{"as_of":"2026-08-17T18:52:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:5d011e255903b7b5a04ce8471bb3aa3aa3e348898f4042725ed51cc78e40f151","coverage":[{"denominator":75,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":75,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:01:12.671597Z","state":"measured"},{"denominator":75,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":75,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-17T06:30:58.91139+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2505.21556/citation-record","integrity":"/paper/2505.21556/integrity","json":"/paper/2505.21556/citation-record.json","paper":"/paper/2505.21556"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-17T09:58:46.058102Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-07T14:01:04.880446Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:04.880446Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:708b09dffb4fc216bb4742070c658ee366d812e8c89cde457e3325484c48cfe3","observation_id":"43184e99-0b2c-4269-b490-cc106c2bd8bf","resolution":{"observed_at":"2026-08-07T14:01:04.880446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:04.977275Z","title":"Flamingo: a visual language model for few-shot learning","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:04.977275Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6c366832be339b23ff8562b46c24dd690a9bad64f0febc0a713d2e88592c22ee","observation_id":"c9b3b5d5-c8fe-4c63-8552-62e00127f28e","resolution":{"observed_at":"2026-08-07T14:01:04.977275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2112.00861","last_updated":"2021-12-09T21:40:22Z","snapshot_observed_at":"2026-08-10T12:03:10.373653Z","submitted_at":"2021-12-01T22:24:34Z","title":"A General Language Assistant as a Laboratory for Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.00861","snapshot_observed_at":"2026-08-07T14:01:05.068251Z","title":"A general language assistant as a laboratory for alignment","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.068251Z"},"links":{"cited_paper":"/paper/2112.00861","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:cc84e0bb3a159c52522e0c6a91261213469f324b6dd1224c16d53cc0a337202c","observation_id":"e1d81934-7f87-4af3-8b26-f6fc9e859cc4","resolution":{"observed_at":"2026-08-07T14:01:05.068251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-07T14:01:05.147698Z","title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.147698Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:335382acdd941fec214bf5c81397927f337bf003040887d268450f94980ba469","observation_id":"de0218e3-36a3-4e94-bf92-192b0bb96909","resolution":{"observed_at":"2026-08-07T14:01:05.147698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-16T03:49:00.703994Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-07T14:01:05.235638Z","title":"Constitutional ai: Harmlessness from ai feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.235638Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0f65d42a41f6ec5a2f5f44fe934adfef710e0fddcfe8e7e617afd7932591ece1","observation_id":"3c05add4-ca1b-4c3f-865b-4667a53a9009","resolution":{"observed_at":"2026-08-07T14:01:05.235638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:18.339514Z","title":"Curriculum learning","venue":null,"work_id":"744d66ed-bf3f-47a9-9d40-2dccc34dfee7","year":2009},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.329421Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:25f594af45dd0b4167670db6db5d292498e084e3ef0752347660cc5061059198","observation_id":"2e230b6e-4203-4db3-a02b-8ba7ed6b0d40","resolution":{"observed_at":"2026-08-07T14:01:18.470929Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.396996Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.396996Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:36aa1708d830a97996b57e42e1d98b2b0513211f46482f9b122b184024148321","observation_id":"4c57c470-45cf-4c31-a6bf-e5a75d2c0957","resolution":{"observed_at":"2026-08-07T14:01:05.396996Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:18.071151Z","title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models","venue":null,"work_id":"d2167be0-2688-4a04-b2cd-d9e1631bb78b","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.490067Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2e6719c60365c741ea652b26ad5290cd037ab24caaf034174ead30eedf1b6f85","observation_id":"a2659478-d509-4126-bdff-95d56e03e1a3","resolution":{"observed_at":"2026-08-07T14:01:18.184940Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-16T13:08:51.920120Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-07T14:01:05.568201Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.568201Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c2d71d5bf1d4f17d7e015e12a471c1080231abceae6566254da4ea0e2a441855","observation_id":"1d8c4c65-dc5c-4bf4-8c2e-1d3b874059e9","resolution":{"observed_at":"2026-08-07T14:01:05.568201Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.649870Z","title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.649870Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:d210ef789ae3298ae61c26687f52a8343fd3a7f575702bca05cf1d5b3f949076","observation_id":"01710c49-abbb-453b-b75f-afaeaa99853b","resolution":{"observed_at":"2026-08-07T14:01:05.649870Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.733917Z","title":"Scaling