{"as_of":"2026-08-10T00:55:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:b0de3ce8889ffbb20a9c055090caa9e4bfce59160daed5e6256cb99fc1786410","coverage":[{"denominator":92,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":92,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-09T14:47:15.448064Z","state":"measured"},{"denominator":100,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":100,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":8,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":8,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T04:37:06.683217Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-18T10:46:17.055047Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-07T04:37:06.683217Z","title":"Zora Che, Stephen Casper, Robert Kirk, Anirudh Satheesh, Stewart Slocum, Lev E","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.10236","last_updated":"2025-08-14T05:03:53Z","snapshot_observed_at":"2026-08-08T09:47:01.651509Z","submitted_at":"2025-06-11T23:36:30Z","title":"Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods","version":2},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-07T04:37:06.683217Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2506.10236"},"observation_digest":"sha256:cc695d8c6f4f4ed0289dceca354ae0d12fb6dc4bb4971ebb98ee9b086bd9d9f8","observation_id":"9ac562e3-c5b1-46c0-8e04-7102890168a9","resolution":{"observed_at":"2026-08-07T04:37:06.683217Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-04T23:10:21.212266Z","title":"Model tampering attacks enable more rigorous evaluations of llm capabilities,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.06795","last_updated":"2025-09-08T15:24:33Z","snapshot_observed_at":"2026-08-06T11:18:33.345942Z","submitted_at":"2025-09-08T15:24:33Z","title":"Anchoring Refusal Direction: Mitigating Safety Risks in Tuning via Projection Constraint","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-04T23:10:21.212266Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2509.06795"},"observation_digest":"sha256:ad66be2da3fb0394a644646d61c4bc3d8b7f6750b400e35692704e94dc608a26","observation_id":"5b691c14-d0ac-4408-84b3-1a983d3c9287","resolution":{"observed_at":"2026-08-04T23:10:21.212266Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":"2502.05209","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model tampering attacks enable more rigorous evaluations of llm capabilities","venue":null,"work_id":"77e8b969-5539-43b7-8791-064456162179","year":2025},"citing_paper":{"arxiv_id":"2510.00761","last_updated":"2026-04-18T07:30:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-10-01T10:50:14Z","title":"Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearning","version":5},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-18T10:44:53.516653Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2510.00761"},"observation_digest":"sha256:828d7b955191f53050af7e660a6f08417f8ef67eca94210d2232d3310b58bdd3","observation_id":"0abc5024-ef5d-4655-95da-9c9b68ade291","resolution":{"observed_at":"2026-05-18T10:46:17.058220Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-03T18:41:33.209039Z","title":"Model tampering attacks enable more rigorous evaluations of llm capabilities.arXiv preprint arXiv:2502.05209, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2512.04144","last_updated":"2026-07-14T05:13:06Z","snapshot_observed_at":"2026-08-08T13:08:29.843209Z","submitted_at":"2025-12-03T18:57:59Z","title":"RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-03T18:41:33.209039Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2512.04144"},"observation_digest":"sha256:3f24e7d78755c610dc91757a620a475a564794a2dd7f9d485b198917a4cd7a4e","observation_id":"9195ab00-e824-41a4-9ef9-dd9eb8448c61","resolution":{"observed_at":"2026-08-03T18:41:33.209039Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-03T19:59:01.358929Z","title":"E., Gandikota, R., Ewart, A., Rosati, D., Wu, Z., et al","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2512.11815","last_updated":"2026-05-23T23:07:49Z","snapshot_observed_at":"2026-08-03T19:58:58.153442Z","submitted_at":"2025-11-26T18:59:43Z","title":"Video Deepfake Abuse: How Company Choices Predictably Shape Misuse Patterns","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-03T19:59:01.358929Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2512.11815"},"observation_digest":"sha256:a61e719205681241e7c35792c16e855f1b801894f1f81a466a5e474c048d9873","observation_id":"5ba3b8fb-a6c3-43a7-8dbe-1d7aa8abb55a","resolution":{"observed_at":"2026-08-03T19:59:01.358929Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-02T22:49:13.999922Z","title":"Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2602.15829","last_updated":"2026-06-08T15:32:04Z","snapshot_observed_at":"2026-08-08T10:24:00.819062Z","submitted_at":"2026-02-17T18:59:39Z","title":"Operationalising the Superficial Alignment Hypothesis via Task Complexity","version":2},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-02T22:49:13.999922Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2602.15829"},"observation_digest":"sha256:66445fc81131fc283451d7d77c18795772b61e14a526195e0a22ab8022af8c74","observation_id":"735466bb-16e9-47f0-ad25-d74394d5c890","resolution":{"observed_at":"2026-08-02T22:49:13.999922Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":"2502.05209","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model tampering attacks enable more rigorous evaluations of llm capabilities","venue":null,"work_id":"77e8b969-5539-43b7-8791-064456162179","year":2025},"citing_paper":{"arxiv_id":"2604.03121","last_updated":"2026-04-03T15:45:35Z","snapshot_observed_at":"2026-07-06T22:52:20.577677Z","submitted_at":"2026-04-03T15:45:35Z","title":"An Independent Safety Evaluation of Kimi K2.5","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-05-13T19:38:18.674355Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2604.03121"},"observation_digest":"sha256:ff24a41d7fb9c316a1a6cd003ef1b70c46af832bb75eeef16489ed8f4dc0072c","observation_id":"9f63ce60-b49b-432b-94be-3091cd96bea2","resolution":{"observed_at":"2026-05-13T19:43:11.577719Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":"2502.05209","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model tampering attacks enable more rigorous evaluations of llm capabilities","venue":null,"work_id":"77e8b969-5539-43b7-8791-064456162179","year":2025},"citing_paper":{"arxiv_id":"2604.07962","last_updated":"2026-04-09T08:24:52Z","snapshot_observed_at":"2026-07-06T22:57:09.435331Z","submitted_at":"2026-04-09T08:24:52Z","title":"Is your algorithm unlearning or untraining?","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T18:06:08.962042Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2604.07962"},"observation_digest":"sha256:4385bb72e0eddc9821e66675642c6196dc3e8f5bff8d4610be22a8ed7ccb1482","observation_id":"ec539424-962b-4ec3-b385-e3a4912b5b1d","resolution":{"observed_at":"2026-05-11T05:30:59.104808Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2502.05209/citation-record","integrity":"/paper/2502.05209/integrity","json":"/paper/2502.05209/citation-record.json","paper":"/paper/2502.05209"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:14.990982Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:14.990982Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:a1322d737dfa7072b194e2603cdf269c12a7c1fcf51147503b22b4150f8a79a4","observation_id":"bf1f4201-9b52-47eb-a0b6-d553ec611530","resolution":{"observed_at":"2026-08-09T14:47:14.990982Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:14.997251Z","title":"T., O'Brien, J., Soder, L., Bucknall, B., Bluemke, E., Schuett, J., Trager, R., Strahm, L., and