{"as_of":"2026-08-19T22:35:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:3ec9219f9647131164e9ebb3b38b733bfb2bfa61f258c2b404ad544517a13bd1","coverage":[{"denominator":83,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":83,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T04:34:34.466875Z","state":"measured"},{"denominator":92,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":92,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-19T06:32:44.657259+00:00","state":"measured"},{"denominator":9,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":9,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T17:47:19.126970Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T00:59:21.218293Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-07T13:32:46.117270Z","title":"Transferable adversarial attacks on black-box vision-language models.arXiv preprint arXiv:2505.01050, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-07T13:24:27.400642Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.117270Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:e3677e26047a6070d2ac9ef09d825fe0cbefa35f01483590dbabfc7a45cc3f64","observation_id":"02d142aa-3a58-466f-8bc4-7634cb758e85","resolution":{"observed_at":"2026-08-07T13:32:46.117270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-15T17:47:19.126970Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.20526","last_updated":"2025-07-28T05:13:04Z","snapshot_observed_at":"2026-08-19T14:36:45.708650Z","submitted_at":"2025-07-28T05:13:04Z","title":"Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-15T17:47:19.126970Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2507.20526"},"observation_digest":"sha256:c30b2857c019e42058a30f0f12540196e2cc66d8bc74656d8622d2db2b90acec","observation_id":"083f7259-0d1d-4bde-8eca-180cf529d63e","resolution":{"observed_at":"2026-08-15T17:47:19.126970Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2512.21815","last_updated":"2026-06-29T08:03:34Z","snapshot_observed_at":"2026-08-11T15:48:09.383072Z","submitted_at":"2025-12-26T01:01:25Z","title":"High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-16T19:29:43.382392Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2512.21815"},"observation_digest":"sha256:dbe360244895489831ce1f58772f8f542922a0d71468396de046baf0f465d89f","observation_id":"7718ef9e-c485-457e-85e4-0f6bf281c1b3","resolution":{"observed_at":"2026-05-16T19:31:13.089502Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-03T14:05:23.148338Z","title":"Trans- ferable adversarial attacks on black-box vision-language models.CoRR, abs/2505.01050, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2512.21815","last_updated":"2026-06-29T08:03:34Z","snapshot_observed_at":"2026-08-11T15:48:09.383072Z","submitted_at":"2025-12-26T01:01:25Z","title":"High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models","version":4},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-03T14:05:23.148338Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2512.21815"},"observation_digest":"sha256:328445a8905578ff162c6983c4195fcd9814685531554d89354e323c12d15cb5","observation_id":"b65d8d1c-3f79-4555-8cf8-0ba3c20b67c9","resolution":{"observed_at":"2026-08-03T14:05:23.148338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2601.23179","last_updated":"2026-04-20T06:15:25Z","snapshot_observed_at":"2026-08-17T20:47:09.641830Z","submitted_at":"2026-01-30T17:03:24Z","title":"Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-16T09:26:14.799360Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2601.23179"},"observation_digest":"sha256:acb83e040c11818183a5f17d5226e16556fc4630fd8ff066db6e724286806745","observation_id":"2385f503-96eb-40c1-99f4-b7e947b121da","resolution":{"observed_at":"2026-05-16T09:27:40.991023Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2605.04261","last_updated":"2026-05-05T19:55:28Z","snapshot_observed_at":"2026-08-15T04:06:36.021932Z","submitted_at":"2026-05-05T19:55:28Z","title":"Laundering AI Authority with Adversarial Examples","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-08T17:19:38.662062Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2605.04261"},"observation_digest":"sha256:b1bf181c5e392608cbe240527143d76361a26ae62151a74e5eaeec48cf349f0f","observation_id":"367a0044-35ea-4727-84dd-85f327c10403","resolution":{"observed_at":"2026-05-11T17:41:08.067046Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2605.21541","last_updated":"2026-05-20T08:15:56Z","snapshot_observed_at":"2026-08-18T01:01:03.391068Z","submitted_at":"2026-05-20T08:15:56Z","title":"Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-22T01:25:06.528845Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2605.21541"},"observation_digest":"sha256:701ec905cff59b45f0360820df52636d1df871e6f103c49a89c1510b3546387b","observation_id":"3f59c936-afc0-45cb-8666-d687fe540a52","resolution":{"observed_at":"2026-05-22T01:25:52.636726Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2606.18710","last_updated":"2026-06-17T05:51:14Z","snapshot_observed_at":"2026-08-14T06:38:04.767925Z","submitted_at":"2026-06-17T05:51:14Z","title":"Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-06-26T20:44:41.268975Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2606.18710"},"observation_digest":"sha256:4f96a309985e9d18a1d769fce718c9fe639887ed784e07c42bec0c2957bd5403","observation_id":"c377a7fd-f605-4322-af3d-26b9ebffd054","resolution":{"observed_at":"2026-07-04T00:59:21.220186Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2607.00174","last_updated":"2026-06-30T20:47:35Z","snapshot_observed_at":"2026-08-13T04:37:49.821515Z","submitted_at":"2026-06-30T20:47:35Z","title":"Steal the Patch Size: Adversarially Manipulate Vision-Language Models","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-07-02T19:30:19.691473Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2607.00174"},"observation_digest":"sha256:0ad71d3ef0e595ed13c4defc6a3842e0e6a1567ebe20f574590670961ddbf639","observation_id":"4a2d34d4-02f9-4e9a-ac19-5bab80e8a762","resolution":{"observed_at":"2026-07-02T19:37:18.466063Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2505.01050/citation-record","integrity":"/paper/2505.01050/integrity","json":"/paper/2505.01050/citation-record.json","paper":"/paper/2505.01050"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.160872Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.160872Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:bb61477ea4c57d8d5e083f40df06cce1750c3d656a2c24fb64d50db0b5c78cdd","observation_id":"ee7b22f6-444c-4832-878a-abc3ddd21edb","resolution":{"observed_at":"2026-08-16T04:34:34.160872Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-17T09:58:46.058102Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-16T04:34:34.165708Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.165708Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0fac6ae23cfdc06e16ead23818f0d4a51c00f2e3ed745207c302d6f463c5fa9d","observation_id":"c1f9d0ad-3eae-4627-81c5-c258e9542356","resolution":{"observed_at":"2026-08-16T04:34:34.165708Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.169725Z","title":"Llama 