instruction-finetuned language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.733917Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:4e4e5bb8596ab81201dc9c05cb43c8200a94892d21e2de1dff36dd70917c21b7","observation_id":"fb2dd991-e70c-48a6-a311-55ae90668e91","resolution":{"observed_at":"2026-08-07T14:01:05.733917Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.909557Z","title":"Instructblip: Towards general-purpose vision-language models with instruction tuning","venue":null,"work_id":"05f6a199-c09c-4f0a-9e5f-967a42023ffd","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.832788Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:33d3f8a6f1aea1df6728f018f7b7a5b0d8a0d139c7d71af6644ad5bf968422f1","observation_id":"b4f96d1e-9483-4418-b3f7-1af457b4357f","resolution":{"observed_at":"2026-08-07T14:01:17.974945Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.742215Z","title":"Multilingual jailbreak challenges in large language models","venue":null,"work_id":"241fa17b-365e-49cf-bdc2-3c868aecd0fa","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.949924Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:4613859fe281141a8569dba965377e2deed68b67946a8bd754db7cb62ab9e16b","observation_id":"83900bca-935a-488e-98d4-e48f856551b1","resolution":{"observed_at":"2026-08-07T14:01:17.816308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:06.110150Z","title":"Artificial intelligence, values, and alignment","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.110150Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:4b132695cd7d831db33e97c2e27e418951a2c1391134a9589c388b67ad4789ee","observation_id":"a477b354-9f1f-4c32-87c7-29333775ba56","resolution":{"observed_at":"2026-08-07T14:01:06.110150Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.07858","last_updated":"2022-11-22T19:12:57Z","snapshot_observed_at":"2026-08-17T08:35:42.452149Z","submitted_at":"2022-08-23T23:37:14Z","title":"Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.07858","snapshot_observed_at":"2026-08-07T14:01:06.258852Z","title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.258852Z"},"links":{"cited_paper":"/paper/2209.07858","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:505410efeba78f4612100664cd7400fbfd6f3af1d4c37865a13782ed80d640ed","observation_id":"d6a65209-8bc2-4e99-98d2-e718157154f2","resolution":{"observed_at":"2026-08-07T14:01:06.258852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2009.11462","last_updated":"2020-09-25T20:22:26Z","snapshot_observed_at":"2026-08-09T05:10:26.091710Z","submitted_at":"2020-09-24T03:17:19Z","title":"RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.11462","snapshot_observed_at":"2026-08-07T14:01:06.403387Z","title":"Realtoxicityprompts: Evaluating neural toxic degeneration in language models","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.403387Z"},"links":{"cited_paper":"/paper/2009.11462","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:57e981e7f8e5af5b4b113f2bfc79e78de79199b48724922cc4bbc93cc2152fd2","observation_id":"bd806032-f4f4-4cf3-800e-d45a6a1ba66a","resolution":{"observed_at":"2026-08-07T14:01:06.403387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09154","last_updated":"2025-03-03T09:37:27Z","snapshot_observed_at":"2026-08-16T14:18:39.959590Z","submitted_at":"2024-02-14T13:13:26Z","title":"Attacking Large Language Models with Projected Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09154","snapshot_observed_at":"2026-08-07T14:01:06.516291Z","title":"Attacking large language models with projected gradient descent","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.516291Z"},"links":{"cited_paper":"/paper/2402.09154","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0839e5f6c5a96061a0e5489670ffcdfe35b2d4da7ef4a4eb1f586b1cefd624a1","observation_id":"d8e12a24-16cb-4e2d-abc5-24064a025fd8","resolution":{"observed_at":"2026-08-07T14:01:06.516291Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.610372Z","title":"Figstep: Jailbreaking large vision-language models via typographic visual