{"as_of":"2026-08-13T09:46:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:de040a07eb14d8099dba2ccd9125af84cbe2c0e89615a3e6cb1ff33de0e61a36","coverage":[{"denominator":58,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":58,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-09T14:02:38.960422Z","state":"measured"},{"denominator":60,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":60,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-13T05:17:34.283917Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"cited_work":{"arxiv_id":"2502.01925","doi":"10.48550/arxiv.2502.01925","metadata_source":"arxiv_reference","pith_arxiv_id":"2502.01925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling , shorttitle =","venue":"ArXiv.org","work_id":"36f6770b-3ea9-4ca9-8f53-6b6514b93448","year":2025},"citing_paper":{"arxiv_id":"2605.08277","last_updated":"2026-05-08T06:33:42Z","snapshot_observed_at":"2026-08-11T13:29:06.290553Z","submitted_at":"2026-05-08T06:33:42Z","title":"Mitigating Many-shot Jailbreak Attacks with One Single Demonstration","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-12T00:50:19.648405Z"},"links":{"cited_paper":"/paper/2502.01925","citing_paper":"/paper/2605.08277"},"observation_digest":"sha256:fe7733115365884cdbabff7b766a5b553885882375f894e9d5cb474accdf3414","observation_id":"cc00ba49-84be-496a-8562-a7fb38e9ce60","resolution":{"observed_at":"2026-05-12T00:51:14.961667Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"cited_work":{"arxiv_id":"2502.01925","doi":"10.48550/arxiv.2502.01925","metadata_source":"arxiv_reference","pith_arxiv_id":"2502.01925","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling , shorttitle =","venue":"ArXiv.org","work_id":"36f6770b-3ea9-4ca9-8f53-6b6514b93448","year":2025},"citing_paper":{"arxiv_id":"2605.12412","last_updated":"2026-05-12T17:09:41Z","snapshot_observed_at":"2026-08-11T04:19:07.969715Z","submitted_at":"2026-05-12T17:09:41Z","title":"Stories in Space: In-Context Learning Trajectories in Conceptual Belief Space","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-05-13T05:17:34.283917Z"},"links":{"cited_paper":"/paper/2502.01925","citing_paper":"/paper/2605.12412"},"observation_digest":"sha256:80e502c05a0f3fea96f219eb0e47bc964b935d830c6f717abbbf34d118b8bd86","observation_id":"ce3b0946-6889-419e-b0b4-9ee3f453c93f","resolution":{"observed_at":"2026-05-13T05:22:18.823341Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2502.01925/citation-record","integrity":"/paper/2502.01925/integrity","json":"/paper/2502.01925/citation-record.json","paper":"/paper/2502.01925"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:38.672091Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.672091Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:ac34712282bd5bd662b8a553962495573a7a5cf85ee1dbceafe108164d762b5b","observation_id":"edc6b069-b5ec-4df6-b96a-ea72e66ed362","resolution":{"observed_at":"2026-08-09T14:02:38.672091Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-09T14:02:38.679096Z","title":"L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.679096Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e779cb4fbd4f3a22a80798829556c20cee66993004892c484b0a9cdabc8fc4d0","observation_id":"e9a89191-3d1f-429b-8239-d140d4c4eee0","resolution":{"observed_at":"2026-08-09T14:02:38.679096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.892769Z","title":"What learning algorithm is in-context learning? investigations with linear models","venue":null,"work_id":"c1b7e896-c392-4ee2-b25f-6ceb3de7ddf1","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.685122Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:363ba98c1bd9535bed5f7982d8183bba3f7280c6c98ba9b79504151114971116","observation_id":"0af1b2ab-2c22-4241-bb72-d7ed61f1de33","resolution":{"observed_at":"2026-08-09T14:02:39.898135Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.876205Z","title":"Jailbreaking leading safety-aligned LLM s with simple adaptive attacks","venue":null,"work_id":"03457e81-6b29-46ec-a5ff-aa88760d72a8","year":2025},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.690848Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:30ef5881d745bb0747a81bb6b611adbe4732a60a851e4c8a6c6455d69d7d09bb","observation_id":"c4799bcd-3113-4929-bbf6-ef61d02c8f81","resolution":{"observed_at":"2026-08-09T14:02:39.881193Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.860197Z","title":"J., et