Chowdhury, R","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:14.997251Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:75aa4e34a2232bd980c34491769b6579fe39aa3927e89c73cbe135c61197b435","observation_id":"183e7ffa-d049-4cfb-b8cf-0c3e179c6892","resolution":{"observed_at":"2026-08-09T14:47:14.997251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-08T01:18:53.200448Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-09T14:47:15.002017Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.002017Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:ecb7cbc216f712132821b066747b5e8c8d32742089de99ae51a40f7c24788538","observation_id":"73b1af65-f276-4185-8a02-8c85bf245625","resolution":{"observed_at":"2026-08-09T14:47:15.002017Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.007519Z","title":"Many-shot jailbreaking","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.007519Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:5e947eace493200792d596a62c1a6553ab165d69599a5ce7d9c16832d164705a","observation_id":"30f4dc67-561b-4b2f-a9fa-dbd1744c6fb6","resolution":{"observed_at":"2026-08-09T14:47:15.007519Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.012554Z","title":"Unlearning in large language models via activation projections, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.012554Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:266a034b40deae7436ffb120dd8b80c5081716540c063ab2be10aa61ff466378","observation_id":"c3e72b8b-62a8-481d-8271-b19d296bebaa","resolution":{"observed_at":"2026-08-09T14:47:15.012554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.11717","last_updated":"2024-10-30T18:57:07Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-17T16:36:12Z","title":"Refusal in Language Models Is Mediated by a Single Direction","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.11717","snapshot_observed_at":"2026-08-09T14:47:15.017432Z","title":"Refusal in language models is mediated by a single direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.017432Z"},"links":{"cited_paper":"/paper/2406.11717","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:e5b2d49773be8e4a3df639b9bd53c34dbd3df486bcaec9ca920deb244ef7cca9","observation_id":"b60765c1-c7ba-4511-b905-6f60d5639e29","resolution":{"observed_at":"2026-08-09T14:47:15.017432Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14762","last_updated":"2024-11-05T16:40:21Z","snapshot_observed_at":"2026-07-06T17:34:07.737296Z","submitted_at":"2024-02-22T18:21:59Z","title":"MT-Bench-101: A Fine-Grained Benchmark for Evaluating Large Language Models in Multi-Turn Dialogues","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14762","snapshot_observed_at":"2026-08-09T14:47:15.023992Z","title":"Mt-bench-101: A fine-grained benchmark for evaluating large language models in multi-turn dialogues","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.023992Z"},"links":{"cited_paper":"/paper/2402.14762","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:8c9e92c735c4eca5843395afec937a0475f05dcb5cafa9a72e53a3473480a398","observation_id":"633bc806-8686-4c0c-bb0e-16e5805b4fdd","resolution":{"observed_at":"2026-08-09T14:47:15.023992Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.04952","last_updated":"2025-01-09T03:59:10Z","snapshot_observed_at":"2026-08-08T00:46:37.661782Z","submitted_at":"2025-01-09T03:59:10Z","title":"Open Problems in Machine Unlearning for AI Safety","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.04952","snapshot_observed_at":"2026-08-09T14:47:15.029821Z","title":"Open problems in machine unlearning for ai safety","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.029821Z"},"links":{"cited_paper":"/paper/2501.04952","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:85efd51fd0f1129a6c7afd29a892b625e66b994e92b21b5ead78d255a7bd2cf5","observation_id":"c9d4dc73-3dd6-4f1b-be7c-ac44238e7d1c","resolution":{"observed_at":"2026-08-09T14:47:15.029821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.14303","last_updated":"2023-11-13T05:28:47Z","snapshot_observed_at":"2026-08-09T09:58:03.453672Z","submitted_at":"2023-10-22T13:55:46Z","title":"Language Model Unalignment: Parametric Red-Teaming to Expose Hidden Harms and Biases","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.14303","snapshot_observed_at":"2026-08-09T14:47:15.034861Z","title":"and Poria, S","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.034861Z"},"links":{"cited_paper":"/paper/2310.14303","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f0caaddf2cab56010fc396ed868e8b47ee8ad689bd7e056a16820b21a4dd32cf","observation_id":"f6fcfcd8-651e-4314-9848-00fa399ccd0d","resolution":{"observed_at":"2026-08-09T14:47:15.034861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.040084Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.040084Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:239a73b81ea730de8234bd01a4ef3acac3439f2301ed328225cc918be247e1dc","observation_id":"e4f9795a-a64c-442d-95fd-3ba18fbca45d","resolution":{"observed_at":"2026-08-09T14:47:15.040084Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.044779Z","title":"AI and Data Act: Part of Bill C-27, Digital Charter Implementation Act, 2022 , 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.044779Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:8465ab7d748a4901b25dd47c334f1985f3746821c9a105596d80e0fa2ddaf1ac","observation_id":"a305ddd1-337a-4a51-a1d5-5426e98c3f80","resolution":{"observed_at":"2026-08-09T14:47:15.044779Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.049489Z","title":"A., Jagielski, M., Gao, I., Koh, P","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.049489Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:b676484b53159dc9be3eeb402073e17b3f44bcc924558dc9de79196d2680ecc4","observation_id":"9e2320bc-7954-45f0-8146-5a6b68311de4","resolution":{"observed_at":"2026-08-09T14:47:15.049489Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05030","last_updated":"2025-07-29T09:44:14Z","snapshot_observed_at":"2026-08-07T17:43:00.958834Z","submitted_at":"2024-03-08T04:22:48Z","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05030","snapshot_observed_at":"2026-08-09T14:47:15.054255Z","title":"Defending against unforeseen failure modes with latent adversarial training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.054255Z"},"links":{"cited_paper":"/paper/2403.05030","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:b9abf0a786013136579f87ea6f35406a43fb8ae77662df4c59b5b0818d6622bf","observation_id":"375996cf-fb2f-4c96-8acc-b63e4b626094","resolution":{"observed_at":"2026-08-09T14:47:15.054255Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-09T14:47:15.059261Z","title":"J., and Wong, E","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.059261Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:821a8c18e534b9e1d7355f386f6e14252cfc498e110c31fb6e8b94c370ff6e59","observation_id":"9b042a6f-9ed9-45de-ada7-14c98f4f361c","resolution":{"observed_at":"2026-08-09T14:47:15.059261Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.064636Z","title":"Interim Measures for the Management of Generative Artificial Intelligence Services , 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.064636Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:9ca3990f59d0715886d5aef1e35afd442ef8083cdb0962380713e738ca0376ba","observation_id":"b5b04b81-e9bb-4b32-bb5f-815e9bd6bf24","resolution":{"observed_at":"2026-08-09T14:47:15.064636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.069152Z","title":"G., Islam, M","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.069152Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:c886500eb6d04a04d6818425206974024c1a38879fdad3efc762d0c66cfe05a5","observation_id":"037a7571-e26d-4a03-8e60-13c6c5568b60","resolution":{"observed_at":"2026-08-09T14:47:15.069152Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.073705Z","title":"O., and Nilsson, F","venue":null,"work_id":null,"year":2006},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.073705Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:36006440633454460be07842e59c62bed74c32b8c0172f363a36d72d98629230","observation_id":"9fd04bde-0107-41eb-b320-f5373135624a","resolution":{"observed_at":"2026-08-09T14:47:15.073705Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.08827","last_updated":"2025-02-07T16:27:48Z","snapshot_observed_at":"2026-08-09T08:01:54.091525Z","submitted_at":"2024-10-11T14:06:58Z","title":"Do Unlearning Methods Remove Information from Language Model Weights?