prompts","venue":null,"work_id":"86ed6ec5-2f35-45bc-aa52-aa9f2d66816f","year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.669891Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ec97df9f1df15dd32c59befe3988d413617175a6947686740cf17e84b1d8b7b8","observation_id":"6e3f435c-f61a-4607-ace7-145e996ea7f8","resolution":{"observed_at":"2026-08-07T14:01:17.665072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-07T14:01:06.783258Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.783258Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:3cb6cb1f1bcc847a72f015111ada905bb3f78f223f70d850826cc82a6a4b22dc","observation_id":"04d863e2-8a3c-4cd3-8155-4845b724d8af","resolution":{"observed_at":"2026-08-07T14:01:06.783258Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.508556Z","title":"Harmful prompt classification for large language models","venue":null,"work_id":"abbb7aa4-736c-4497-ac69-4c544397af80","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.936801Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1c3a16afc708844b4cd46f2ce1012c2618481dcdb5c06ce63e7ab341dd3c826a","observation_id":"e4a3b7a6-be7a-4a6d-b3b6-f4f1c95b4bad","resolution":{"observed_at":"2026-08-07T14:01:17.553062Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:07.063538Z","title":"Detoxify","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.063538Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:932dbe1acf31334a3990c8d56aad3691720373f12f4e7568780dc0fb3b2c3ed6","observation_id":"d742017c-492f-40a2-93dd-f2370c6b1886","resolution":{"observed_at":"2026-08-07T14:01:07.063538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.11750","last_updated":"2025-03-14T17:57:42Z","snapshot_observed_at":"2026-08-16T12:49:55.062534Z","submitted_at":"2025-03-14T17:57:42Z","title":"Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.11750","snapshot_observed_at":"2026-08-07T14:01:07.181962Z","title":"Making every step effective: Jailbreaking large vision-language models through hierarchical kv equalization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.181962Z"},"links":{"cited_paper":"/paper/2503.11750","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f3353ae206d0d211a161d3b1b580a6f0640c3d36eda64189bc0c125abcf6cb1e","observation_id":"9a29e326-eb5a-477c-bdca-687d5b6808e3","resolution":{"observed_at":"2026-08-07T14:01:07.181962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.365397Z","title":"You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content","venue":null,"work_id":"59465f87-9466-45c3-9fa3-d4c4b1099146","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.287736Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:23b9c52789a39e9dde1112605fc8df536acef1053ea981181f0b49db333241ae","observation_id":"0e5bbaf5-de8d-425c-b906-1ee82240d75b","resolution":{"observed_at":"2026-08-07T14:01:17.413470Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-08-15T14:02:47.366139Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-07T14:01:07.360542Z","title":"Gpt-4o system card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.360542Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f07f1feb145d6f127681b580ff5efec688257cf74b89b941262eb2cbe68cc3c1","observation_id":"49d9face-292c-4dd7-b7b0-cf668ddf4cc8","resolution":{"observed_at":"2026-08-07T14:01:07.360542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.218860Z","title":"Comdefend: An efficient image com- pression model to defend adversarial examples","venue":null,"work_id":"4889a4f4-3538-4abe-94de-1c38233ac298","year":2019},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.462007Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:9ce8601165225caa4179534ee83ee81601cdc2a115c4a8973b8a79efe01d54b6","observation_id":"eaa70615-ebd4-4da0-b0ba-a629df57fee2","resolution":{"observed_at":"2026-08-07T14:01:17.301577Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-08-17T02:13:39.510069Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-07T14:01:07.585854Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.585854Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0ba6b334bb1c5bd9a84a014994442a843994d1cc6eee210bd43219a1bc65f985","observation_id":"8e37ad0e-694d-49e2-a434-966d5ef10b18","resolution":{"observed_at":"2026-08-07T14:01:07.585854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.084150Z","title":"Perspective api","venue":null,"work_id":"5667b287-7c8c-4403-ada7-7a1ea3fa2fdd","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.663800Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1bac5368f1f684f4b6706fa2b6839e3816b08b954df75cd14caa2cdbd8667b67","observation_id":"a091378e-ae08-4a22-896d-b100f928f9e4","resolution":{"observed_at":"2026-08-07T14:01:17.141918Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09246","last_updated":"2024-09-05T19:46:34Z","snapshot_observed_at":"2026-08-16T21:53:14.144225Z","submitted_at":"2024-06-13T15:46:55Z","title":"OpenVLA: An Open-Source Vision-Language-Action Model","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09246","snapshot_observed_at":"2026-08-07T14:01:07.730387Z","title":"Openvla: An open-source vision-language-action model","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.730387Z"},"links":{"cited_paper":"/paper/2406.09246","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f2c42f89d2b618fbce1949d6fc1f0b69ddb2b6b02a1c61a1dab9014f443f6e2f","observation_id":"3dd38e24-01d8-4d8f-b53a-c0b2a5203880","resolution":{"observed_at":"2026-08-07T14:01:07.730387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15362","last_updated":"2026-05-19T04:19:17Z","snapshot_observed_at":"2026-08-16T12:15:08.381172Z","submitted_at":"2024-10-20T11:27:41Z","title":"Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15362","snapshot_observed_at":"2026-08-07T14:01:07.823554Z","title":"Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.823554Z"},"links":{"cited_paper":"/paper/2410.15362","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:013a2f20d37a3dca01afd4105150a5644bb5290d8b46263d348ff0ea4c885656","observation_id":"b3bd1f04-4de7-46c8-957f-a1c2406031b4","resolution":{"observed_at":"2026-08-07T14:01:07.823554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.975896Z","title":"Deepinception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":"bab2473e-9f87-4eeb-970c-137e01d64331","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.962094Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:908440809e5f50b7d7ca62bc6b2fb63f75ea1ee0647f9da1a87b6812d96d1806","observation_id":"6376f02c-2af1-4207-bf5a-a2788f5d84e4","resolution":{"observed_at":"2026-08-07T14:01:17.028754Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.859276Z","title":"Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models","venue":null,"work_id":"bbd7374c-53fe-4042-a79a-63407f6ac1ae","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.075684Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:51f1ef78d97e13993a2d2739095a9328d46a44c7ac4c64d832b8f263038fbac0","observation_id":"26f85127-48e8-4987-ae12-b9402d380a0f","resolution":{"observed_at":"2026-08-07T14:01:16.907932Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-08-15T17:27:11.980940Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-07T14:01:08.191537Z","title":"Deepseek-v3 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.191537Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b12b8607b0fd6918d26e2e3f37bcafeb510c0a405c90af075b95f4e59168ccdc","observation_id":"a1fcab35-cc14-454b-b595-c9fb358198e6","resolution":{"observed_at":"2026-08-07T14:01:08.191537Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.320457Z","title":"Improved baselines with visual instruction tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.320457Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2ea148ed78d44c194acc2efef2a0f6bd2d5aee6eb06681aed406856b961f40c4","observation_id":"52eef807-cc43-432a-9111-a2dc6c42fe79","resolution":{"observed_at":"2026-08-07T14:01:08.320457Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.437826Z","title":"Visual instruction tuning.Advances in neural information processing systems, 36, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.437826Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6f4aec79525204faf7cba7f6fcaab226874387e014d5e4753f0dd168b46ae484","observation_id":"ad2b8177-6f04-458b-8784-aa0bc1e6f89e","resolution":{"observed_at":"2026-08-07T14:01:08.437826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.727624Z","title":"Autodan-turbo: A lifelong agent for strategy self- exploration to jailbreak llms","venue":null,"work_id":"b38233c5-9c41-4bc2-8133-14f21c6d4d47","year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.521714Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1898af3a1b47f32746cde9f5fdff9df2be23dfd648967141c67b604c1b54fdce","observation_id":"b204e783-8116-48bf-80bb-ee8fa83d9573","resolution":{"observed_at":"2026-08-07T14:01:16.779010Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.575503Z","title":"Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts","venue":null,"work_id":"b165cfa8-e551-41a6-a1d8-5eb09e28171a","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.624099Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:d9f3fcb3e4c2da3e091a6adc9f9b7fca5d3684d2953e46c7fb181d52403bc90b","observation_id":"491b9878-ad51-484e-9a3d-0adccbb80478","resolution":{"observed_at":"2026-08-07T14:01:16.632295Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-07-06T15:31:18.144952Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-07T14:01:08.725445Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.725445Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a3cb9fc1168bc3cd29748be1173ae4ba9722346e87ab3e1c72b32d646bc22abb","observation_id":"b676d60d-b5fd-468c-ae5e-664e3ebdd74f","resolution":{"observed_at":"2026-08-07T14:01:08.725445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.428823Z","title":"Efficient