3 model card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.169725Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:4e5148a93192f324f6633687572703d64330e5b90b873cf9840f6a1e9280c369","observation_id":"e8e6b134-43b6-48e7-b94d-596091a31889","resolution":{"observed_at":"2026-08-16T04:34:34.169725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-16T14:04:12.947538Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-16T04:34:34.173226Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.173226Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a47f79f0e027f9ec9df3be577dfe76315beeffd238bac6f0fb60243b2851ad12","observation_id":"9130abb0-0457-4875-8965-f7b8d118eda3","resolution":{"observed_at":"2026-08-16T04:34:34.173226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.177020Z","title":"Model card and evaluations for claude models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.177020Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:267327e1d739ba5758cd4cef35adfddcbe7c8c1dcd1da6e38d8d671dd42b30d5","observation_id":"26b926a3-bd56-4dc1-81ca-fba99ae45735","resolution":{"observed_at":"2026-08-16T04:34:34.177020Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.330600Z","title":"The claude 3 model family: Opus, sonnet, haiku","venue":null,"work_id":"b73bf4c1-ef13-46c2-b0ea-99dc54effa48","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.180461Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f4016de5fb394e99d7fea6ba99055fc162f23b1ce0ecb9000d50c380ec213434","observation_id":"e6f7accd-9ed6-4bf5-90e0-d438fec113c9","resolution":{"observed_at":"2026-08-16T04:34:35.334246Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.13923","last_updated":"2025-02-19T18:00:14Z","snapshot_observed_at":"2026-08-14T04:17:22.593941Z","submitted_at":"2025-02-19T18:00:14Z","title":"Qwen2.5-VL Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.13923","snapshot_observed_at":"2026-08-16T04:34:34.183861Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.183861Z"},"links":{"cited_paper":"/paper/2502.13923","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d1291f26bbd64d4d9dfb36986687135c14a44457738d3c6a1e13422ece53c541","observation_id":"51845fca-6eda-4c25-aa77-cae82fd698f9","resolution":{"observed_at":"2026-08-16T04:34:34.183861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00236","last_updated":"2024-09-17T19:56:09Z","snapshot_observed_at":"2026-08-19T01:23:57.750375Z","submitted_at":"2023-09-01T03:53:40Z","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00236","snapshot_observed_at":"2026-08-16T04:34:34.187704Z","title":"Image hijacks: Adversarial images can control generative models at runtime","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.187704Z"},"links":{"cited_paper":"/paper/2309.00236","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:050fa9d8bc6a5939e544d9caf4161c11f37444f437da075717ca694aa9e1296f","observation_id":"836fd2c4-9d7f-40e5-b3d4-6ada7dcd91ce","resolution":{"observed_at":"2026-08-16T04:34:34.187704Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.320050Z","title":"Evasion attacks against machine learning at test time","venue":null,"work_id":"46a99aad-f003-4cbe-8eb4-34671014de0e","year":2013},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.191197Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:4dcb8e96a258e9f55c970548c62e11cf2418d39bfaf6362d6f98c631930ae222","observation_id":"4e74ba98-fd9a-46b4-bb3e-5d9664275554","resolution":{"observed_at":"2026-08-16T04:34:35.323690Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15818","last_updated":"2023-07-28T21:18:02Z","snapshot_observed_at":"2026-08-02T16:17:50.621617Z","submitted_at":"2023-07-28T21:18:02Z","title":"RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15818","snapshot_observed_at":"2026-08-16T04:34:34.194529Z","title":"Rt-2: Vision-language-action models transfer web knowledge to robotic control","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.194529Z"},"links":{"cited_paper":"/paper/2307.15818","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d8fd893c216e42720fd935b5918b2a2ccadce0c42013522a62b78a484d2bcc51","observation_id":"39791491-56bc-4bf0-8687-8010b191d4a8","resolution":{"observed_at":"2026-08-16T04:34:34.194529Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.309403Z","title":"Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2023","venue":null,"work_id":"cdc16dbf-d859-4cb1-a6d2-7e4045a8a7a9","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.198028Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a516a013d9a12e2edd3c7dd3b8d1883ce1d837cb2f2c33dcc5d23fc13a91b412","observation_id":"232eb64f-ff7b-4d68-9b15-2d61f3da3c31","resolution":{"observed_at":"2026-08-16T04:34:35.313026Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-16T13:08:51.920120Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-16T04:34:34.201186Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.201186Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:dc269006bf8c9aca38462c08461a6a6683298d354666c59f602d50bd8910c5a7","observation_id":"1ca1d42d-810c-4d58-91f2-90a79f8a560d","resolution":{"observed_at":"2026-08-16T04:34:34.201186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.09105","last_updated":"2024-03-04T11:30:06Z","snapshot_observed_at":"2026-08-19T12:47:37.176074Z","submitted_at":"2023-03-16T06:37:16Z","title":"Rethinking Model Ensemble in Transfer-based Adversarial Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.09105","snapshot_observed_at":"2026-08-16T04:34:34.204316Z","title":"Rethinking model ensemble in transfer-based adversarial attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.204316Z"},"links":{"cited_paper":"/paper/2303.09105","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:e5d1715685b9c89d47e142850cdb7ad804eca332eda4c15378d870db56cc524a","observation_id":"807f4dd1-4a16-4aae-ad71-fb07a707204f","resolution":{"observed_at":"2026-08-16T04:34:34.204316Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.03411","last_updated":"2024-12-15T20:50:51Z","snapshot_observed_at":"2026-08-19T15:16:34.706810Z","submitted_at":"2024-04-04T12:38:14Z","title":"Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.03411","snapshot_observed_at":"2026-08-16T04:34:34.207424Z","title":"Red teaming gpt-4v: Are gpt-4v safe against uni/multi-modal jailbreak