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.08827","snapshot_observed_at":"2026-08-09T14:47:15.078108Z","title":"and Roger, F","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.078108Z"},"links":{"cited_paper":"/paper/2410.08827","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:27dc493d5fd737802d6209e5536ca035d654aac3e21c705a6db6aa0f9f1fc094","observation_id":"7f515d96-f150-4a66-87a0-e43671afe57a","resolution":{"observed_at":"2026-08-09T14:47:15.078108Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-07-06T18:55:11.576666Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-09T14:47:15.082764Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.082764Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:97852e28cc01fb30e378020d8d1b1a3d0cd48f889554672c84a1e3df0599f816","observation_id":"e625dda2-cebb-471c-a6ef-c43baa3c9637","resolution":{"observed_at":"2026-08-09T14:47:15.082764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.087548Z","title":"The eu artificial intelligence act","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.087548Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f7bd6c812d54a24905706b42c60bd94b8d735760af21035e501b6da1bac1277d","observation_id":"fafdf18d-29b6-43e4-b8a6-8cf8436227fa","resolution":{"observed_at":"2026-08-09T14:47:15.087548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.02780","last_updated":"2023-12-05T14:12:15Z","snapshot_observed_at":"2026-08-02T20:11:51.008725Z","submitted_at":"2023-12-05T14:12:15Z","title":"Scaling Laws for Adversarial Attacks on Language Model Activations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.02780","snapshot_observed_at":"2026-08-09T14:47:15.092289Z","title":"Scaling laws for adversarial attacks on language model activations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.092289Z"},"links":{"cited_paper":"/paper/2312.02780","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:a1fdbb2ffeb9f7fff6c38d89f970c138e8078e2f09ab86b9d6393ca8f3e7dd31","observation_id":"feea78e1-b98f-41dc-94a2-5ebc51bc4061","resolution":{"observed_at":"2026-08-09T14:47:15.092289Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.097049Z","title":"Towards a science of ai evaluations","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.097049Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:0338d834dace1ca7851c6630bd064ff40b8819dd3383c01de8944904bb96ca0c","observation_id":"5b9d2a9f-2592-4aa0-9ac8-804cadcd21c5","resolution":{"observed_at":"2026-08-09T14:47:15.097049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02760","last_updated":"2025-07-21T21:03:45Z","snapshot_observed_at":"2026-08-10T00:16:23.865631Z","submitted_at":"2024-10-03T17:59:30Z","title":"Erasing Conceptual Knowledge from Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02760","snapshot_observed_at":"2026-08-09T14:47:15.101899Z","title":"Erasing conceptual knowledge from language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.101899Z"},"links":{"cited_paper":"/paper/2410.02760","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:fa62716d8a2cb66b2b299e117340c6a1e22ecb52466c6e2a55ef8948aeee5fdb","observation_id":"db1812b8-3cba-45e1-ab28-f5d46d864bf3","resolution":{"observed_at":"2026-08-09T14:47:15.101899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.19550","last_updated":"2024-05-29T22:26:26Z","snapshot_observed_at":"2026-07-06T18:22:18.644161Z","submitted_at":"2024-05-29T22:26:26Z","title":"Stress-Testing Capability Elicitation With Password-Locked Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.19550","snapshot_observed_at":"2026-08-09T14:47:15.106879Z","title":"Stress-testing capability elicitation with password-locked models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.106879Z"},"links":{"cited_paper":"/paper/2405.19550","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:26c48596a6dae92a3b09ac81d4e01dbc45a6b66de01e2d9fcf381db406d46981","observation_id":"ef386264-db9e-4fb4-bfb3-572786246e45","resolution":{"observed_at":"2026-08-09T14:47:15.106879Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.111767Z","title":"Cascade: Exploring hierarchical inference in language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.111767Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:98fa2d5997933c8c6dca1aefeecd662f654f171f440168302b0594b23619a2e7","observation_id":"ced76700-4f74-427c-98f4-f4fd392bcd53","resolution":{"observed_at":"2026-08-09T14:47:15.111767Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.941668Z","title":"T., Haghtalab, N., and Steinhardt, J","venue":null,"work_id":"4ed13275-0984-410e-8005-898193748cba","year":null},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.116500Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:90632b45f03aa22b72854dff77f585d97e0e3e478ef9dae24d85b4c442a37f43","observation_id":"122f75cd-0c4e-4a4f-b5d9-096bb7b5eeee","resolution":{"observed_at":"2026-08-09T14:47:35.947064Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2009.03300","last_updated":"2021-01-12T18:57:11Z","snapshot_observed_at":"2026-08-09T10:28:06.906299Z","submitted_at":"2020-09-07T17:59:25Z","title":"Measuring Massive Multitask Language Understanding","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.03300","snapshot_observed_at":"2026-08-09T14:47:15.121434Z","title":"Measuring massive multitask language understanding","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.121434Z"},"links":{"cited_paper":"/paper/2009.03300","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:b5db97fd2dfd0251403ba83099edd3a80e43db14e3fc322ec965150eff07f837","observation_id":"859381dd-9d09-4cc8-ab4a-ecce32ab1439","resolution":{"observed_at":"2026-08-09T14:47:15.121434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.923718Z","title":null,"venue":null,"work_id":"4c22da82-e409-4577-80d0-b64c2af9a149","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.125861Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:fd0104ad57b3ed39fd27cae4d8c64923a561fcad039cf3aa102e60a3a27b1f1d","observation_id":"a1b4633c-ab77-48bb-be91-52cd0af80adc","resolution":{"observed_at":"2026-08-09T14:47:35.928848Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-07T07:43:16.294957Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-09T14:47:15.130612Z","title":"J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.130612Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:c9c778379a48289f6aad3c7059d6f4ee9ddbb619708ec6175e5ef612826ee98b","observation_id":"ac493279-4922-49e3-a797-b466f436aed1","resolution":{"observed_at":"2026-08-09T14:47:15.130612Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13356","last_updated":"2025-03-17T07:46:49Z","snapshot_observed_at":"2026-08-01T17:13:21.519528Z","submitted_at":"2024-06-19T09:03:21Z","title":"Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13356","snapshot_observed_at":"2026-08-09T14:47:15.135860Z","title":"S., and