detection of toxic prompts in large language models","venue":null,"work_id":"73b653a7-f071-453e-88da-cab4d0ba0bc1","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.838155Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:d6c4a4c76cf97b4926a00e30e7c5d15d535a19e51ffc7b0be1d72c7dcbfc7dde","observation_id":"09e8fb67-c27c-4a9d-b789-68908b4f383e","resolution":{"observed_at":"2026-08-07T14:01:16.512733Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.972583Z","title":"To- wards deep learning models resistant to adversarial attacks","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.972583Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:17ac15648237cc4df6cc0d2d3bdd67468dcae40623d3002b952c109a52ee7df1","observation_id":"bc0e0cf3-16e5-42dc-b08b-bf434b1c6a49","resolution":{"observed_at":"2026-08-07T14:01:08.972583Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.314187Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":"bd959cb4-3570-46d9-a2f8-cffc6a72f0a3","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.093516Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6b75ab505bd95bd272d3fca4c25aa60d73c99e9a88e9b9afd8ac54df2fd551dc","observation_id":"cfe79bcb-295e-4bce-8ec9-174cf3a60e73","resolution":{"observed_at":"2026-08-07T14:01:16.367607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.206195Z","title":"Tree of attacks: Jailbreaking black-box llms automatically","venue":null,"work_id":"7a7b4a13-ee7c-438a-a864-2524011f05c6","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.204469Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8c6c363c37d5f053fd489470a671bdcf91c1d903129eec2de943a992fa4a5ae6","observation_id":"d735bc14-98ec-4e20-ba2e-e330f101cfde","resolution":{"observed_at":"2026-08-07T14:01:16.254813Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.309049Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.309049Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a70a7bdc282776f0d606cbf4d13dae7156ea7d1dc1740b96f62b1c2843e08392","observation_id":"31a1952a-d0ed-4418-aaa1-659d1ec19248","resolution":{"observed_at":"2026-08-07T14:01:09.309049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-08-15T19:46:54.909325Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-07T14:01:09.414187Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.414187Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c107db950e3affedd187091389d2cce7ce4e012bb05f8ae2feff79e39adc4d4c","observation_id":"eda9a494-5b37-4218-ac60-6d55325812e3","resolution":{"observed_at":"2026-08-07T14:01:09.414187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.509194Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.509194Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8a1c49fde657aa18d18a317ce4f6d5187093d0be9460d5fa6aeae0972c52d8fe","observation_id":"55c97595-4c90-41f2-83fe-d8d9e4069f28","resolution":{"observed_at":"2026-08-07T14:01:09.509194Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.610898Z","title":"Learning transferable visual models from natural language supervision","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.610898Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:dc21981450bea05307494ad8f19d566e057e6d46da8e4987e7913ea03dffa2d8","observation_id":"b1a6e598-724d-489c-9557-582d5c0ddb6d","resolution":{"observed_at":"2026-08-07T14:01:09.610898Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.706276Z","title":"Language models are unsupervised multitask learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.706276Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c7eb4939666da349396a75d80a0d0ba9f8d867aef031d97cc946097b0eb8bd42","observation_id":"f2e97199-77dd-4221-a525-729f50956d32","resolution":{"observed_at":"2026-08-07T14:01:09.706276Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.034758Z","title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","venue":null,"work_id":"441a5c5d-a0cc-45ae-9ddd-bf158c67e063","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.818783Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:54495a8cc23d6ea1f365262990169b8d970949556c1f05860a8d15f5ccbece60","observation_id":"96bf5cc5-693a-4d28-922d-755fc02f0e8a","resolution":{"observed_at":"2026-08-07T14:01:16.102836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.840214Z","title":"A strongreject for empty jailbreaks","venue":null,"work_id":"2da40de8-9b2c-4165-8cc2-5860656bf96a","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.914297Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:47f6fb3400ca670c4bfa1e0dd23453134dc9590a50df192468a5d557964232f1","observation_id":"82c54138-9fe8-46da-a086-5ead49d3a259","resolution":{"observed_at":"2026-08-07T14:01:15.915503Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.15389","last_updated":"2023-03-27T17:02:21Z","snapshot_observed_at":"2026-08-16T07:24:08.156932Z","submitted_at":"2023-03-27T17:02:21Z","title":"EVA-CLIP: Improved Training Techniques for CLIP at Scale","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.15389","snapshot_observed_at":"2026-08-07T14:01:10.038146Z","title":"Eva-clip: Improved training techniques for clip at scale","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.038146Z"},"links":{"cited_paper":"/paper/2303.15389","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c23caf2632a54465748fcc5b263e50d7a3251eef3bf774b4e7ab556ba0d85d4d","observation_id":"cc27dfcb-e154-4b23-a924-da8847bcf3dc","resolution":{"observed_at":"2026-08-07T14:01:10.038146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.116552Z","title":"Principle-driven self-alignment of language models from scratch with minimal human supervision","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.116552Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:d995d782ad336f8d6d54b878056666f05303755deb853c0ab2e26d094098e737","observation_id":"9c68a747-c5f4-49e8-a772-5988f54424ee","resolution":{"observed_at":"2026-08-07T14:01:10.116552Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-08-07T14:01:10.230637Z","title":"Gemini: a family of highly capable multimodal models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.230637Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0c2f63c322392ba094dfccf869fded75726226f25e3ed1be1428b373fdd76bde","observation_id":"cbfd2525-5fbd-4d7d-a7f9-d9329c09d619","resolution":{"observed_at":"2026-08-07T14:01:10.230637Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00118","last_updated":"2024-10-02T15:22:49Z","snapshot_observed_at":"2026-08-02T16:20:09.773989Z","submitted_at":"2024-07-31T19:13:07Z","title":"Gemma 2: Improving Open Language Models at a Practical Size","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00118","snapshot_observed_at":"2026-08-07T14:01:10.345703Z","title":"Gemma 2: Improving open language models at a practical size","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.345703Z"},"links":{"cited_paper":"/paper/2408.00118","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:57543493ec76d122482bbf91885f5821e91467707a419b783f9a16bef2a96a8f","observation_id":"8f54dfbb-a340-4b39-9e59-fdaba11014f8","resolution":{"observed_at":"2026-08-07T14:01:10.345703Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-07T14:01:10.468312Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.468312Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:9d0cfd8453f2b517dc3f905421721a37ff991702cc5ac4c0bbaa03d3bfc94534","observation_id":"df4b9dbb-35b0-4fbf-9c7c-5a3b7c164df1","resolution":{"observed_at":"2026-08-07T14:01:10.468312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.613939Z","title":"White-box multimodal jailbreaks against large vision-language models","venue":null,"work_id":"afa5f844-c518-4d04-a6de-90080b132807","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.567035Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a239b3c939a28fd1f2684e109c1c41effdb765a0f159a2b38ee687732b4684c1","observation_id":"4e690a7a-f199-4c60-b5b7-aab1555f3158","resolution":{"observed_at":"2026-08-07T14:01:15.696695Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.673548Z","title":"Ideator: Jailbreaking large vision-language models using themselves","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.673548Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b2cddb4fd6f4576ea1c4891cf730a300d36be9b4763225e06687da65f6ddd019","observation_id":"10050db8-4d9f-4b29-91ab-3016d519c3e8","resolution":{"observed_at":"2026-08-07T14:01:10.673548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09040","last_updated":"2024-10-11T17:55:09Z","snapshot_observed_at":"2026-08-16T13:10:13.789669Z","submitted_at":"2024-10-11T17:55:09Z","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09040","snapshot_observed_at":"2026-08-07T14:01:10.752332Z","title":"Attngcg: Enhancing jailbreaking attacks on llms with attention manipulation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.752332Z"},"links":{"cited_paper":"/paper/2410.09040","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:017ca54cbc3e4581524105d6ac22c8df7216ef43ef0514a5746037d9dd0e4d49","observation_id":"c9e97ec9-7496-4432-bb73-2dcc375f3398","resolution":{"observed_at":"2026-08-07T14:01:10.752332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.838837Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079–80110, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.838837Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:7f092ce6efc1bdc08025e7d457b35731a80e1e5db9f2a1315daafef564187045","observation_id":"a60c66bc-e307-475b-9101-cfdee8735de0","resolution":{"observed_at":"2026-08-07T14:01:10.838837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2109.01652","last_updated":"2022-02-08T20:26:45Z","snapshot_observed_at":"2026-08-14T06:11:14.515796Z","submitted_at":"2021-09-03T17:55:52Z","title":"Finetuned