al","venue":null,"work_id":"ce1b8093-d5e9-4633-98dd-31c26a746ff1","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.696196Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:a8023f26417dacedc36fb6fbef308154da97855c08aa0e0e1778d864c9254f9d","observation_id":"810a0264-d52d-464a-bb96-7e44d721b7d6","resolution":{"observed_at":"2026-08-09T14:02:39.865038Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-09T14:02:38.701627Z","title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.701627Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:ea69b98e4e13945b55dc5b3766982e576926676bff80b8f4f33116f05bb9db99","observation_id":"0f58597b-951d-43b5-b104-348bb47970ad","resolution":{"observed_at":"2026-08-09T14:02:38.701627Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:38.707132Z","title":"D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.707132Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:26756b7e81f685cf23f00c6d55a9f53c07700faae073d7588d85615cd05a9fbe","observation_id":"9a4038b2-7caa-44c7-8fa2-9afbbd46c36a","resolution":{"observed_at":"2026-08-09T14:02:38.707132Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.833953Z","title":"J., and Wong, E","venue":null,"work_id":"4f8d3e52-c3d1-4d1e-bba1-f4b8ced24b42","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.712934Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:c634188c382a59670d4ddf4fcee49f7d51c2fac6ad38a09eddc0aebfecb2643e","observation_id":"2076e417-f77e-4b9d-abfe-e7389033a782","resolution":{"observed_at":"2026-08-09T14:02:39.838867Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.818629Z","title":"How many demonstrations do you need for in-context learning? In Findings of the Association for Computational Linguistics: EMNLP, 2023","venue":null,"work_id":"948960f0-71bb-4d0e-878a-20bc60487c0a","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.717968Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:726742a26e886102e7ce39507772e2de13af16b283392d605ce77f0c9a606491","observation_id":"53ca5892-b4e7-441f-9fb9-500c604c1d03","resolution":{"observed_at":"2026-08-09T14:02:39.823673Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.802967Z","title":"What does BERT look at? A n analysis of BERT ’s attention","venue":null,"work_id":"980572a1-b7a0-437f-8d40-9307b51332dc","year":2019},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.723140Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e74152e7f0bbca424769f61d5c904c2b4c2428d94726039009482a19b497ceef","observation_id":"1dba753b-4f46-419f-afa2-0d2c5c3e4f2c","resolution":{"observed_at":"2026-08-09T14:02:39.808177Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.785655Z","title":"BERT : Pre-training of deep bidirectional transformers for language understanding","venue":null,"work_id":"0c221b15-4276-425a-8b23-8ed58de64af1","year":2019},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.728274Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:14af7dd8479293353463754eb1aa4588be1c46ff1a81945802a6125a1e3627fd","observation_id":"41cf55af-ddbc-455e-b3bd-97318fcc5b60","resolution":{"observed_at":"2026-08-09T14:02:39.792042Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.769911Z","title":"L., Zhang, C., Xu, Y., Shang, N., Xu, J., Yang, F., and Yang, M","venue":null,"work_id":"42fb8fde-3348-4a7b-9138-fa488ee7ef37","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.734484Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:508a5305beb82b69d2b4d258833dec6cfabed2cef7cdfa6570042839301be08a","observation_id":"c596d65e-0b2a-41ed-a8ca-41fe1030c439","resolution":{"observed_at":"2026-08-09T14:02:39.774919Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.754658Z","title":"X., Wang, B., Tian, Z., Chen, W., and Wen, J.-R","venue":null,"work_id":"3d2c5c8f-df7a-4b1a-994c-c3c077156c6a","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.739622Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e8d003345f0e7b11660069eba4c7a3089555796b13b171828d181e6757e38ffa","observation_id":"7548d31d-efd0-4ff1-936e-a3329d3fc9cc","resolution":{"observed_at":"2026-08-09T14:02:39.759338Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-10T16:40:37.411115Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-09T14:02:38.744562Z","title":"The Llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.744562Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:9ff669e50a6d0c935c4ebe9df14c9da840952b5c0d6e7fa45d4ff382a1f6737d","observation_id":"6b652bf3-e455-4335-9306-f8562761a66a","resolution":{"observed_at":"2026-08-09T14:02:38.744562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.739040Z","title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned","venue":null,"work_id":"fdd468a3-aa89-46d9-b51c-f9d29149bae8","year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.749852Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:f9721f564813bc31c8182e328056b7309b617a0ebb47c9da7f82df537a2e1e62","observation_id":"339f643a-586c-477f-869c-4a27c619d4d3","resolution":{"observed_at":"2026-08-09T14:02:39.744028Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.723155Z","title":"and Das, K","venue":null,"work_id":"9ebae7ec-7bbb-4ab6-bdd5-0e884f7ec185","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.754667Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:4981377a3dc4628ed08c042e8d758f684f2286855de1cc4681b5a75b4a0cd97a","observation_id":"1a8bc742-36e0-4988-9b6b-e375a885ad6c","resolution":{"observed_at":"2026-08-09T14:02:39.728024Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.707271Z","title":"ChatGLM : A family of large language models from GLM-130B to GLM-4 all tools, 2024","venue":null,"work_id":"ebdd7697-812c-4365-b693-410ae71f4087","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.759412Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e778107dbd8428820b8f1814cc84f84b3b37c3f8ac08127a871fce1c4be2a2b6","observation_id":"cf188ecf-51e2-484e-92bd-a5e0721bc083","resolution":{"observed_at":"2026-08-09T14:02:39.712294Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.691602Z","title":"Comparing results of 31 algorithms from the black-box optimization benchmarking BBOB-2009","venue":null,"work_id":"3608a43e-110c-4d86-bdd4-b175e14a7451","year":2009},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.764123Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:12b9920de86835296a4daa1b95dee1dec4a3708eb84d0641195f40ed1954cf7b","observation_id":"3540208b-63db-4f9d-b6f2-6aa9e12ad817","resolution":{"observed_at":"2026-08-09T14:02:39.696549Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.675940Z","title":"Self-attention attribution: Interpreting information interactions inside transformer","venue":null,"work_id":"f259c598-0e01-4a6f-8891-98745d556199","year":2021},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.769107Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:9a0c0bd82fa42254f0f7b77114bd7d62696a2749165ff6ae204c71fb1da28f4e","observation_id":"78bba061-cf75-4aec-9343-966316fe9e89","resolution":{"observed_at":"2026-08-09T14:02:39.680842Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.660716Z","title":"WizardLM-13B-Uncensored , 2023","venue":null,"work_id":"387ca272-d29b-4533-86d3-835f6ee3af29","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.774170Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e4c79a1ac30a29f15fe5bddfa8512fd7c69db5a5c3445f949a2110fcd78794e4","observation_id":"573ae094-0bdb-4b6a-aae0-1f0ac36359fa","resolution":{"observed_at":"2026-08-09T14:02:39.665681Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.645269Z","title":"Measuring mathematical problem solving with the math dataset","venue":null,"work_id":"2c6fab6b-aa49-4ac5-ae50-cbe252e894b1","year":2021},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.779314Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:7694257b145fa83b0ce066b9ec59cc6c1e332af9a1caf8771fa4ef67b4d32322","observation_id":"1e508619-bdbc-4886-be77-fb0afa741acc","resolution":{"observed_at":"2026-08-09T14:02:39.650630Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-09T14:02:38.784054Z","title":"Baseline defenses for adversarial attacks against aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.784054Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:741fe28b731dec16a4804e6ad2cb28c07137e2b078f5036d4a8d1c1a576e66a6","observation_id":"2d7f3953-7880-46eb-8df1-0541ac21f691","resolution":{"observed_at":"2026-08-09T14:02:38.784054Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.629186Z","title":"LLM maybe LongLM : Self-extend LLM context window without