Smith, V","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.135860Z"},"links":{"cited_paper":"/paper/2406.13356","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:54e6ff6cf3fa47144ea5d5e36c8dd16060de5865dab02d824f71848470c82323","observation_id":"c267204e-d9f5-4a06-a2ef-70836602af39","resolution":{"observed_at":"2026-08-09T14:47:15.135860Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.18169","last_updated":"2026-04-23T18:48:49Z","snapshot_observed_at":"2026-07-06T19:22:58.341345Z","submitted_at":"2024-09-26T17:55:22Z","title":"Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.18169","snapshot_observed_at":"2026-08-09T14:47:15.141334Z","title":"F., and Liu, L","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.141334Z"},"links":{"cited_paper":"/paper/2409.18169","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:9c2c920099b97e645573b518dc29226221e307881200bd0f62c22ab79518e934","observation_id":"8dd47542-8160-46b8-a070-04a1f37247bd","resolution":{"observed_at":"2026-08-09T14:47:15.141334Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.12786","last_updated":"2024-08-21T16:37:20Z","snapshot_observed_at":"2026-07-06T16:50:42.754354Z","submitted_at":"2023-11-21T18:51:04Z","title":"Mechanistically analyzing the effects of fine-tuning on procedurally defined tasks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.12786","snapshot_observed_at":"2026-08-09T14:47:15.146775Z","title":"S., Dick, R","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.146775Z"},"links":{"cited_paper":"/paper/2311.12786","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:34ab65a453b397093942a138eaf68c5c580369a8e67d89ca77ef67c3131d266a","observation_id":"3bad5977-5ee9-49b1-a799-7ab9661c9872","resolution":{"observed_at":"2026-08-09T14:47:15.146775Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.905637Z","title":"Language models resist alignment, 2024","venue":null,"work_id":"ecdf26c6-e27f-4ea2-be08-137b4b73a2f7","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.151928Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f0b320a1b0a0471483d61bef0134146d240179ce7123c2e3a5c5cd74a3f1f74b","observation_id":"853c3ab5-e289-40be-89ea-4a61d4329711","resolution":{"observed_at":"2026-08-09T14:47:35.911752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.157036Z","title":"Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.157036Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:9b351a5b9da098a25613067b896d79b65052c17894a4f3fab2b8a917ccaf423a","observation_id":"beaf5ec8-3b43-4564-b970-5b3fa8a64530","resolution":{"observed_at":"2026-08-09T14:47:15.157036Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.889528Z","title":"Act on the protection of personal information, 2025","venue":null,"work_id":"db5c1851-e6b5-4d79-8000-df029e7802f8","year":2025},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.161963Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:7d0dd3449d8d8ed5695a48ec8e537e09dfaed8a0ec7d0125e22439a87260f8e6","observation_id":"7c6eb7ce-c036-404c-b7b8-55c92326ee63","resolution":{"observed_at":"2026-08-09T14:47:35.894782Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.16229","last_updated":"2024-05-25T13:38:40Z","snapshot_observed_at":"2026-07-06T18:19:52.121906Z","submitted_at":"2024-05-25T13:38:40Z","title":"No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.16229","snapshot_observed_at":"2026-08-09T14:47:15.166472Z","title":"T., Cheng, Y., Xu, K., Wang, J., Wang, H., and Li, W","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.166472Z"},"links":{"cited_paper":"/paper/2405.16229","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:c7aa3237f96cad5f12520fbe4b3747233f07eb577613dde48f52c286185ccc3c","observation_id":"8bb16e20-1d1b-44ef-82f2-e26f100e351b","resolution":{"observed_at":"2026-08-09T14:47:15.166472Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20624","last_updated":"2024-05-22T08:39:46Z","snapshot_observed_at":"2026-08-02T03:56:52.247351Z","submitted_at":"2023-10-31T16:55:06Z","title":"LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20624","snapshot_observed_at":"2026-08-09T14:47:15.171392Z","title":"Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.171392Z"},"links":{"cited_paper":"/paper/2310.20624","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:7a80ad9e66e8478081f6e13c1d14cbc3a252c68cd9f20e1858a9af0fcb50990c","observation_id":"43acf8e1-359d-47e2-b21a-ca64edf4fd8d","resolution":{"observed_at":"2026-08-09T14:47:15.171392Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-09T22:39:47.545972Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-09T14:47:15.176057Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.176057Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:32d5843dd4021c86c3e77a06363dd9b4525ff58c0367c721c8f230e773558d3f","observation_id":"e85b16c9-7c66-4b34-93ef-ddfa98ce1114","resolution":{"observed_at":"2026-08-09T14:47:15.176057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03218","last_updated":"2024-05-15T19:16:09Z","snapshot_observed_at":"2026-08-09T09:20:14.433688Z","submitted_at":"2024-03-05T18:59:35Z","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","version":7},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03218","snapshot_observed_at":"2026-08-09T14:47:15.181547Z","title":"D., Dombrowski, A.-K., Goel, S., Phan, L., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.181547Z"},"links":{"cited_paper":"/paper/2403.03218","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:bc0d1e709d408873d0a6ab8fb1e994d59e125f3115c229dba9a6c75e08474adb","observation_id":"c6c86131-280a-44a2-b768-ca80477cde25","resolution":{"observed_at":"2026-08-09T14:47:15.181547Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.00629","last_updated":"2024-11-26T11:59:17Z","snapshot_observed_at":"2026-08-04T00:35:46.251606Z","submitted_at":"2024-03-31T09:50:39Z","title":"Against The Achilles' Heel: A Survey on Red Teaming for Generative Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.00629","snapshot_observed_at":"2026-08-09T14:47:15.186818Z","title":"Against the achilles' heel: A survey on red teaming for generative models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.186818Z"},"links":{"cited_paper":"/paper/2404.00629","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:6966b5840eed0ed1a28681896fce7c1043c27b77cdec3feac744dfabf016ea39","observation_id":"7569bbfc-337a-4e57-827e-c21e17128f0b","resolution":{"observed_at":"2026-08-09T14:47:15.186818Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.873634Z","title":"Continual learning and private unlearning","venue":null,"work_id":"cd6c9962-cfb3-4760-8dc5-d0e15fcd239a","year":2022},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.191766Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:61923adb732c1084b63b9b66b17e64ccfedec80f9f32d15cd3b33c7976c7f6cd","observation_id":"c0c5d3e0-6632-47ea-a285-1a98c0d9d47c","resolution":{"observed_at":"2026-08-09T14:47:35.878763Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08787","last_updated":"2024-12-06T21:39:49Z","snapshot_observed_at":"2026-08-09T11:53:57.275236Z","submitted_at":"2024-02-13T20:51:58Z","title":"Rethinking Machine Unlearning for Large Language Models","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08787","snapshot_observed_at":"2026-08-09T14:47:15.196404Z","title":"R., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.196404Z"},"links":{"cited_paper":"/paper/2402.08787","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:feee2036d4884821a5f76a511ec4d2ae608f964dba6cdfbb1efcb610d88ab6fd","observation_id":"9a67d7ca-f77f-4652-8175-fc201462abfa","resolution":{"observed_at":"2026-08-09T14:47:15.196404Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.13682","last_updated":"2025-02-17T05:57:26Z","snapshot_observed_at":"2026-08-09T10:10:40.451488Z","submitted_at":"2024-03-20T15:40:18Z","title":"Threats, Attacks, and