attacks?, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.207424Z"},"links":{"cited_paper":"/paper/2404.03411","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f2edff35735e29a45b53d5f4edd9e3bb2f558837b1d0aa241c590810fbfe33f4","observation_id":"9426dbcb-d891-4347-82ca-93130fa736ae","resolution":{"observed_at":"2026-08-16T04:34:34.207424Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.200987Z","title":"Certified adversarial robustness via randomized smoothing","venue":null,"work_id":"b3980a86-214b-4666-8685-a08ba5c10bef","year":2019},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.210767Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:9f55740fe482364f8571a36d51e7b62acb47ab3a5483dbbef9ab4d2d6307173e","observation_id":"d3ecb44a-bc7b-408e-8fa1-50e26bffde9f","resolution":{"observed_at":"2026-08-16T04:34:35.302101Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.16588","last_updated":"2024-04-12T09:38:33Z","snapshot_observed_at":"2026-08-07T09:40:32.614733Z","submitted_at":"2023-09-28T16:45:46Z","title":"Vision Transformers Need Registers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.16588","snapshot_observed_at":"2026-08-16T04:34:34.214741Z","title":"Vision transformers need registers","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.214741Z"},"links":{"cited_paper":"/paper/2309.16588","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:cb6fb39c455ef07ae23a19c1207cb21c4d2b07818e410d5309d7384ea53cb912","observation_id":"a52e39a9-b6c0-42c4-ba6e-9bbd402ddff1","resolution":{"observed_at":"2026-08-16T04:34:34.214741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.190998Z","title":"Paddleocr: An easy-to-use ocr tool based on paddlepaddle","venue":null,"work_id":"feeb1b73-027e-4539-b6b5-1821f1471727","year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.218313Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:20c9d99bf156ae79f31fbecd236f104c96c676ec165fe964f1fb6c342e6ac23b","observation_id":"50de2276-79c0-4cee-ab66-7476e8d7afae","resolution":{"observed_at":"2026-08-16T04:34:35.194540Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.11751","last_updated":"2023-10-14T12:56:13Z","snapshot_observed_at":"2026-08-16T14:58:55.951885Z","submitted_at":"2023-09-21T03:24:30Z","title":"How Robust is Google's Bard to Adversarial Image Attacks?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.11751","snapshot_observed_at":"2026-08-16T04:34:34.222225Z","title":"How robust is google's bard to adversarial image attacks? arXiv preprint arXiv:2309.11751, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.222225Z"},"links":{"cited_paper":"/paper/2309.11751","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d8ab6b86b08be7f5b5ce642296a854581ea7bcc8c54d07cd35f09a4007d94d7c","observation_id":"7ca23396-7e39-4883-8729-a54a7e1a16fe","resolution":{"observed_at":"2026-08-16T04:34:34.222225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.181022Z","title":"Large language models in radiology: fundamentals, applications, ethical considerations, risks, and future directions","venue":null,"work_id":"f1e429c3-560a-498e-b9c0-5de90b25a12e","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.226222Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:91872ef502b2c4b378f526cff0f5cae658f2d4e134261160a5e3fce47c379d08","observation_id":"f1c10498-814c-4243-abb0-4f67ac295e5e","resolution":{"observed_at":"2026-08-16T04:34:35.184607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.229543Z","title":"Robust physical-world attacks on deep learning visual classification","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.229543Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:54767e0b7d038bd3d1439a2317bfb6f7f45d336be37dff2cff5211fef2c06dd6","observation_id":"da38a1d0-1415-4c07-aca8-e13158d5c825","resolution":{"observed_at":"2026-08-16T04:34:34.229543Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.17425","last_updated":"2023-11-06T02:47:51Z","snapshot_observed_at":"2026-08-16T14:56:25.720519Z","submitted_at":"2023-09-29T17:37:29Z","title":"Data Filtering Networks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.17425","snapshot_observed_at":"2026-08-16T04:34:34.232849Z","title":"Data filtering networks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.232849Z"},"links":{"cited_paper":"/paper/2309.17425","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:25a92a1cf9ac01d1d6b63ab3099df0df1d5f154cfd765d24d134e16f190e5e8e","observation_id":"c917b5d7-14cd-4058-acf7-ac06200894c6","resolution":{"observed_at":"2026-08-16T04:34:34.232849Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2010.01412","last_updated":"2021-04-29T16:44:25Z","snapshot_observed_at":"2026-08-15T12:34:14.131778Z","submitted_at":"2020-10-03T19:02:10Z","title":"Sharpness-Aware Minimization for Efficiently Improving Generalization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.01412","snapshot_observed_at":"2026-08-16T04:34:34.236251Z","title":"Sharpness-aware minimization for efficiently improving generalization","venue":null,"work_id":null,"year":2010},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.236251Z"},"links":{"cited_paper":"/paper/2010.01412","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a1845b38c9091e96c863bb66cc4da7c84c30c2bb4b90fbce3b8b6ffa3c77c316","observation_id":"7048848a-7e78-4c27-bd35-59cfc9c775cf","resolution":{"observed_at":"2026-08-16T04:34:34.236251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.239756Z","title":"Multimodal neurons in artificial neural networks","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.239756Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:37095f3a982f16e0475bd6e45c557aeda6098cad594ec40c28218a49e87c6dbb","observation_id":"baeb416b-e12e-4682-99b0-3df4979f8d64","resolution":{"observed_at":"2026-08-16T04:34:34.239756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.243186Z","title":"Goodfellow, Jonathon Shlens, and Christian Szegedy","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.243186Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:9f37d27a44f81527089947927106b2cf0f390f9bd9c5a97f6b616bf4c2554ae6","observation_id":"edf5d497-06fc-4a0f-aa12-a64ea4280b78","resolution":{"observed_at":"2026-08-16T04:34:34.243186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.153093Z","title":"Regulating chatgpt and other large generative ai models","venue":null,"work_id":"3bc8fdd6-9891-4ddc-9f0d-1940bf77daea","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.247003Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:326138a181c20a234d42b0e368cd5e3a4bba5ad04ecee9618ff06afc9e1090a9","observation_id":"aecff6d5-dc7e-406e-85fa-25e26479f794","resolution":{"observed_at":"2026-08-16T04:34:35.156584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.250782Z","title":"Deep residual learning for image