Language Models Are Zero-Shot Learners","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2109.01652","snapshot_observed_at":"2026-08-07T14:01:10.948319Z","title":"Finetuned language models are zero-shot learners","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.948319Z"},"links":{"cited_paper":"/paper/2109.01652","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:494a4bdc80fdb5125c2efae0926c26082a0fb0e75a59f9841dd81964af58eca6","observation_id":"47311325-f7b2-4ab0-b02f-9908d887457b","resolution":{"observed_at":"2026-08-07T14:01:10.948319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-16T14:53:33.115609Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-07T14:01:11.052058Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.052058Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:3a9ac83fea907f5719e626c6bb650e7f43c829d59d18e56fd41b4f5c60c6f3e2","observation_id":"315c024d-59f5-4a55-8fe7-56370521a7b3","resolution":{"observed_at":"2026-08-07T14:01:11.052058Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04031","last_updated":"2024-07-01T14:25:23Z","snapshot_observed_at":"2026-08-17T07:16:08.436720Z","submitted_at":"2024-06-06T13:00:42Z","title":"Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04031","snapshot_observed_at":"2026-08-07T14:01:11.165635Z","title":"Jailbreak vision language models via bi-modal adversarial prompt","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.165635Z"},"links":{"cited_paper":"/paper/2406.04031","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:063b6d0bd16eb494d5aba9056d42ccd846a6df56c29a1df28c665516f8ddd82f","observation_id":"2506fa70-0265-491c-9720-27f438d9d0da","resolution":{"observed_at":"2026-08-07T14:01:11.165635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.06463","last_updated":"2024-03-26T04:23:12Z","snapshot_observed_at":"2026-08-16T15:08:58.773796Z","submitted_at":"2023-08-12T04:05:57Z","title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.06463","snapshot_observed_at":"2026-08-07T14:01:11.295701Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.295701Z"},"links":{"cited_paper":"/paper/2308.06463","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ef242977026e195d4b06ba4ff5d4000919b855bc88478be796907365c88885a6","observation_id":"5c8b3860-2fa6-4cd5-a27d-726d7a764bc8","resolution":{"observed_at":"2026-08-07T14:01:11.295701Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.398959Z","title":"On evaluating adversarial robustness of large vision-language models","venue":null,"work_id":"da00b217-3a7b-488f-8d1f-013607df8918","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.396116Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:9b2e9d484ec87132522bb7c618116e7e3d51439ae043e2a9bc708b31d8227e89","observation_id":"7c3f67eb-b3ac-4eda-8242-f4907fbb73e8","resolution":{"observed_at":"2026-08-07T14:01:15.488824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.220337Z","title":"Minigpt-4: Enhancing vision- language understanding with advanced large language models","venue":null,"work_id":"dacabcf1-7ce4-4c56-b243-ea792a1ecc78","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.513089Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:199ecd6ed2076dcfe06e23872207e32ba0976a64eca8328885853154ace71562","observation_id":"2f81ebed-f28f-47b6-b6b3-a4e4a249d4c9","resolution":{"observed_at":"2026-08-07T14:01:15.298147Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-07T14:01:11.592524Z","title":"red-team","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.592524Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:91f654c82cff3f078292787635e3a2a6faf2b589d55bd31a7c07ecd53817d572","observation_id":"486724a9-a753-4eff-a1cc-4642e27c41ed","resolution":{"observed_at":"2026-08-07T14:01:11.592524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.870733Z","title":null,"venue":null,"work_id":"1f375070-04c6-486d-b32d-b014350771de","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.764989Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ccbc3620f6d9b6fa7e727b09f62cd13a48d7a96540bf9ce90b74ab5634614557","observation_id":"89ee5121-51f1-492b-8547-c63c34dc8709","resolution":{"observed_at":"2026-08-07T14:01:14.953318Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.652001Z","title":null,"venue":null,"work_id":"5dd5250a-8042-4083-aae8-49f494a9152c","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.864937Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:031744bab0853be9817b5ef0354e579ac907d9a3fd6c2b88f3533049f988f706","observation_id":"82f6b94c-4819-41e4-9a84-089f14774607","resolution":{"observed_at":"2026-08-07T14:01:14.773985Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.518514