Defenses in Machine Unlearning: A Survey","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.13682","snapshot_observed_at":"2026-08-09T14:47:15.201431Z","title":"Threats, attacks, and defenses in machine unlearning: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.201431Z"},"links":{"cited_paper":"/paper/2403.13682","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:cd8b1c0c171e4cc78162857b1886b943e295077b3a3461862c30722e1be5ae33","observation_id":"153ff993-0b35-4b9e-a6a0-c6be10f7c39e","resolution":{"observed_at":"2026-08-09T14:47:15.201431Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.01814","last_updated":"2024-01-03T16:15:57Z","snapshot_observed_at":"2026-07-06T17:11:17.528395Z","submitted_at":"2024-01-03T16:15:57Z","title":"Large Language Models Relearn Removed Concepts","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.01814","snapshot_observed_at":"2026-08-09T14:47:15.206547Z","title":"B., and Barez, F","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.206547Z"},"links":{"cited_paper":"/paper/2401.01814","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:a1000d0cc192326aa8eae20651183a9405374565a850b656425084f28f99d9d3","observation_id":"dfa340c9-2760-493a-9f3e-6fed376a1db0","resolution":{"observed_at":"2026-08-09T14:47:15.206547Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.857020Z","title":"and Rimsky, N","venue":null,"work_id":"a6647b14-5e20-45cd-8789-17ec6dfa597d","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.211427Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:887f1336d68c2809b3ea0110554e3fd57798a63593f5c5411d192875f1072381","observation_id":"b1a68a4a-4299-4fca-ba6e-6f07c0521583","resolution":{"observed_at":"2026-08-09T14:47:35.862145Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.18025","last_updated":"2025-05-31T19:22:41Z","snapshot_observed_at":"2026-07-06T19:22:54.212921Z","submitted_at":"2024-09-26T16:32:19Z","title":"An Adversarial Perspective on Machine Unlearning for AI Safety","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.18025","snapshot_observed_at":"2026-08-09T14:47:15.215964Z","title":"An adversarial perspective on machine unlearning for ai safety","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.215964Z"},"links":{"cited_paper":"/paper/2409.18025","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:4b4fbcbc9bfb2a37259b508855ee75342d56d495d6fc493f032314b57c243f52","observation_id":"52289a63-379a-44f5-b904-0db3406e363f","resolution":{"observed_at":"2026-08-09T14:47:15.215964Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16835","last_updated":"2024-02-26T18:57:37Z","snapshot_observed_at":"2026-08-08T00:43:51.702314Z","submitted_at":"2024-02-26T18:57:37Z","title":"Eight Methods to Evaluate Robust Unlearning in LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16835","snapshot_observed_at":"2026-08-09T14:47:15.221048Z","title":"Eight methods to evaluate robust unlearning in llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.221048Z"},"links":{"cited_paper":"/paper/2402.16835","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:044b2571d99470fb28e590a5638585452deae96d0f38a55c3093f65ae66118da","observation_id":"c24c5f8c-9705-45b0-b204-b9a06d97a898","resolution":{"observed_at":"2026-08-09T14:47:15.221048Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:15.225782Z","title":"Pointer sentinel mixture models, 2016","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.225782Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:825ec3208c69f2eeb66b26cb0cdea39bd61b251abcde30bc7f6120afbdac4d58","observation_id":"4ce66b5b-93f5-4eb5-883c-4f0784adca3a","resolution":{"observed_at":"2026-08-09T14:47:15.225782Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.828461Z","title":null,"venue":null,"work_id":"f408aae9-2741-45b0-a079-405d9d6b5944","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.230458Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:ee62c717a9f7c75ea883d26e3210c8dd0f99a07c37b8f0827bf5e9c1de9d4280","observation_id":"8a9b5cb3-561d-4abb-83f5-92739136e69a","resolution":{"observed_at":"2026-08-09T14:47:35.833753Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.811613Z","title":"AI Risk Management Framework : AI RMF (1.0), January 2023","venue":null,"work_id":"414518bd-475b-412c-9c15-b8c80f5d6aa6","year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.234922Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:1c935501ce0c0aa7a2ef4aa47e4c17a7b87524c1fb2a67f3e4353c06d4c48728","observation_id":"f24989a3-4478-4e69-aef5-a8658535b9d4","resolution":{"observed_at":"2026-08-09T14:47:35.817088Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.794249Z","title":"Openai system card: December 2024, 2024","venue":null,"work_id":"9b522d74-3229-48ad-9066-de01d65354ac","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.239688Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:a3669445e7701022503e8180c8962fa7c50dc2e24c8296a59ab49d50f41c247f","observation_id":"94250e00-55ce-41fe-82d0-0e93f89049fe","resolution":{"observed_at":"2026-08-09T14:47:35.799205Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.17410","last_updated":"2023-09-29T17:12:43Z","snapshot_observed_at":"2026-07-06T16:25:38.571377Z","submitted_at":"2023-09-29T17:12:43Z","title":"Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.17410","snapshot_observed_at":"2026-08-09T14:47:15.244674Z","title":"Can sensitive information be deleted from llms? objectives for defending against extraction attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.244674Z"},"links":{"cited_paper":"/paper/2309.17410","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:df506a098e8be11a03ac92926efe7dc500089204479b01c5b7992b1f1e3ffac2","observation_id":"11943eb2-7684-42a4-9402-04f4fe61a795","resolution":{"observed_at":"2026-08-09T14:47:15.244674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.17374","last_updated":"2024-10-30T22:35:59Z","snapshot_observed_at":"2026-07-06T18:20:44.070255Z","submitted_at":"2024-05-27T17:31:56Z","title":"Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.17374","snapshot_observed_at":"2026-08-09T14:47:15.249627Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.249627Z"},"links":{"cited_paper":"/paper/2405.17374","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:9fbb2f7f3cd3da5d0e4c0dcbc4f502670286ac43b64910b3ba03398b13e40bf4","observation_id":"45cc7030-3d76-4a04-a0b8-f5b5f5e44703","resolution":{"observed_at":"2026-08-09T14:47:15.249627Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03693","last_updated":"2023-10-05T17:12:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-05T17:12:17Z","title":"Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03693","snapshot_observed_at":"2026-08-09T14:47:15.254462Z","title":"Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.254462Z"},"links":{"cited_paper":"/paper/2310.03693","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:cfa248b357055c004fcc1b803af73f2d92dba959f623fabba94ba0fe23e6afa0","observation_id":"a9921514-bedd-4a3d-a40f-c3ecc1d08f61","resolution":{"observed_at":"2026-08-09T14:47:15.254462Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.778143Z","title":"Safety alignment should be made more than just a few tokens deep, 2024 a","venue":null,"work_id":"4f1a107b-0d13-40bb-bd09-e134cf780d27","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.259603Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:03ec745f7101f8f2d26984439128d36ccb18cda3e71a645ecb9e70150e35fda6","observation_id":"7657da45-83b4-4452-96cc-aaf6b36efad7","resolution":{"observed_at":"2026-08-09T14:47:35.783616Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.07097","last_updated":"2024-12-10T01:30:32Z","snapshot_observed_at":"2026-08-07T16:36:45.547070Z","submitted_at":"2024-12-10T01:30:32Z","title":"On