recognition","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.250782Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:53965f7925bec69d6abd4a539951ab66d3d9cb6e208292d4fd9a9fe60a927fb3","observation_id":"e246c911-ba7e-4294-9dd0-eac34feaeae7","resolution":{"observed_at":"2026-08-16T04:34:34.250782Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.136374Z","title":"Deep networks with stochastic depth","venue":null,"work_id":"c4660cd2-724e-4c0d-b51d-a83e2365d813","year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.253970Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:b60e5fb860ae06f92a3c3b81938d1b6a9265d1b5a49a866c1f09b0ce9e6398d1","observation_id":"9f14c6a3-d17a-479d-9f35-df75d17c215e","resolution":{"observed_at":"2026-08-16T04:34:35.140252Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.257743Z","title":"Densely connected convolutional networks","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.257743Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:4a724da67894d99a9abf63cd28afa5a9b9eb6fc8c4309dec62140823bbf524ff","observation_id":"cd3aeb0a-9296-4bee-a9e1-a04458abb6d5","resolution":{"observed_at":"2026-08-16T04:34:34.257743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1803.05407","last_updated":"2019-02-25T14:18:11Z","snapshot_observed_at":"2026-08-14T19:36:09.254749Z","submitted_at":"2018-03-14T17:09:27Z","title":"Averaging Weights Leads to Wider Optima and Better Generalization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1803.05407","snapshot_observed_at":"2026-08-16T04:34:34.261402Z","title":"Averaging weights leads to wider optima and better generalization","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.261402Z"},"links":{"cited_paper":"/paper/1803.05407","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:8bd93dca8b3e24389a6b410f5a1e94ab686f3664d0531b9e7c7396bdbada5088","observation_id":"cbe52011-36f5-4a70-9efc-7a6331ddbfb2","resolution":{"observed_at":"2026-08-16T04:34:34.261402Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-16T04:34:34.264833Z","title":"Baseline defenses for adversarial attacks against aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.264833Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:8f6a3860850abbe635627cceebe879dda21c290baa31dc8647010d8a25bd3355","observation_id":"1b224d41-e382-4346-9245-fc29747c201a","resolution":{"observed_at":"2026-08-16T04:34:34.264833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2004.10190","last_updated":"2020-07-31T13:43:53Z","snapshot_observed_at":"2026-08-19T08:25:55.074839Z","submitted_at":"2020-04-21T17:57:04Z","title":"Never Stop Learning: The Effectiveness of Fine-Tuning in Robotic Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2004.10190","snapshot_observed_at":"2026-08-16T04:34:34.268065Z","title":"Never stop learning: The effectiveness of fine-tuning in robotic reinforcement learning","venue":null,"work_id":null,"year":2004},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.268065Z"},"links":{"cited_paper":"/paper/2004.10190","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:584f1367936ca06b0880788f124e7e2711558609c8b1a460804df0cb9df25e33","observation_id":"3655163f-0bf5-429b-8b3a-382f9c8e6832","resolution":{"observed_at":"2026-08-16T04:34:34.268065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.119275Z","title":"Adversarial attacks and defences competition","venue":null,"work_id":"0dbb0fe5-aedf-4afd-b9ba-d33153efa1e3","year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.271617Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:5f751782e3a53383fcc38e97dd221b8b86db35eb32577f537b433a5042ff5fc8","observation_id":"2871704e-3301-4862-ad25-a614fd5e33e4","resolution":{"observed_at":"2026-08-16T04:34:35.123434Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.108240Z","title":"Building and better understanding vision-language models: insights and future directions","venue":null,"work_id":"ba4d9ee6-1839-4433-9e3a-75cc40c5f9a0","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.274647Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ad192281fa25ff017edba408865f83f43d109deec00b6f7b0deb9264c6fc6923","observation_id":"4312c81d-cf67-4f78-941b-c871117676aa","resolution":{"observed_at":"2026-08-16T04:34:35.111904Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.07895","last_updated":"2024-07-28T19:58:08Z","snapshot_observed_at":"2026-08-13T00:09:23.835117Z","submitted_at":"2024-07-10T17:59:43Z","title":"LLaVA-NeXT-Interleave: Tackling Multi-image, Video, and 3D in Large Multimodal Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.07895","snapshot_observed_at":"2026-08-16T04:34:34.278320Z","title":"Llava-next-interleave: Tackling multi-image, video, and 3d in large multimodal models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.278320Z"},"links":{"cited_paper":"/paper/2407.07895","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7ae8c1e92280692a3f6e03929624caca105902430ee5b937e033d73f3e19fbdc","observation_id":"9cc1f752-8afe-4863-b58a-5f4a0ff6ad60","resolution":{"observed_at":"2026-08-16T04:34:34.278320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-16T13:23:25.577041Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-16T04:34:34.281806Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.281806Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:9b964945b9d5842d476684e773c82417952fcbd77dc3fd588e5ee6e61a11de84","observation_id":"9aa46f9c-67aa-45d8-85ed-081b9373d979","resolution":{"observed_at":"2026-08-16T04:34:34.281806Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.15658","last_updated":"2023-06-27T17:51:06Z","snapshot_observed_at":"2026-08-19T15:16:26.293186Z","submitted_at":"2023-06-27T17:51:06Z","title":"CLIPA-v2: Scaling CLIP Training with 81.1% Zero-shot ImageNet Accuracy within a \\$10,000 Budget; An Extra \\$4,000 Unlocks 81.8% Accuracy","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.15658","snapshot_observed_at":"2026-08-16T04:34:34.285319Z","title":"Clipa-v2: Scaling clip training with 81.1 accuracy within a 10,000 budget; an extra 4,000 unlocks 81.8 arXiv preprint arXiv:2306.15658, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.285319Z"},"links":{"cited_paper":"/paper/2306.15658","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ee44633ce5db67a73473d33df2f9667deee2f78c89e80527b9399a25e35e0fdb","observation_id":"1eb14972-568b-4528-8915-f112ab047e13","resolution":{"observed_at":"2026-08-16T04:34:34.285319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.288730Z","title":"Microsoft coco: Common objects in context","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.288730Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:c163262a19a755f8709612ecbb373e1f1f0bb3b69c210aa93f610224e9b0cf06","observation_id":"d5de2046-b404-4555-98cb-c10e2f1e9d27","resolution":{"observed_at":"2026-08-16T04:34:34.288730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.292579Z","title":"Visual