{"as_of":"2026-08-09T13:31:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:1ecf47a60d4cadb01e70bd791a3ba7d18294a4e4246a8ef556b34e68c7919c66","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T19:46:27.712204Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2507.04673/citation-record","integrity":"/paper/2507.04673/integrity","json":"/paper/2507.04673/citation-record.json","paper":"/paper/2507.04673"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:25.135856Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.135856Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:b84950f19312be83dfe31109d3bcd00676701b575c476f5849dd5c06714a9fe7","observation_id":"cbe1ae7c-e1cd-4754-b783-12ba81f019ae","resolution":{"observed_at":"2026-08-06T19:46:25.135856Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-07-06T16:45:24.070954Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-06T19:46:25.203611Z","title":"& Wang, X","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.203611Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:16e1f755bed61a0ef245e07958e0e927224356a8fa33b207d71bdd8f7855d6fa","observation_id":"68b78950-31ea-4ae7-a11a-c446900e07a2","resolution":{"observed_at":"2026-08-06T19:46:25.203611Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00523","last_updated":"2025-06-24T18:55:29Z","snapshot_observed_at":"2026-07-06T18:55:32.910650Z","submitted_at":"2024-08-01T12:54:46Z","title":"Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00523","snapshot_observed_at":"2026-08-06T19:46:25.332759Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.332759Z"},"links":{"cited_paper":"/paper/2408.00523","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:77fa129e41578fb9e9c18b7f3a652f9cad7831175a44e626d23ed5bfd63635c5","observation_id":"02c6bfce-8387-4b88-961f-51cdbc6e695a","resolution":{"observed_at":"2026-08-06T19:46:25.332759Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:30.246528Z","title":"& Lowe, R","venue":null,"work_id":"1a26c7d4-c796-4341-80ad-86fef46c59b8","year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.420968Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:a8ed3932107a29137ed2b5f33912dce97450031c6aa7d98a5f81be5172d361ac","observation_id":"42e7b7f6-a4ff-454f-98b2-b7b0f6a236fd","resolution":{"observed_at":"2026-08-06T19:46:30.312037Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11054","last_updated":"2025-03-11T03:06:17Z","snapshot_observed_at":"2026-08-07T18:15:02.415148Z","submitted_at":"2025-02-16T09:27:44Z","title":"Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.11054","snapshot_observed_at":"2026-08-06T19:46:25.503493Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.503493Z"},"links":{"cited_paper":"/paper/2502.11054","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:6e6cab0f03e937cfc58c6982f363c2e344b5cb5ee9b4063f5a3c026cf0f88d22","observation_id":"39ef1738-b7ea-4156-ba56-a47d600122a4","resolution":{"observed_at":"2026-08-06T19:46:25.503493Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-06T19:46:25.612647Z","title":"& Kaplan, J","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.612647Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:ed6a2fc3dc55f04c530458cbd93255b49426ec597d3a26e036a8099d379be68b","observation_id":"a68bd5e6-34fd-4093-8a56-43f078dbbba9","resolution":{"observed_at":"2026-08-06T19:46:25.612647Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.07858","last_updated":"2022-11-22T19:12:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-08-23T23:37:14Z","title":"Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.07858","snapshot_observed_at":"2026-08-06T19:46:25.761176Z","title":"& Amodei, D","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.761176Z"},"links":{"cited_paper":"/paper/2209.07858","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:9ccd59b3dc0b53598ed6004016da40a76adb3a07b7a8368921f25ffa3e14e0e3","observation_id":"6433a5ab-e4ec-4c88-93f2-acf3754ec031","resolution":{"observed_at":"2026-08-06T19:46:25.761176Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-06T19:46:25.870469Z","title":"Z., & Fredrikson, M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.870469Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:90e44c75ba2dcffc9566af093af6c090c0c2ca9ff6e7a2a51cc809c0794397d7","observation_id":"3d0799c7-1f3f-4ff7-b50c-591d077226c6","resolution":{"observed_at":"2026-08-06T19:46:25.870469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:30.072901Z","title":null,"venue":null,"work_id":"53a9a3fb-b0c3-441f-98ea-8cb1bcfa4b88","year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.984097Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:8d57e36dc588dc57aac5262b60a0dbc338b3297e9dee718b87ac7b03e2db7449","observation_id":"7fd45238-5c2f-435e-842e-0f93b792de74","resolution":{"observed_at":"2026-08-06T19:46:30.169777Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.858851Z","title":null,"venue":null,"work_id":"3f7ca015-f4e7-4970-abd1-4634c8ebe981","year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.136525Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:d7c84d7a97e552fa04cfc4647fbcbc21555860e0c245543e8b5344f7d0bd5371","observation_id":"c72c4f5c-94a3-4041-b26b-747ee4884a48","resolution":{"observed_at":"2026-08-06T19:46:29.946114Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19149","last_updated":"2025-06-10T19:36:10Z","snapshot_observed_at":"2026-08-09T10:41:46.212814Z","submitted_at":"2024-09-27T21:23:46Z","title":"Multimodal