","venue":null,"work_id":"20800a7e-68c6-45e6-a2f7-7108e8bfdabb","year":2020},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.884518Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:413adba26e3648d125543cb3197b084976c032d096ed3044494bab210fbb03c2","observation_id":"1d10e6f8-17ba-4e7d-9374-158774c915bf","resolution":{"observed_at":"2026-08-10T19:44:47.383906Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.368666Z","title":null,"venue":null,"work_id":"b22b9ede-aa71-40eb-a98d-1432df68b22f","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.888569Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:a632b8248b34a490bb40b3167661d4c657493bea504fadf551b24fd90878bfc3","observation_id":"13e4e8dc-b042-4dcc-80ec-8668d70ebcc4","resolution":{"observed_at":"2026-08-10T19:44:47.372357Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.357620Z","title":null,"venue":null,"work_id":"21ef1273-78da-489c-b55e-0d855518e242","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.892036Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:e8dbdb9b1c13846b2d429a572f6593f09fd1bab343c292439381beef2557082c","observation_id":"db61c01e-0c12-4674-9cb6-43d7eede1420","resolution":{"observed_at":"2026-08-10T19:44:47.361126Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.347021Z","title":null,"venue":null,"work_id":"c6d856ad-ec10-494a-a4ae-ce76e3ca94ac","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.895486Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:7c46b72ca44ae44b0e55045c02a81bc2602dfaf92072686e01fad69484e37852","observation_id":"d9ae7401-df04-4bdc-95d9-9009817f3248","resolution":{"observed_at":"2026-08-10T19:44:47.350698Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.335828Z","title":"Appendix C","venue":null,"work_id":"18822bd6-ed38-4469-9b86-3f587b8b3751","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.899408Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:e241562133809c3375e8acaf6dbf545f2b453fe90164474cb63be0081df5b991","observation_id":"1475143e-a480-42a2-9969-dfdf9bdea8bf","resolution":{"observed_at":"2026-08-10T19:44:47.339635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T19:44:47.323677Z","title":null,"venue":null,"work_id":"43a97bd5-9902-4d28-adc6-f7430405c49d","year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.904083Z"},"links":{"citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:2ec70464260011b4de4558cab94e6d54416fec6524fd089072f51d28d4c23200","observation_id":"fe648af9-ece8-4a51-8f46-d9d1f6dacd71","resolution":{"observed_at":"2026-08-10T19:44:47.328186Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03792","last_updated":"2024-05-02T09:25:38Z","snapshot_observed_at":"2026-07-06T17:40:29.558340Z","submitted_at":"2024-03-06T15:40:30Z","title":"Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03792","snapshot_observed_at":"2026-08-10T19:44:46.798448Z","title":"Available: https://arxiv.org/abs/2403.03792","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","version":2},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-10T19:44:46.798448Z"},"links":{"cited_paper":"/paper/2403.03792","citing_paper":"/paper/2501.09798"},"observation_digest":"sha256:f404442bfafb40402cd5039f6b19b47aa574b890e89fa35ea8ffe1b81ba8b99a","observation_id":"27a7fa14-653a-47e3-aebd-1be0f2c28992","resolution":{"observed_at":"2026-08-10T19:44:46.798448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2501.09798","last_updated":"2025-05-10T02:36:13Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-10T21:58:42.525514Z","submitted_at":"2025-01-16T19:01:25Z","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface"},"reference_resolution":{"displayed":65,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":36,"verified_exact":0,"verified_fuzzy":29},"total_outbound_references":65},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 65 of 65 outbound references and 3 inbound Pith citation observations for arXiv:2501.09798."}