instruction tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.292579Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:13d1ad8f128210aaba46db9ef95dc406cbc34b907be7a1b03887ca5e69faf912","observation_id":"9252b662-3bce-4a33-b020-cdf5d0e2d9cf","resolution":{"observed_at":"2026-08-16T04:34:34.292579Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-16T14:36:14.029419Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-16T04:34:34.296596Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024 b","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.296596Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:484e9c94cd0998845c041aee8c5328450c0961e8784b97fe37654d66bb1701bd","observation_id":"80a0dc0b-8f2e-43e9-9603-5a92ea86eda5","resolution":{"observed_at":"2026-08-16T04:34:34.296596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1611.02770","last_updated":"2017-02-07T14:24:44Z","snapshot_observed_at":"2026-08-18T17:48:45.518915Z","submitted_at":"2016-11-08T23:25:00Z","title":"Delving into Transferable Adversarial Examples and Black-box Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1611.02770","snapshot_observed_at":"2026-08-16T04:34:34.300807Z","title":"Delving into transferable adversarial examples and black-box attacks","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.300807Z"},"links":{"cited_paper":"/paper/1611.02770","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:9ae409c7d9fd5612fa9d1b4f25b6342303e960e80de6c7876ca6c6cb076235a2","observation_id":"481d7042-6bb0-4912-8d02-81dac63c5978","resolution":{"observed_at":"2026-08-16T04:34:34.300807Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.086013Z","title":"Patchdropout: Economizing vision transformers using patch dropout","venue":null,"work_id":"21eaa8b1-c0b8-4ebb-a64a-d2f128ab994f","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.304830Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:fa2eb0ee0f9590e09f33695318a0b9001aec9f6b69368d528147fd26af237274","observation_id":"27af11fa-8c4d-498b-811b-0c7b81a84cdd","resolution":{"observed_at":"2026-08-16T04:34:35.089645Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.12931","last_updated":"2024-04-30T21:35:53Z","snapshot_observed_at":"2026-08-02T10:40:03.816188Z","submitted_at":"2023-10-19T17:31:01Z","title":"Eureka: Human-Level Reward Design via Coding Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.12931","snapshot_observed_at":"2026-08-16T04:34:34.309778Z","title":"Eureka: Human-level reward design via coding large language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.309778Z"},"links":{"cited_paper":"/paper/2310.12931","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:6ef6ef3db7889960e8362f838a2189669fba34dd41c08f82b2ae543c01565467","observation_id":"11573e70-cf04-4886-be86-0cdff54478d7","resolution":{"observed_at":"2026-08-16T04:34:34.309778Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00438","last_updated":"2023-12-01T09:10:33Z","snapshot_observed_at":"2026-08-19T15:16:18.882142Z","submitted_at":"2023-12-01T09:10:33Z","title":"Dolphins: Multimodal Language Model for Driving","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00438","snapshot_observed_at":"2026-08-16T04:34:34.313636Z","title":"Dolphins: Multimodal language model for driving","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.313636Z"},"links":{"cited_paper":"/paper/2312.00438","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:eae07968930374d7ab5e478df47c1f1bf7cc209b8063eb0b58aec0681becc3e8","observation_id":"68622cfc-ae15-4c87-9263-e6bd30a6981e","resolution":{"observed_at":"2026-08-16T04:34:34.313636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1706.06083","last_updated":"2019-09-04T18:53:10Z","snapshot_observed_at":"2026-08-07T14:27:46.872660Z","submitted_at":"2017-06-19T17:53:11Z","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1706.06083","snapshot_observed_at":"2026-08-16T04:34:34.317179Z","title":"Towards deep learning models resistant to adversarial attacks","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.317179Z"},"links":{"cited_paper":"/paper/1706.06083","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7cc7fd4af764ba845295ab9955aa58d4a9fc9abff1ca9f33220cd06814d66a28","observation_id":"d49c94cf-a37c-4eab-ad42-605e4f34c7d5","resolution":{"observed_at":"2026-08-16T04:34:34.317179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.07016","last_updated":"2023-04-21T17:08:27Z","snapshot_observed_at":"2026-08-16T16:08:49.584396Z","submitted_at":"2022-12-14T04:08:56Z","title":"Understanding Zero-Shot Adversarial Robustness for Large-Scale Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.07016","snapshot_observed_at":"2026-08-16T04:34:34.321269Z","title":"Understanding zero-shot adversarial robustness for large-scale models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.321269Z"},"links":{"cited_paper":"/paper/2212.07016","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f5331d25ac88ecef3268fb8be98881eaa6ca2266ee8886e0e98c2a486120b357","observation_id":"c25168d4-a740-44fa-afbd-38e34691dd90","resolution":{"observed_at":"2026-08-16T04:34:34.321269Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.324838Z","title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.324838Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:b07d540a378020202c428ba7eec811edd1399b0d0442875491243f354008f66e","observation_id":"aaac4266-6e2e-4a63-81a3-a2c5efbe9873","resolution":{"observed_at":"2026-08-16T04:34:34.324838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.17035","last_updated":"2023-11-28T18:47:03Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-11-28T18:47:03Z","title":"Scalable Extraction of Training Data from (Production) Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.17035","snapshot_observed_at":"2026-08-16T04:34:34.328770Z","title":"Scalable extraction of training data from (production) language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.328770Z"},"links":{"cited_paper":"/paper/2311.17035","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:49b5446244b27435994a9446192745493c2134bb88b3b7f2ec22657afacdc2c7","observation_id":"e690f6c5-0185-41da-a841-e90c7a6c9afc","resolution":{"observed_at":"2026-08-16T04:34:34.328770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.068525Z","title":"Jailbreaking attack against multimodal large language model, 