tuning","venue":null,"work_id":"59e989c5-ebb9-46c0-92ff-fcef0fe6cf74","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.789233Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:d7b6db81deb67f102dc09602c507ef498e61c3346acfbdf4ed7a01159ae68ce8","observation_id":"06f05d7f-5f69-49ce-b5fb-96df45cbc25e","resolution":{"observed_at":"2026-08-09T14:02:39.634246Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.613765Z","title":null,"venue":null,"work_id":"61d0da7c-bc18-41b0-bfca-edc14124b08a","year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.794558Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:5cff96e20f8629a96ff362ce0b62f704671e003f5650edc4eae1ba5f2bd011f9","observation_id":"e60d5aa6-b1e3-407d-a9b8-d98f36562f04","resolution":{"observed_at":"2026-08-09T14:02:39.618661Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.598200Z","title":"Fantastically ordered prompts and where to find them: Overcoming few-shot prompt order sensitivity","venue":null,"work_id":"ebb21199-92b9-4749-97ad-7b4213c3032b","year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.799904Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:f45d9c51e850983a12a0a374ca117d4b0bfac2d968b961f04a200716558157e9","observation_id":"c034bce8-ca56-49ff-b366-31cf55b5cc2c","resolution":{"observed_at":"2026-08-09T14:02:39.603277Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.582461Z","title":"Attention-enhancing backdoor attacks against BERT -based models","venue":null,"work_id":"ac78668e-14b9-4df7-9d53-4837b9cba536","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.804891Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:2e0ee435c2ecd86015794f0ee4200346a8dc13ab5f72ead403491fbceee94776","observation_id":"2ba4cd55-4d1e-48f6-a4c9-2645fcc1d322","resolution":{"observed_at":"2026-08-09T14:02:39.587553Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.566302Z","title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":"3d48a516-6797-4456-a0bf-cf155e98e4f9","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.809842Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:4d2feb8bf9f2bc1b32c65de1e5cbf26eae55c1a7979eaa42bd1c8fb076e477f4","observation_id":"a2b9f54d-e71d-42f1-9f8a-89a5fbe7ebb7","resolution":{"observed_at":"2026-08-09T14:02:39.571273Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.551349Z","title":"Tree of attacks: Jailbreaking black-box LLMs automatically","venue":null,"work_id":"2152b304-4f2a-4038-b2f9-fad80709dda1","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.814969Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:ab478f4928e0233da12dce56668182b9b6587daff27c29223cf4a39a8d2566d5","observation_id":"f88212ac-0e77-44f2-8d9f-80d82fd105a0","resolution":{"observed_at":"2026-08-09T14:02:39.556180Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.535716Z","title":"Bayesian Optimization : Open source constrained global optimization tool for Python , 2014","venue":null,"work_id":"e4bd404a-14af-4aae-b8ce-a11657aae492","year":2014},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.819627Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:bbdcf70f7d198451b2cac2d7d0e09a42ba13c008758a5e19cca3bd2e4e49f34a","observation_id":"e980d4f3-c52f-46e3-ae06-2e25889085ca","resolution":{"observed_at":"2026-08-09T14:02:39.540977Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.519834Z","title":"2 OLMo 2 F urious","venue":null,"work_id":"5a126a56-dc1a-4277-b3d9-c05d16da8df5","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.824402Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:99a9a051746c4047b89339888fe23cb7edf07ce301439101d46e38bb1699ec9e","observation_id":"08fe398d-46fd-4119-8b82-7e64b8ea9cb2","resolution":{"observed_at":"2026-08-09T14:02:39.525142Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.502547Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":"23095a98-dee9-4301-8b0e-529961b64008","year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.829040Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:31c7c641ddd442c852338cb3fd529915d97443474e1e2b862d140361feb1cbab","observation_id":"e3e47036-ad29-44a4-9247-54e72e8d252c","resolution":{"observed_at":"2026-08-09T14:02:39.507753Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.486835Z","title":"S., Soltanolkotabi, M., and