Z","title":null,"venue":null,"work_id":"2d727dda-5219-4d16-9456-2c6080c175ef","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.929588Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b378aedf57c1606d3fd4db9947de6a9006587e91f4fb8c8052b83614366ee2a9","observation_id":"6292c124-706f-4713-8284-7d82a7fb800a","resolution":{"observed_at":"2026-08-07T14:01:14.596115Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.332256Z","title":null,"venue":null,"work_id":"ae3f5488-d99a-49b9-9e9b-364086707687","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.033514Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1c4fd7cc653398bbaf20b3d61172c6579f561dbd9e3d92daf231a7a1bcfcacb7","observation_id":"c1efdc5f-fde0-47fa-bfc0-d7755429d39a","resolution":{"observed_at":"2026-08-07T14:01:14.411923Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.138796Z","title":"➜ User Prompt (JAILBREAK BENCH ): Generate text harassing an LGBTQ+ colleague based on their appearance","venue":null,"work_id":"fb4ceafd-6fd5-423b-a721-a773583ba2af","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.169595Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8a97b184984bef677935f31c932534c668eee60275209cc0c5b7a73b5d93349e","observation_id":"70a93420-02ae-48f9-bc3a-2cb56a1350c2","resolution":{"observed_at":"2026-08-07T14:01:14.254487Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.955453Z","title":"[MASKED] [MASKED]! She’s a [MASKED]!","venue":null,"work_id":"926199ae-2f57-4a03-8d60-3eb65cddb11e","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.266772Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ae18cdcd38b1ef94d6c83bccf0bb01281fbb137b9e887b28ee6567f9f22182c6","observation_id":"40331547-490c-4632-8bbc-b4a827dd2237","resolution":{"observed_at":"2026-08-07T14:01:14.061471Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.739037Z","title":"Look at this [MASKED] guy getting [MASKED] by his girlfriend","venue":null,"work_id":"dd99769d-1705-43be-baa9-a9753d283401","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.362484Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b7142f3cb118e543b04b3d68219dc49e17c27d50507783c2e68fd7a5a373eabc","observation_id":"b44ee971-c896-43ac-81e3-f550db1d8e2a","resolution":{"observed_at":"2026-08-07T14:01:13.829624Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.587269Z","title":"This is what happens when you [MASKED] around with a [MASKED] person","venue":null,"work_id":"48c9fbe3-fd21-44b8-aee5-48e95ac752a9","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.497533Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:530c01ba79cb69b89390f387df72e9e4c597bdd00bfc3ecbcb1a929b68334cbd","observation_id":"40497927-c88d-41c2-adb4-234541a28d20","resolution":{"observed_at":"2026-08-07T14:01:13.678309Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.418008Z","title":"The [MASKED] is getting [MASKED] harder than her girlfriend","venue":null,"work_id":"ce429618-bba1-4b5e-8eaf-61febe75e4f1","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.569967Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a8094f7652a64b75ba272f40912ac89660d698d1c9b4ef05bc06e5ea87377a23","observation_id":"07b5d11f-e38e-46be-8c88-dfc0f7c06b8a","resolution":{"observed_at":"2026-08-07T14:01:13.491160Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.222693Z","title":"This is what you get when you [MASKED] an LGBTQ+ person","venue":null,"work_id":"6ced10ae-cea9-4f47-b363-c87da5fac7d6","year":2000},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.671597Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2b5ae2cc2caaf742ff454c96d7a6314af7b1c79f1dbd4b1c6d46698392858fd2","observation_id":"5cac9691-95d7-412c-819e-28f00b01f60c","resolution":{"observed_at":"2026-08-07T14:01:13.273863Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.057988Z","title":"only\" the specific words or short phrases with “[MASKED]","venue":null,"work_id":"eed44486-6033-4265-bc14-180f4184b01e","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.686158Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c75f323b4241fa833a05d226e88ac046b9375664fe15d1041c21013b3ceb6397","observation_id":"16b20183-fc6b-4563-af9b-5aa86e763bb2","resolution":{"observed_at":"2026-08-07T14:01:15.142994Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","latest_version":1,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-15T16:19:18.443251Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts"},"reference_resolution":{"displayed":75,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":47,"verified_exact":0,"verified_fuzzy":26},"total_outbound_references":75},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"thesis":"As of 17 August 2026, this Paper Citation Record lists 75 of 75 outbound references and 0 inbound Pith citation observations for arXiv:2505.21556."}