2024","venue":null,"work_id":"cf446817-4ab2-4c29-9371-5068cc5ee5eb","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.332699Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:51a6573bca01b991fafa6a2a4ab55f313631127754dff6df158354c5d7b3c74a","observation_id":"fbc5b27a-69e5-4e4a-8941-14352182ff0f","resolution":{"observed_at":"2026-08-16T04:34:35.072486Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2103.10480","last_updated":"2021-03-18T18:56:51Z","snapshot_observed_at":"2026-08-19T15:16:24.701828Z","submitted_at":"2021-03-18T18:56:51Z","title":"Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neurons","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2103.10480","snapshot_observed_at":"2026-08-16T04:34:34.336232Z","title":"Noever and Samantha E","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.336232Z"},"links":{"cited_paper":"/paper/2103.10480","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:155ceb4e6d01f51104f5ce29f615d14f640a3bfb3ad13dd52c79caf7c3e1c5ad","observation_id":"6e009c27-e2dd-4a1a-b694-386043d21d7a","resolution":{"observed_at":"2026-08-16T04:34:34.336232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.057449Z","title":"Gpt-4v(ision) system card","venue":null,"work_id":"6b0eb00d-545a-45df-b555-50363c921400","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.340244Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:fe2678387065b694105a616901ee3cce404b6331e91a51ca959bea686d391e6a","observation_id":"397a5291-2ca0-459b-b322-721411ef9bf7","resolution":{"observed_at":"2026-08-16T04:34:35.061079Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.07193","last_updated":"2024-02-02T10:24:09Z","snapshot_observed_at":"2026-08-17T13:03:40.359628Z","submitted_at":"2023-04-14T15:12:19Z","title":"DINOv2: Learning Robust Visual Features without Supervision","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.07193","snapshot_observed_at":"2026-08-16T04:34:34.343572Z","title":"Dinov2: Learning robust visual features without supervision","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.343572Z"},"links":{"cited_paper":"/paper/2304.07193","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:01f20e4ccdaa759a4935506a0defaa915940746c41a7c1a9085994386c8e98da","observation_id":"e452ad34-7705-449e-8ce0-ad8e39aecbe7","resolution":{"observed_at":"2026-08-16T04:34:34.343572Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.347345Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.347345Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:c7c44e2200dd90a09c717f5a00828818ed32c49207a4e2dfd0a5548897ca04a8","observation_id":"31917675-06f1-4ff2-a576-5f522215132b","resolution":{"observed_at":"2026-08-16T04:34:34.347345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1605.07277","last_updated":"2016-05-24T03:27:48Z","snapshot_observed_at":"2026-08-19T02:49:49.891766Z","submitted_at":"2016-05-24T03:27:48Z","title":"Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1605.07277","snapshot_observed_at":"2026-08-16T04:34:34.351555Z","title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.351555Z"},"links":{"cited_paper":"/paper/1605.07277","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7b4e6b1cf8394960edba4cf6be5f89c36c802b0eede5301904b785788f936c91","observation_id":"d3b099a6-3c9b-46a5-95f6-3d137a42650a","resolution":{"observed_at":"2026-08-16T04:34:34.351555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-08-15T19:46:54.909325Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-16T04:34:34.355320Z","title":"Red teaming language models with language models, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.355320Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:884effba78f57c9b894c4c9e623249a2be7828b165f0e773a22541fd14540af6","observation_id":"7294eb77-a106-4f77-961d-072e8f5abf85","resolution":{"observed_at":"2026-08-16T04:34:34.355320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.13213","last_updated":"2023-08-16T22:38:55Z","snapshot_observed_at":"2026-08-16T15:21:48.065276Z","submitted_at":"2023-06-22T22:13:03Z","title":"Visual Adversarial Examples Jailbreak Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.13213","snapshot_observed_at":"2026-08-16T04:34:34.359095Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.359095Z"},"links":{"cited_paper":"/paper/2306.13213","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:c6b912c6b44d1b9779d39bf0ccff0d0682a82d7d9df465abc8c390bbc94c1cf1","observation_id":"11478142-a000-4211-a3b5-edf8ed4033c9","resolution":{"observed_at":"2026-08-16T04:34:34.359095Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.040793Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":"486de758-9727-4637-bd1e-e81086492e49","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.362562Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ef6896a5b0ef452324bac8bee4157a3c99ffca9a85d171853a69f1f07fd9b586","observation_id":"9ddc675e-172b-404b-95bb-de48503a1681","resolution":{"observed_at":"2026-08-16T04:34:35.044476Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.365888Z","title":"Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.365888Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d1fa308f7f1455776b54d852da00b492a46e156a9521f3ae44b893ae0c5de7c6","observation_id":"0d2ef145-9649-4d72-a572-8f2af5b54c4a","resolution":{"observed_at":"2026-08-16T04:34:34.365888Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.023849Z","title":"Differentiable jpeg: The devil is in the details","venue":null,"work_id":"731c1cc9-5f6a-4e00-b2dd-a3c5b8b604a7","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.369398Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:aef3380be5a8d2485530417384a696b1c7ec79fe6c95f9c79a9d15f7781ed9df","observation_id":"d88ab7dc-704e-43c5-aa28-716ad2bb366d","resolution":{"observed_at":"2026-08-16T04:34:35.027475Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05530","last_updated":"2024-12-16T17:39:39Z","snapshot_observed_at":"2026-08-14T18:15:53.516440Z","submitted_at":"2024-03-08T18:54:20Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05530","snapshot_observed_at":"2026-08-16T04:34:34.372863Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.372863Z"},"links":{"cited_paper":"/paper/2403.05530","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:891524314600e0eeab274b39c829c13862eb3b69e9b45799208cc162a86c14d1","observation_id":"f9f122a6-6ec2-4f5c-a5e3-0f689f4716c7","resolution":{"observed_at":"2026-08-16T04:34:34.372863Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-08-17T15:25:03.596568Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-16T04:34:34.376170Z","title":"Smoothllm: Defending large language models against jailbreaking attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.376170Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:809faa50ae90649331a7fe2737556e2f004814b025b5abd324d849f8c079fb5c","observation_id":"97df4209-91f5-40e2-9329-a443e7ea1f3c","resolution":{"observed_at":"2026-08-16T04:34:34.376170Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01833","last_updated":"2025-02-26T13:41:41Z","snapshot_observed_at":"2026-08-13T05:33:18.631487Z","submitted_at":"2024-04-02T10:45:49Z","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01833","snapshot_observed_at":"2026-08-16T04:34:34.379800Z","title":"Great, now