Evaluating the Durability of Safeguards for Open-Weight LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.07097","snapshot_observed_at":"2026-08-09T14:47:15.264207Z","title":"On evaluating the durability of safeguards for open-weight llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.264207Z"},"links":{"cited_paper":"/paper/2412.07097","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:d87172161864ed670862929f4a63e6c6824c00e0e7127df86796051e08fc0ae8","observation_id":"46082899-8732-4da9-ad97-7c6104d9b44c","resolution":{"observed_at":"2026-08-09T14:47:15.264207Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.761409Z","title":"D., Xu, P., Honigsberg, C., and Ho, D","venue":null,"work_id":"2aa5317f-efc6-436f-95d2-7abd442e0eaa","year":2022},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.269083Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:aa23491030edf759f075d473a26497a2aec49cd7a0ca735fa35ad65a99f206d4","observation_id":"46e855c5-3c66-40d2-b412-a59fd126938b","resolution":{"observed_at":"2026-08-09T14:47:35.767226Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.14981","last_updated":"2025-04-16T09:38:09Z","snapshot_observed_at":"2026-07-06T18:49:33.987133Z","submitted_at":"2024-07-20T21:13:56Z","title":"Open Problems in Technical AI Governance","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.14981","snapshot_observed_at":"2026-08-09T14:47:15.273714Z","title":"Open problems in technical ai governance","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.273714Z"},"links":{"cited_paper":"/paper/2407.14981","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:a169ec8e0be4c1ef53505655e6cec455f2205a56a28feac7d7319f55cabd4bc5","observation_id":"02e2e5a7-928d-45c4-b7d0-34193dd1bf67","resolution":{"observed_at":"2026-08-09T14:47:15.273714Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.14577","last_updated":"2024-10-30T22:58:40Z","snapshot_observed_at":"2026-07-06T18:18:39.093732Z","submitted_at":"2024-05-23T13:51:55Z","title":"Representation Noising: A Defence Mechanism Against Harmful Finetuning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.14577","snapshot_observed_at":"2026-08-09T14:47:15.278636Z","title":"Representation noising effectively prevents harmful fine-tuning on llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.278636Z"},"links":{"cited_paper":"/paper/2405.14577","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:e503daea4e349c82526ea6aefb3e4d550822a7d7453e6633ea0d2339b76b2940","observation_id":"d1c44e37-5f68-4494-8618-560ad26d944d","resolution":{"observed_at":"2026-08-09T14:47:15.278636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15570","last_updated":"2024-02-23T19:12:53Z","snapshot_observed_at":"2026-07-06T17:34:45.072246Z","submitted_at":"2024-02-23T19:12:53Z","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15570","snapshot_observed_at":"2026-08-09T14:47:15.283768Z","title":"S., Saha, S., Sriramanan, G., Kattakinda, P., Chegini, A., and Feizi, S","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.283768Z"},"links":{"cited_paper":"/paper/2402.15570","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:9c6a9461d3f10d158421a99f768ad3361be2d1548bc7817642d43342ff03378e","observation_id":"dc0996cd-9a84-41e8-95b7-8e63d29f3799","resolution":{"observed_at":"2026-08-09T14:47:15.283768Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.743494Z","title":null,"venue":null,"work_id":"3edd0032-866f-4df6-b543-608890ac0a16","year":2018},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.288872Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:d451024373ffc6d8f9360289c66d6697e76b05704b2b9717403d011a7a96a4db","observation_id":"494f9dc6-20ee-48f4-825c-e56e317b936b","resolution":{"observed_at":"2026-08-09T14:47:35.749567Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.07153","last_updated":"2023-05-11T21:54:30Z","snapshot_observed_at":"2026-08-08T00:13:40.833227Z","submitted_at":"2023-05-11T21:54:30Z","title":"Towards best practices in AGI safety and governance: A survey of expert opinion","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.07153","snapshot_observed_at":"2026-08-09T14:47:15.293676Z","title":"Towards best practices in agi safety and governance: A survey of expert opinion","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.293676Z"},"links":{"cited_paper":"/paper/2305.07153","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:61693524e893c4f47de370cc0f92a79a920fabb7d9aef039c8229dab9c93a6ef","observation_id":"77db4e86-0d51-49ef-b89a-be27da8b1815","resolution":{"observed_at":"2026-08-09T14:47:15.293676Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.725537Z","title":"Adversarial attacks and defenses in large language models: Old and new threats","venue":null,"work_id":"60d9c7fe-0651-486b-9e83-620e9373a26d","year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.299109Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:3ae12700e95b510b4f6d5b4e7a94889c7ff308263782eeb9bc570ca5c74e82e2","observation_id":"6ccc3f80-0418-4903-a57f-661b4c4fc24c","resolution":{"observed_at":"2026-08-09T14:47:35.730884Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09063","last_updated":"2025-04-16T15:15:56Z","snapshot_observed_at":"2026-08-09T19:47:01.044428Z","submitted_at":"2024-02-14T10:20:03Z","title":"Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09063","snapshot_observed_at":"2026-08-09T14:47:15.304017Z","title":"Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.304017Z"},"links":{"cited_paper":"/paper/2402.09063","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:2488f61268544f8e7536214e09d02fbd6cfe30a0befd26f404633867b65e42e3","observation_id":"ad40a32b-3f19-4bfc-b54c-e45792a8415a","resolution":{"observed_at":"2026-08-09T14:47:15.304017Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-08-07T21:21:24.962049Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-09T14:47:15.309285Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.309285Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:44b0be47e9e8f97121d380946a8009baaac0fa5f35625403d703aa226e5dc69a","observation_id":"af0cb92b-f7bd-42ad-9c34-e3a1ece7f36f","resolution":{"observed_at":"2026-08-09T14:47:15.309285Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15549","last_updated":"2025-07-29T09:37:22Z","snapshot_observed_at":"2026-08-06T22:31:48.025702Z","submitted_at":"2024-07-22T11:19:14Z","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.15549","snapshot_observed_at":"2026-08-09T14:47:15.314358Z","title":"C., Perez, E., Hadfield-Menell, D., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.314358Z"},"links":{"cited_paper":"/paper/2407.15549","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:c07843be544235f414286d3395fc97bd3eb95f6e221fc2ba044566de134146cb","observation_id":"5b9b18c3-6020-455f-9cdc-8ab91d420ad9","resolution":{"observed_at":"2026-08-09T14:47:15.314358Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15324","last_updated":"2023-09-22T18:48:42Z","snapshot_observed_at":"2026-08-08T14:17:44.034837Z","submitted_at":"2023-05-24T16:38:43Z","title":"Model evaluation for extreme risks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.15324","snapshot_observed_at":"2026-08-09T14:47:15.319250Z","title":"Model evaluation for extreme