Thrampoulidis, C","venue":null,"work_id":"094321d4-6492-4f31-a5be-10e915b1738e","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.833730Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:3131a72a8a1ee363b846f49795eaafeac113feeacda0e02dcb32a309282fe707","observation_id":"e605e30b-a35e-4755-b477-4def7886fac0","resolution":{"observed_at":"2026-08-09T14:02:39.491573Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.470939Z","title":"S., O'Brien, J., Cai, C","venue":null,"work_id":"54406154-7d1c-44f9-848c-5ba1c7e3c859","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.838426Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:27e68ed29ab36fab8ba0e7c991066b34294e11ccd7edae8a93159cd70f72a06d","observation_id":"8800b52c-2221-4ea7-9382-7e70755cef03","resolution":{"observed_at":"2026-08-09T14:02:39.475920Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-09T14:02:38.843272Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.843272Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:8f055c8a6f44cec3eaa2de0248d6a50da002708bae5ed91bb5ea74f789cb9bdc","observation_id":"6a9f2eb1-747e-4c56-b095-68e9a8541ede","resolution":{"observed_at":"2026-08-09T14:02:38.843272Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.454852Z","title":"Baitattack: Alleviating intention shift in jailbreak attacks via adaptive bait crafting","venue":null,"work_id":"6ee586de-a309-4940-baba-f3ec17aa0511","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.848658Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:1df62e0c318b65a99c61d2bc91b98283c054b7cdb0f795d7eef222903938eb45","observation_id":"8f6256a7-e521-4e52-9c58-7aa146b45b97","resolution":{"observed_at":"2026-08-09T14:02:39.459923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.438340Z","title":"and Barez, F","venue":null,"work_id":"75786d28-c340-4e13-b5c5-a72c684968a6","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.853805Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:b1b63b23070dede634eeb3a8f659593a1381548d64f64cc3b5c21aed4242f5d3","observation_id":"07ef3fc9-f027-4e17-9387-645ed9bd8f2a","resolution":{"observed_at":"2026-08-09T14:02:39.443220Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:38.858787Z","title":"Language models are unsupervised multitask learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.858787Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:ede14cdfb6e2280399f89f3b7ecc7af5d578afdf030195bee9bf1f00623508ea","observation_id":"19d42300-af06-4934-87e9-aa127ecc40df","resolution":{"observed_at":"2026-08-09T14:02:38.858787Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.411026Z","title":"Tricking LLMs into disobedience: Formalizing, analyzing, and detecting jailbreaks","venue":null,"work_id":"e0f60199-d8f5-43b7-aa18-be02f61e65fd","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.863659Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:73e8de0dccf898f6c6fb3744838cfce24e86e58d524cecb79c46b903c85fbebb","observation_id":"b3127a67-72f4-42e9-827e-fbd0049284eb","resolution":{"observed_at":"2026-08-09T14:02:39.416559Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-09T14:02:38.868276Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.868276Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:f04928de8469794390ab9e594526348f334e51e368fe764860805c96ba620611","observation_id":"662cfdae-b896-4968-9704-422ae6d95df7","resolution":{"observed_at":"2026-08-09T14:02:38.868276Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.394527Z","title":"P., and De Freitas, N","venue":null,"work_id":"ecdaa9d7-7514-4fc9-a4dc-5a11f8e0191c","year":2015},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.874036Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:ae81ee57bc73f2d31c0af81c4988726bf7e1b3786d66611a650e9b1623c605ff","observation_id":"ad5cd759-6940-416e-a69a-fe7683933d1c","resolution":{"observed_at":"2026-08-09T14:02:39.399652Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05530","last_updated":"2024-12-16T17:39:39Z","snapshot_observed_at":"2026-07-06T17:41:42.995949Z","submitted_at":"2024-03-08T18:54:20Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05530","snapshot_observed_at":"2026-08-09T14:02:38.879189Z","title":"I., Burnell, R., Bai, L., Gulati, A., Tanzer, G., Vincent, D., Pan, Z., Wang, S., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.879189Z"},"links":{"cited_paper":"/paper/2403.05530","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:b9255f50c93f6d01a3fb1915b280c337f17e42c21429dd6b823d1ab248b3495b","observation_id":"bc2101dc-cbca-443c-855f-1461c93cb6be","resolution":{"observed_at":"2026-08-09T14:02:38.879189Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.377649Z","title":"Qwen2.5: A party of foundation models, 2024","venue":null,"work_id":"d31931ed-e602-4e5f-b8e0-0ee69db74e14","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.884299Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:18c31ad828b3176cb5a09f6f42ccb58e9fee7d4096f5a54cf9c2ff9c06847934","observation_id":"2e9a0925-b676-46d4-a4dc-644c39dc8f0a","resolution":{"observed_at":"2026-08-09T14:02:39.382828Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-08-09T14:02:38.889082Z","title":"Llama: Open and efficient foundation language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.889082Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:8778e128bc766627b6e0816a48a4ce4c5828fa86e58c9183f2f65da95197a499","observation_id":"917cc9bb-3b75-4789-9ed4-6272e02ba0ae","resolution":{"observed_at":"2026-08-09T14:02:38.889082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.361270Z","title":"Bayesian optimization is superior to random search for machine learning hyperparameter tuning: Analysis of the black-box optimization challenge 2020","venue":null,"work_id":"84df78f6-0d13-43b5-b904-27bb90f6e21f","year":2020},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.894328Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:e9e97d80ab867b0a12b0f40456dace33f6899cbc514a9d50c08447622a706836","observation_id":"8a1cd8ae-a4d1-42e7-aa71-d651bffd4ff7","resolution":{"observed_at":"2026-08-09T14:02:39.366481Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.345909Z","title":"Attention is all you need","venue":null,"work_id":"ecf2cb3f-5b6d-44ee-b1bb-bf401bc5a258","year":2017},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.898986Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:457120fbb5590cd851b9b09aa503668346b662aad4a46a83a683f8ca4a38d37a","observation_id":"806772cf-42de-477b-9c5a-e628e8470ee2","resolution":{"observed_at":"2026-08-09T14:02:39.350820Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.330554Z","title":"Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems (NeurIPS), 2023 a","venue":null,"work_id":"430dd897-9937-4a5c-828d-0c4556ece3ad","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.903722Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:0d86fd95b192a9ed439e51716875a83a99b9a737a1bed4b2ebe876630cf1cf29","observation_id":"ab6a9ead-82e5-4605-8df1-46eb9577f14c","resolution":{"observed_at":"2026-08-09T14:02:39.335411Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-13T07:21:48.498707Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-09T14:02:38.908552Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.908552Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:5787c5ed93d66ce71366b47b35e8a5c162824d0d5faf6c33b13adb8393430757","observation_id":"a928bc4c-1dd2-43bd-862a-186b3966b4c8","resolution":{"observed_at":"2026-08-09T14:02:38.908552Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.314170Z","title":"Never miss a beat: An efficient recipe for context window extension of large language models with consistent ``middle'' enhancement","venue":null,"work_id":"db04025d-5ab2-4b7a-b9e1-1893cec6818a","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.913719Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:8de37514a07147331b303d683f6608e103951639726ae6d83cca3ee7f0a20893","observation_id":"b7cbf08a-857b-48a3-99eb-54fc721163eb","resolution":{"observed_at":"2026-08-09T14:02:39.319450Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.297117Z","title":"Distract large language models for automatic jailbreak attack","venue":null,"work_id":"a0362065-b002-462f-9c1e-83f36420c51e","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.918497Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:8e4abc250294a57077cac50a99b6403c93556730ff62e76b1bdd01d5bf7717ee","observation_id":"6a37ad53-bd30-4d3e-a0c9-25f8077beb81","resolution":{"observed_at":"2026-08-09T14:02:39.302514Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.281099Z","title":"Defending chat GPT against jailbreak attack via self-reminders","venue":null,"work_id":"79afd101-82ac-4a5d-9b3f-37ca6ac483d1","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.923177Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:f3013f6f7d58683d0304fa38898b6979516201629e17afa894f8dfa5a7f614d1","observation_id":"1ad21543-645e-4493-b87e-507f7de8f4bd","resolution":{"observed_at":"2026-08-09T14:02:39.286459Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.10671","last_updated":"2024-09-10T13:25:53Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-07-15T12:35:42Z","title":"Qwen2 Technical Report","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.10671","snapshot_observed_at":"2026-08-09T14:02:38.927696Z","title":"Qwen2 