write an article about that: The crescendo multi-turn llm jailbreak attack","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.379800Z"},"links":{"cited_paper":"/paper/2404.01833","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ac01294a86fb0d3fcbc18b6c26db95e87e2b0c1b33a0bec10c7b54549783d622","observation_id":"3a2f6f71-4c12-4d2e-a8fe-04fb90316f91","resolution":{"observed_at":"2026-08-16T04:34:34.379800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.012910Z","title":"On the adversarial robustness of multi-modal foundation models, 2023","venue":null,"work_id":"c3be60f6-ce51-418d-bcdf-f41452463b54","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.383530Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:19a3d46ae9b8c33f3cc0298ec0ecaf8102e28d145978d7f98421b24cdd773684","observation_id":"ca1f1b1f-c6fe-44f6-830f-d534fcc3d422","resolution":{"observed_at":"2026-08-16T04:34:35.016635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2010.15980","last_updated":"2020-11-07T05:33:35Z","snapshot_observed_at":"2026-08-16T19:09:26.533311Z","submitted_at":"2020-10-29T22:54:00Z","title":"AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.15980","snapshot_observed_at":"2026-08-16T04:34:34.386874Z","title":"Logan IV au2, Eric Wallace, and Sameer Singh","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.386874Z"},"links":{"cited_paper":"/paper/2010.15980","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:e678809a4a0e40e8d1e1ee2baf82ee846edf8a9d6f0434f9d67e140d9346172a","observation_id":"cc0a9220-ecc6-4d3c-84af-29d5a1aa0ca9","resolution":{"observed_at":"2026-08-16T04:34:34.386874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.390469Z","title":"Large language models encode clinical knowledge","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.390469Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:6ac4a31c145536628b1a124b41cbb8139912ddf9ce6c9618899783f67e3eec23","observation_id":"f70b5db4-965e-4f5b-93bf-2b3238c6176b","resolution":{"observed_at":"2026-08-16T04:34:34.390469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.995587Z","title":"Intriguing properties of neural networks","venue":null,"work_id":"2f616a3a-cc7e-4672-b548-bf75a75dc74b","year":2014},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.393694Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:df8efed56058cb3b8c4b5e670cec3ffc1cf15d5884c1ea56de7d6bd3930ee131","observation_id":"b7aec58d-5757-46b4-b2d5-5739a65e39bd","resolution":{"observed_at":"2026-08-16T04:34:34.999340Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-08-16T04:34:34.402597Z","title":"Gemini: a family of highly capable multimodal models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.402597Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ca4bb707e930c62a7c8a72bc194080fccb576b4722c3c268bc3ab803aab55a05","observation_id":"59aac060-3960-4ca3-968c-105bd69d0e3c","resolution":{"observed_at":"2026-08-16T04:34:34.402597Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.984923Z","title":"Ocr receipts text detection - retail dataset","venue":null,"work_id":"249f4ca7-0082-42a3-8485-42ec1ae90a53","year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.406226Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:752db8fa676bbb957fb796a0ed79049cd8bef265b261366cd1355c8ec3147dc1","observation_id":"13566eb0-cbcb-4617-ba8a-27d344237974","resolution":{"observed_at":"2026-08-16T04:34:34.988698Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.974903Z","title":"Revisiting adversarial training at scale","venue":null,"work_id":"66b84faf-6ba1-4a47-9504-5da00e0b1967","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.409854Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0c2eaffd916c0ca285248b3ea45451b11082d2ba4098522190d6a393e259046f","observation_id":"be2e8e0e-1bd3-4924-bcb3-05519571c5a5","resolution":{"observed_at":"2026-08-16T04:34:34.978521Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.964261Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024 a","venue":null,"work_id":"e5a1d74b-8426-4b34-9ab0-9f8a158cda1c","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.413580Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a467425c06981f1ab41852fc3801389f728140f1300d27d6242044ce4df320fa","observation_id":"b044c04a-fc3d-4f0e-b9bc-62f58051a898","resolution":{"observed_at":"2026-08-16T04:34:34.967929Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.953671Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations, 2024 b","venue":null,"work_id":"8f30157e-c851-4c44-a880-a1319ab5b07e","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.417198Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:6827f16e2252cbff27765aa886ae836f1e420590ffac13a3f7240adb7fbd95b8","observation_id":"7244f837-b6ae-4d54-ad5c-8cb269bd01e9","resolution":{"observed_at":"2026-08-16T04:34:34.957335Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.421120Z","title":"Dissecting adversarial robustness of multimodal lm agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.421120Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:82000e99650f72f53fe6e2a45efc2ccd8cc730dc7744997c7999ef5576ec2b9c","observation_id":"a68d8c79-e523-4acf-bb1e-9ec3731ab0aa","resolution":{"observed_at":"2026-08-16T04:34:34.421120Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12814","last_updated":"2025-02-04T20:02:17Z","snapshot_observed_at":"2026-08-16T13:41:44.544093Z","submitted_at":"2024-06-18T17:32:48Z","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12814","snapshot_observed_at":"2026-08-16T04:34:34.424911Z","title":"Adversarial attacks on multimodal agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.424911Z"},"links":{"cited_paper":"/paper/2406.12814","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:eadaa395a9464ed780120b1c7b8ce04cf1fbd746cd017377a198f2a0629507d9","observation_id":"670d1895-d82d-4dfd-a0fc-fe322807d972","resolution":{"observed_at":"2026-08-16T04:34:34.424911Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-19T01:12:30.856436Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"cited_work":{"arxiv_id":"2411.15720","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.15720","snapshot_observed_at":"2026-08-16T04:34:34.547389Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","venue":"cs.CV","work_id":"c93348b0-2e25-4c99-abdc-852f28035124","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.429357Z"},"links":{"cited_paper":"/paper/2411.15720","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:1fe6a1600dcb4ea93afed3d7988d9ee8e04a8d1b959b3720d05e46e6fdfe3a2d","observation_id":"8098073a-5b68-454e-a740-3086ae4f2dad","resolution":{"observed_at":"2026-08-16T04:34:34.553216Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.936624Z","title":"Demystifying