risks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.319250Z"},"links":{"cited_paper":"/paper/2305.15324","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:ffffe82f439391cdd20eb099ad555a6e331f19db21495e891f8f3cc86e26640b","observation_id":"e882aafa-ceab-4c62-9b51-c96884513ba0","resolution":{"observed_at":"2026-08-09T14:47:15.319250Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2010.15980","last_updated":"2020-11-07T05:33:35Z","snapshot_observed_at":"2026-08-05T14:17:34.026911Z","submitted_at":"2020-10-29T22:54:00Z","title":"AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.15980","snapshot_observed_at":"2026-08-09T14:47:15.324252Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.324252Z"},"links":{"cited_paper":"/paper/2010.15980","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:08822569b91b25fdaa9b0c130d8f8da06684b69c38e46190a447b5d417e331ff","observation_id":"04b13167-b951-403d-9833-4c2ac64427dc","resolution":{"observed_at":"2026-08-09T14:47:15.324252Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.00106","last_updated":"2024-06-27T10:24:35Z","snapshot_observed_at":"2026-08-09T22:56:17.923881Z","submitted_at":"2024-06-27T10:24:35Z","title":"UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.00106","snapshot_observed_at":"2026-08-09T14:47:15.329073Z","title":"Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.329073Z"},"links":{"cited_paper":"/paper/2407.00106","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:8783f50514936aafb9c13062f4c51336f6b0cfa94c16c432a0714e760117e11a","observation_id":"8b1f053a-be81-4969-aa6a-d73c134f95ac","resolution":{"observed_at":"2026-08-09T14:47:15.329073Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.709416Z","title":null,"venue":null,"work_id":"6d3d4cb2-cd21-4ba6-b6e4-75a5e0a563f9","year":2019},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.334078Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f3cedede2042af168868935049c43e58dd09130dd4b1b43bf6ecb133c2a5a070","observation_id":"f6df5fa0-756f-4281-87e5-1492cc8cc155","resolution":{"observed_at":"2026-08-09T14:47:35.714557Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.10260","last_updated":"2024-08-27T03:32:47Z","snapshot_observed_at":"2026-08-04T21:32:35.483431Z","submitted_at":"2024-02-15T18:58:09Z","title":"A StrongREJECT for Empty Jailbreaks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.10260","snapshot_observed_at":"2026-08-09T14:47:15.338954Z","title":"A strongreject for empty jailbreaks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.338954Z"},"links":{"cited_paper":"/paper/2402.10260","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:77ade86b30923ecd1c06eea6bea039808fd80e61772fce49828f0467684ed190","observation_id":"3b01b132-ce61-46a2-aedf-4dcea52fdc81","resolution":{"observed_at":"2026-08-09T14:47:15.338954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.11695","last_updated":"2024-05-06T17:47:01Z","snapshot_observed_at":"2026-07-06T15:44:42.776459Z","submitted_at":"2023-06-20T17:18:20Z","title":"A Simple and Effective Pruning Approach for Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.11695","snapshot_observed_at":"2026-08-09T14:47:15.343866Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.343866Z"},"links":{"cited_paper":"/paper/2306.11695","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:8017c9c90b072f9dae1cadc8a33671df8bb42a6c708edc605355b6ce6beab845","observation_id":"1d3ddeba-b616-47bb-bed5-613a2bf254ed","resolution":{"observed_at":"2026-08-09T14:47:15.343866Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00761","last_updated":"2025-02-10T18:26:14Z","snapshot_observed_at":"2026-08-06T05:53:06.918202Z","submitted_at":"2024-08-01T17:59:12Z","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00761","snapshot_observed_at":"2026-08-09T14:47:15.348837Z","title":"Tamper-resistant safeguards for open-weight llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.348837Z"},"links":{"cited_paper":"/paper/2408.00761","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:882107e23903da4986fae0addf477ab2d22df6fba7f0a1d2b282382238d26a60","observation_id":"9a2486f0-3e1b-4f9f-b395-d26a1835bd4d","resolution":{"observed_at":"2026-08-09T14:47:15.348837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-09T14:47:15.353590Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.353590Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:7763f735d7db3739329cd4c5d008fd9030e92e6d462d5f3522f0a06d2d35c47d","observation_id":"aa727472-dfef-42ec-84b1-83bb5e94f6d2","resolution":{"observed_at":"2026-08-09T14:47:15.353590Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.692324Z","title":"A pro-innovation approach to AI regulation","venue":null,"work_id":"eb30bd67-7d85-4e56-af61-9884d50ac905","year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.358517Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f8a8984d2812a0110addf043381a8b3a5057ed8313830d5bc55f0ee2675c6822","observation_id":"1dfc3555-196d-425e-833a-f95e4ee86445","resolution":{"observed_at":"2026-08-09T14:47:35.698068Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.07358","last_updated":"2025-02-06T20:58:43Z","snapshot_observed_at":"2026-08-06T05:53:39.626163Z","submitted_at":"2024-06-11T15:26:57Z","title":"AI Sandbagging: Language Models can Strategically Underperform on Evaluations","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.07358","snapshot_observed_at":"2026-08-09T14:47:15.363084Z","title":"F., and Ward, F","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.363084Z"},"links":{"cited_paper":"/paper/2406.07358","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:637c2c38e73737bfd14aaa51fb5c6e60e8c934d2c7a93779debc909f1de3cf1e","observation_id":"1876fddd-203d-463e-839f-4af8685db792","resolution":{"observed_at":"2026-08-09T14:47:15.363084Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-07-06T16:48:16.671370Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-09T14:47:15.367750Z","title":"and Shu, K","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.367750Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:16b9748ceba8b5d782bafe27b66b9c264b88b6403c8b64a9346f7327123122a8","observation_id":"dd41a068-d301-48c4-a177-4c4270a48e03","resolution":{"observed_at":"2026-08-09T14:47:15.367750Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.15589","last_updated":"2024-11-01T16:39:36Z","snapshot_observed_at":"2026-08-05T10:26:07.839736Z","submitted_at":"2024-05-24T14:20:09Z","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.15589","snapshot_observed_at":"2026-08-09T14:47:15.372451Z","title":"Efficient adversarial training in llms with continuous attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.372451Z"},"links":{"cited_paper":"/paper/2405.15589","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:86d372f1c5872948a31c74e9ea653ea33a009ad167d684c6828ba2f9c1526201","observation_id":"0bf8c76c-ecb1-4d01-a8c8-a7a07a00873c","resolution":{"observed_at":"2026-08-09T14:47:15.372451Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02949","last_updated":"2023-10-04T16:39:31Z","snapshot_observed_at":"2026-08-07T11:20:01.991656Z","submitted_at":"2023-10-04T16:39:31Z","title":"Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02949","snapshot_observed_at":"2026-08-09T14:47:15.377658Z","title":"Y., Zhao, X., and Lin, D","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.377658Z"},"links":{"cited_paper":"/paper/2310.02949","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:38d94b9c1bceaa1bf27f060c16064127158f34fc0bc3d541921006960412274d","observation_id":"da6e0ecc-79bb-47cc-80ab-863b8edc129c","resolution":{"observed_at":"2026-08-09T14:47:15.377658Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.675952Z","title":"On the vulnerability of safety alignment in open-access llms","venue":null,"work_id":"ac73d1a1-150d-4d48-8101-d90629b06cdf","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.382845Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:05c324a37f2657d1e6783331c2a991b1f0f9d101988c09a15a34ea383347f92b","observation_id":"fc9df143-d719-4af9-8b61-8e95f72f1ce9","resolution":{"observed_at":"2026-08-09T14:47:35.680996Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-09T14:47:15.387716Z","title":"Jailbreak