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.927696Z"},"links":{"cited_paper":"/paper/2407.10671","citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:261df364fd4a0737bd86b11698ec02fa98840ed0d8de8301b6531c707b1fc98e","observation_id":"0a69fe84-05bd-47b1-b7c5-53d4f54bf1bd","resolution":{"observed_at":"2026-08-09T14:02:38.927696Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.265152Z","title":"Tell your model where to attend: Post-hoc attention steering for LLMs","venue":null,"work_id":"c239a7e1-e568-4b32-a7c3-8580ad2d7d0b","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.932874Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:be1f994671e562669ead6f2cba0e4a931ac2c3cc54e89d783a692421e6eba209","observation_id":"eec647d9-6744-45df-bee5-89ac7b834d2a","resolution":{"observed_at":"2026-08-09T14:02:39.270411Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.248253Z","title":"In-context principle learning from mistakes","venue":null,"work_id":"491d48a5-514b-4dd9-ba39-5bf172d854ce","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.937270Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:85d35c1825a912ea904d7aab8cd5e12ca45b5289096d3b28c552e97889c95eb5","observation_id":"cdb0e819-a258-48f8-b051-968249140517","resolution":{"observed_at":"2026-08-09T14:02:39.253913Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.230133Z","title":"What makes good examples for visual in-context learning? In Advances in Neural Information Processing Systems (NeurIPS), 2023","venue":null,"work_id":"4ef35982-b747-43d1-af72-7f113bb6e3bd","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.941925Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:04eae1f7f0b6bdb62ffe07febe80a13646ba4ee868b7c36f9a664f5306c37bae","observation_id":"3158314c-1474-4972-8274-163ca8dc1a5a","resolution":{"observed_at":"2026-08-09T14:02:39.235536Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.213193Z","title":"Calibrate before use: Improving few-shot performance of language models","venue":null,"work_id":"24bb16fb-f90d-4da6-87fd-006c849f110d","year":2021},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.946524Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:bc302e55fe15a82747ebb81724cbbcb02579a69ec77dc1cdd86ea5a58b8c610b","observation_id":"0bddeb3a-23f4-4153-b5ee-d7a272365c80","resolution":{"observed_at":"2026-08-09T14:02:39.218387Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.196256Z","title":"Improved few-shot jailbreaking can circumvent aligned language models and their defenses","venue":null,"work_id":"dba666ba-05b8-47ac-b025-2a41038d4350","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.951304Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:b07a6d8864ba0ab08568a25971a0d34272887fbac067a5963fc576d348c4ecac","observation_id":"7a23758f-509b-465d-b6d1-76b017de50a5","resolution":{"observed_at":"2026-08-09T14:02:39.202097Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.179723Z","title":"P., Di Eugenio, B., and Zhang, Y","venue":null,"work_id":"69a74327-76d5-4662-9514-aa647e7d84dc","year":2024},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.955740Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:9fec0442325834f72a777981f51dea7a7e353e3ef0ac59b99a3a215027c723fa","observation_id":"8e68e883-4acb-444c-84d2-412a40e8c2b5","resolution":{"observed_at":"2026-08-09T14:02:39.184896Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:02:39.161753Z","title":"Z., and Fredrikson, M","venue":null,"work_id":"f8b7e457-5577-4bdd-8359-107416f77f30","year":2023},"citing_paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","version":2},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-09T14:02:38.960422Z"},"links":{"citing_paper":"/paper/2502.01925"},"observation_digest":"sha256:f6663e99837bbcded40bd44b4b65254119cb283ff6c0d12af7d3ee18e126843e","observation_id":"7078b9d0-2b3a-4673-864d-786cbfc30fb2","resolution":{"observed_at":"2026-08-09T14:02:39.168206Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2502.01925","last_updated":"2025-06-12T19:46:44Z","latest_version":2,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-13T07:22:41.819178Z","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling"},"reference_resolution":{"displayed":58,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":14,"verified_exact":0,"verified_fuzzy":44},"total_outbound_references":58},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 58 of 58 outbound references and 2 inbound Pith citation observations for arXiv:2502.01925."}