clip data","venue":null,"work_id":"3422f698-2a04-4e6d-b5de-8d20d0b7e673","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.433526Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:8f31b3cbe782b11e0361e4668b545d47c55d10f03d621ef49a7faf1bfd751589","observation_id":"72383db9-b1d3-45d9-9f47-65aa2151b5b3","resolution":{"observed_at":"2026-08-16T04:34:34.940263Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.15793","last_updated":"2024-11-11T20:01:15Z","snapshot_observed_at":"2026-07-06T18:19:29.996982Z","submitted_at":"2024-05-06T17:41:33Z","title":"SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.15793","snapshot_observed_at":"2026-08-16T04:34:34.437510Z","title":"Swe-agent: Agent-computer interfaces enable automated software engineering","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.437510Z"},"links":{"cited_paper":"/paper/2405.15793","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:983a4f7958db0519f3074652f38525da1ba2a809c520976641d0b6db469b4028","observation_id":"b746b0da-fa34-4596-8b86-df187c1e06ed","resolution":{"observed_at":"2026-08-16T04:34:34.437510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.925924Z","title":"Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models","venue":null,"work_id":"ee873b89-743b-423b-a979-02f86c588183","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.441258Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:83cc481daad305c0a7fff37b4aab70b8adbfbd157024d5fc4e4f5cd42c74538b","observation_id":"5bf8fc7b-d59a-4b8b-b7b6-9e4dc660a90e","resolution":{"observed_at":"2026-08-16T04:34:34.929583Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.15343","last_updated":"2023-09-27T12:05:41Z","snapshot_observed_at":"2026-07-06T15:08:30.190912Z","submitted_at":"2023-03-27T15:53:01Z","title":"Sigmoid Loss for Language Image Pre-Training","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.15343","snapshot_observed_at":"2026-08-16T04:34:34.445195Z","title":"Sigmoid loss for language image pre-training","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.445195Z"},"links":{"cited_paper":"/paper/2303.15343","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a6fb8cc1b249ddf24f5ac6879fb66e9bab4e2085bc5c65fee1495eb20e221991","observation_id":"9c16cce2-a0f2-4c45-97da-395ce6ca2154","resolution":{"observed_at":"2026-08-16T04:34:34.445195Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.914909Z","title":"Towards adversarial attack on vision-language pre-training models","venue":null,"work_id":"35032945-18c2-404c-9a68-033cf2be8602","year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.449121Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7f984becde4c976405bf00e3ccd0da24e440169e4075b5887d9d2957072981b6","observation_id":"a43b2de4-395d-4954-ab51-ac79f180d4f1","resolution":{"observed_at":"2026-08-16T04:34:34.918793Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.05346","last_updated":"2025-03-28T02:55:23Z","snapshot_observed_at":"2026-08-19T15:16:25.421117Z","submitted_at":"2024-10-07T09:45:18Z","title":"AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.05346","snapshot_observed_at":"2026-08-16T04:34:34.452461Z","title":"Anyattack: Towards large-scale self-supervised generation of targeted adversarial examples for vision-language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.452461Z"},"links":{"cited_paper":"/paper/2410.05346","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:29a910ee307bd14b31265ec0df93d0d469907c3e812c6e007ebaee151613b461","observation_id":"54dc0068-a54c-4b26-b7f1-045634ffd54f","resolution":{"observed_at":"2026-08-16T04:34:34.452461Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.903868Z","title":"On evaluating adversarial robustness of large vision-language models, 2023","venue":null,"work_id":"0d715e5e-b217-41b2-8d80-9033d4c64116","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.456215Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:bb53407ed344718bd8e783b04f02da7db5385b4dde6a0b10ee2ede16e2e13d11","observation_id":"92dcd7cd-5107-40ce-b3eb-8bff966a0f68","resolution":{"observed_at":"2026-08-16T04:34:34.907765Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-19T06:32:44.657259+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.10592","last_updated":"2023-10-02T16:38:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-04-20T18:25:35Z","title":"MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.10592","snapshot_observed_at":"2026-08-16T04:34:34.459651Z","title":"Minigpt-4: Enhancing vision-language understanding with advanced large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.459651Z"},"links":{"cited_paper":"/paper/2304.10592","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:871100591e542a59dffd58f0a39fc083f201915013293e66af3be59d746a2d94","observation_id":"0b7d4655-e1a3-445b-a6f2-bbaf08593a3a","resolution":{"observed_at":"2026-08-16T04:34:34.459651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.463162Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.463162Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:cccdee6e04877ff1acbb5ab9b7c480db8cb32652e2d1f0e1e7c740d7dff46ed8","observation_id":"ba8479a5-2b5a-49b7-9c2f-3f3480a5ea99","resolution":{"observed_at":"2026-08-16T04:34:34.463162Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04313","last_updated":"2024-07-12T16:51:07Z","snapshot_observed_at":"2026-08-19T15:15:09.617421Z","submitted_at":"2024-06-06T17:57:04Z","title":"Improving Alignment and Robustness with Circuit Breakers","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04313","snapshot_observed_at":"2026-08-16T04:34:34.466875Z","title":"Improving alignment and robustness with circuit breakers, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.466875Z"},"links":{"cited_paper":"/paper/2406.04313","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:9e9612052b52071111811d3471c0e7168359caefca0dd12b7153ebbf8f620f8c","observation_id":"321b9f85-1b30-480c-aa8d-879559e90024","resolution":{"observed_at":"2026-08-16T04:34:34.466875Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","latest_version":1,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-19T15:15:20.401413Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models"},"reference_resolution":{"displayed":83,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":57,"verified_exact":1,"verified_fuzzy":25},"total_outbound_references":83},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"thesis":"As of 19 August 2026, this Paper Citation Record lists 83 of 83 outbound references and 9 inbound Pith citation observations for arXiv:2505.01050."}