attacks and defenses against large language models: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.387716Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:6e94e247823a1d1f07ba132b0ad799d4d123a98feb4b0ab4bcc095b36db1e19a","observation_id":"c0b52edb-205f-49c1-879f-be6937fc0b5e","resolution":{"observed_at":"2026-08-09T14:47:15.387716Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-09T14:47:15.392539Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.392539Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:2f9206cb32be2466f2936c112f0b0557b1d096bff6a12127222e5b8e1101694c","observation_id":"bc50e58e-37ee-492d-bc8c-52347c806179","resolution":{"observed_at":"2026-08-09T14:47:15.392539Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.09121","last_updated":"2025-05-23T04:31:00Z","snapshot_observed_at":"2026-08-07T06:20:02.075920Z","submitted_at":"2024-07-12T09:36:33Z","title":"Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.09121","snapshot_observed_at":"2026-08-09T14:47:15.397309Z","title":"Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.397309Z"},"links":{"cited_paper":"/paper/2407.09121","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:3b51b4b9e32fd022caa68ef5a9cd0fc2a1e7e9480a86d3554fe29747fa763bca","observation_id":"aefc68dd-f5a7-4218-8fe3-77f7c6f34395","resolution":{"observed_at":"2026-08-09T14:47:15.397309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.17092","last_updated":"2024-06-24T19:29:47Z","snapshot_observed_at":"2026-08-09T15:27:19.924818Z","submitted_at":"2024-06-24T19:29:47Z","title":"BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.17092","snapshot_observed_at":"2026-08-09T14:47:15.402376Z","title":"N., Song, D., Li, B., and Jia, R","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.402376Z"},"links":{"cited_paper":"/paper/2406.17092","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:774ed3e45f1a14589948005ede5bd66ce30a9ccc4d8fb045fe3caa17abb35ee0","observation_id":"ad4eb8ad-9be3-49ed-bbd1-b106c3b322d5","resolution":{"observed_at":"2026-08-09T14:47:15.402376Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05553","last_updated":"2024-04-05T23:30:56Z","snapshot_observed_at":"2026-08-07T23:30:34.877117Z","submitted_at":"2023-11-09T17:54:59Z","title":"Removing RLHF Protections in GPT-4 via Fine-Tuning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05553","snapshot_observed_at":"2026-08-09T14:47:15.407456Z","title":"Removing rlhf protections in gpt-4 via fine-tuning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.407456Z"},"links":{"cited_paper":"/paper/2311.05553","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:cd4b4014219c15e79ba509c26e0c472dc99585f905290a5509f5511a9c021e79","observation_id":"75cfd0a4-16c1-4066-8ef6-5fb86992c319","resolution":{"observed_at":"2026-08-09T14:47:15.407456Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2309.17401","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:24.376073Z","title":"Adversarial machine learning in latent representations of neural networks","venue":null,"work_id":"6b71d54b-bbee-4ba0-bf6e-84e1ac1b58de","year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.412546Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:b831e777a07c4d4e53ba6855ff26d1fa4126a4ea1c22e61e24b7cad4c1dc68d8","observation_id":"f3323a75-f9ad-4ce3-b497-b1bad5992b69","resolution":{"observed_at":"2026-08-09T14:47:24.387209Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.16454","last_updated":"2025-03-21T06:37:37Z","snapshot_observed_at":"2026-07-06T19:37:24.895623Z","submitted_at":"2024-10-21T19:28:37Z","title":"Catastrophic Failure of LLM Unlearning via Quantization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.16454","snapshot_observed_at":"2026-08-09T14:47:15.422836Z","title":"Catastrophic failure of llm unlearning via quantization, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.422836Z"},"links":{"cited_paper":"/paper/2410.16454","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:2d14f3875cbb25ed281168d2e8d3d4025f2d303bc3f99a89e949c86420df3dd9","observation_id":"73905ea9-a758-443f-8657-588ec377ee6c","resolution":{"observed_at":"2026-08-09T14:47:15.422836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.06852","last_updated":"2025-01-04T13:39:47Z","snapshot_observed_at":"2026-07-06T18:28:33.795339Z","submitted_at":"2024-06-10T23:54:21Z","title":"A Survey of Recent Backdoor Attacks and Defenses in Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.06852","snapshot_observed_at":"2026-08-09T14:47:15.427626Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.427626Z"},"links":{"cited_paper":"/paper/2406.06852","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:ccb7d4496a1b2cb7a93c8323a4c9ad9e6a3aafb94669fec9205b7fb9db0ae439","observation_id":"c52482b9-2f28-4048-80f8-85433775e0de","resolution":{"observed_at":"2026-08-09T14:47:15.427626Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.06364","last_updated":"2023-09-18T14:23:02Z","snapshot_observed_at":"2026-08-07T12:51:50.861720Z","submitted_at":"2023-04-13T09:39:30Z","title":"AGIEval: A Human-Centric Benchmark for Evaluating Foundation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.06364","snapshot_observed_at":"2026-08-09T14:47:15.432963Z","title":"Agieval: A human-centric benchmark for evaluating foundation models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.432963Z"},"links":{"cited_paper":"/paper/2304.06364","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:d53f466ff09781a93fe9fa6b24e9241304521ddffed0f02feb051a998970d2de","observation_id":"0f86f630-1d5a-440f-a596-014d8a74a2cc","resolution":{"observed_at":"2026-08-09T14:47:15.432963Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-09T14:47:15.438083Z","title":"Representation engineering: A top-down approach to ai transparency","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":91,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.438083Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:24f2f2f58da38626aee4c3bd3a6396344dce13a81f7dd0c0c865a4f9374fcd0c","observation_id":"d94a0715-f578-490c-8a47-ec5e68464ee1","resolution":{"observed_at":"2026-08-09T14:47:15.438083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-09T14:47:15.442928Z","title":"Z., and Fredrikson, M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.442928Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:f7c2f415ab27706cfb75ae58c7cd8028f77e98e8bd62aab197d25223fecf8fa0","observation_id":"c0a5011b-8beb-48f3-b3fd-c6ba8f62a5b6","resolution":{"observed_at":"2026-08-09T14:47:15.442928Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T14:47:35.659800Z","title":"Improving alignment and robustness with circuit breakers","venue":null,"work_id":"98856c3e-f2e3-4652-9641-f4e09c9a5bf9","year":2024},"citing_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-09T14:47:15.448064Z"},"links":{"citing_paper":"/paper/2502.05209"},"observation_digest":"sha256:356e6e45ca024e0cf12533c72897b7beae02fcd6908f9c63ff382e2ec551589e","observation_id":"73f8f072-4083-4492-8bce-0cafd19c6284","resolution":{"observed_at":"2026-08-09T14:47:35.664850Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","latest_version":4,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities"},"reference_resolution":{"displayed":92,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":78,"verified_exact":1,"verified_fuzzy":13},"total_outbound_references":92},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 92 of 92 outbound references and 8 inbound Pith citation observations for arXiv:2502.05209."}