Pragmatic Jailbreak on Text-to-image Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19149","snapshot_observed_at":"2026-08-06T19:46:26.221727Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.221727Z"},"links":{"cited_paper":"/paper/2409.19149","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:3a6db2d6168a781fe92a1285bc3f44f9b42e34e9e8471b84a4ed1f2ec687b57a","observation_id":"129cc2a2-71a6-4f6e-9f65-da89169c3590","resolution":{"observed_at":"2026-08-06T19:46:26.221727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-06T19:46:26.337360Z","title":"& Kaplan, J","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.337360Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:5a8cb20400e291bca2fa4bc8f09e4cbda89a0d29860a0a7a462b012e9e4c226b","observation_id":"86029344-f94f-4cc8-958d-392e967e577e","resolution":{"observed_at":"2026-08-06T19:46:26.337360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.686237Z","title":"F., Leike, J., Brown, T., Martic, M., Legg, S., & Amodei, D","venue":null,"work_id":"53f7dc3e-d2d8-4cd7-825a-aa9c260da230","year":2017},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.401264Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:b16d5d2547cd06b70d00fdd2f881d8610b05160e8a0ee1ae9b03a7bea3e32b97","observation_id":"5b2c57e0-11c6-4d76-903a-19dec5ccff73","resolution":{"observed_at":"2026-08-06T19:46:29.747993Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-08T18:11:45.725753Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-06T19:46:26.491295Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.491295Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:f8f4766a41313df98c391305c5349db72cb9ef41f20da749e8c73d4d1b50b039","observation_id":"0d2a6696-a20a-4316-9611-5342157ccb23","resolution":{"observed_at":"2026-08-06T19:46:26.491295Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-07-06T17:31:58.268105Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-06T19:46:26.685840Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.685840Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:7d053b5a2b1215826b5d9495259f53f165fbb0bca93ca91164e74b5773091170","observation_id":"e6418170-4cf4-49d2-b7f2-4d1e2b9b094d","resolution":{"observed_at":"2026-08-06T19:46:26.685840Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.03869","last_updated":"2025-06-03T17:32:00Z","snapshot_observed_at":"2026-07-06T19:28:08.374354Z","submitted_at":"2024-10-04T19:04:43Z","title":"Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step","version":2},"cited_work":{"arxiv_id":"2410.03869","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.03869","snapshot_observed_at":"2026-08-06T19:46:28.631936Z","title":"Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step","venue":"cs.CL","work_id":"3841591b-77d8-42e0-bd29-587182cabcd0","year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.766578Z"},"links":{"cited_paper":"/paper/2410.03869","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:1a3bfec2de2ea64219d115e6091e66b333aa5cb01de635c5d8d3fbf7c9c11f85","observation_id":"2b6982bd-78ac-4b73-aa55-315d166a41e4","resolution":{"observed_at":"2026-08-06T19:46:28.715500Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.17987","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:28.953355Z","title":null,"venue":null,"work_id":"cdd2ff4a-1216-4ba0-9544-11142958beb2","year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.858023Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:1f26e2b0f096fcb3864bd4c88f100beb5d00e24e37f291eec0edbd332c432db0","observation_id":"e4dedf08-ce85-4eb0-92da-562fef96fbe0","resolution":{"observed_at":"2026-08-06T19:46:29.028272Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.10047","last_updated":"2025-06-11T09:09:12Z","snapshot_observed_at":"2026-08-09T06:09:10.228296Z","submitted_at":"2025-06-11T09:09:12Z","title":"GenBreak: Red Teaming Text-to-Image Generators Using Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.10047","snapshot_observed_at":"2026-08-06T19:46:26.940175Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.940175Z"},"links":{"cited_paper":"/paper/2506.10047","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:8eefc80568ed8b04f3fd37a35cf56cc331ecf67d10f63a41399e457147012c18","observation_id":"5128f266-0187-4ed2-974e-3b94f5a72697","resolution":{"observed_at":"2026-08-06T19:46:26.940175Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.04931","last_updated":"2025-06-27T10:07:29Z","snapshot_observed_at":"2026-08-09T10:00:38.301366Z","submitted_at":"2025-01-09T02:47:01Z","title":"Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.04931","snapshot_observed_at":"2026-08-06T19:46:26.999796Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.999796Z"},"links":{"cited_paper":"/paper/2501.04931","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:94d2f822addfcd651d2a3ebe0a193437211dd06da591d038653aaddc0f42f2d2","observation_id":"0a5cbd56-88a6-4c88-8df7-b6e574ac8c03","resolution":{"observed_at":"2026-08-06T19:46:26.999796Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.13896","last_updated":"2024-12-15T05:13:26Z","snapshot_observed_at":"2026-08-09T06:10:22.893274Z","submitted_at":"2024-08-25T17:33:40Z","title":"HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.13896","snapshot_observed_at":"2026-08-06T19:46:27.054948Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.054948Z"},"links":{"cited_paper":"/paper/2408.13896","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:73ecaf01a4cb0bc589b8eff31760e6f50a8c20666bfb3821b285a51f323720bb","observation_id":"a6b983d6-49ab-4cdd-967c-1d567a4bd97d","resolution":{"observed_at":"2026-08-06T19:46:27.054948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.12082","last_updated":"2023-11-10T19:15:20Z","snapshot_observed_at":"2026-07-06T15:29:57.940337Z","submitted_at":"2023-05-20T03:41:45Z","title":"SneakyPrompt: Jailbreaking Text-to-image Generative Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.12082","snapshot_observed_at":"2026-08-06T19:46:27.138588Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.138588Z"},"links":{"cited_paper":"/paper/2305.12082","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:e2e47fbee707390eb1d8bd5bf0e5740b4b715541382976a5dc7acae6d2f072af","observation_id":"3e668489-c586-4ce6-84b2-c3e279662485","resolution":{"observed_at":"2026-08-06T19:46:27.138588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.19610","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:28.344444Z","title":null,"venue":null,"work_id":"bea8822b-24e4-4b83-b611-dbc44f6017f0","year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.219717Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:5bb2b37f45ad3be41f508717c8ea7652d381d18795659f928e97807ca9015d51","observation_id":"634b7aab-52c0-4de4-91af-93bce1a07b10","resolution":{"observed_at":"2026-08-06T19:46:28.438341Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.03489","last_updated":"2024-10-23T13:38:29Z","snapshot_observed_at":"2026-07-06T19:27:42.862745Z","submitted_at":"2024-10-04T14:59:39Z","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.03489","snapshot_observed_at":"2026-08-06T19:46:27.317130Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.317130Z"},"links":{"cited_paper":"/paper/2410.03489","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:2782bccf1af51d40dae0a5da4590cfd931a8472d1d0c6ff4042e99833c5fa556","observation_id":"b2067cff-6d94-47f2-8e03-bcdfb55f1ec1","resolution":{"observed_at":"2026-08-06T19:46:27.317130Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-08-09T09:14:39.779608Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-06T19:46:27.368912Z","title":"& Lin, M","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.368912Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:46a946a3d2404b488b786b70f0ddffd55fb0847c36b428c49127d991b85d2007","observation_id":"6a6c5220-9606-4a96-be45-78998596fd50","resolution":{"observed_at":"2026-08-06T19:46:27.368912Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.14847","last_updated":"2025-06-02T01:51:09Z","snapshot_observed_at":"2026-08-07T18:01:00.658329Z","submitted_at":"2025-02-20T18:55:39Z","title":"Red-Teaming LLM Multi-Agent Systems via Communication Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.14847","snapshot_observed_at":"2026-08-06T19:46:27.451948Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.451948Z"},"links":{"cited_paper":"/paper/2502.14847","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:6329ef49f68f781e19959d2020548add8021ccc15d9d5de6dfecad16c4b523ce","observation_id":"f4e24e59-c187-4a25-b386-c1458f598470","resolution":{"observed_at":"2026-08-06T19:46:27.451948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-06T19:46:27.536570Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.536570Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:7c8f8e8808b0dd4b566851ca58cb5755a78dc72e6c492e8e05bdd641fa73fd00","observation_id":"ed12d4c6-a0e6-4378-b560-30a9911f5ae0","resolution":{"observed_at":"2026-08-06T19:46:27.536570Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.14333","last_updated":"2023-07-26T17:51:02Z","snapshot_observed_at":"2026-07-06T15:58:55.330444Z","submitted_at":"2023-07-26T17:51:02Z","title":"Consideration Set Sampling to Analyze Undecided Respondents","version":1},"cited_work":{"arxiv_id":"2307.14333","doi":null,"metadata_source":"pith","pith_arxiv_id":"2307.14333","snapshot_observed_at":"2026-08-06T19:46:27.865214Z","title":"Consideration Set Sampling to Analyze Undecided Respondents","venue":"stat.ME","work_id":"7e87b95f-38c3-4d12-af42-0c95b04fcfab","year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.623901Z"},"links":{"cited_paper":"/paper/2307.14333","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:9855baeb09c5a37392fce8152a603937c78229efef6b50e4616e1f911abf849a","observation_id":"3e0cb174-ef09-44f7-a443-6fab71e75112","resolution":{"observed_at":"2026-08-06T19:46:27.921011Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.395325Z","title":null,"venue":null,"work_id":"48d03f84-fb49-4c1e-9008-6419f4326ff2","year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.712204Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:a59058c2783ffbc5a51a977f2e344e829c53c91302d68a6b7c2b6dff2b001a5c","observation_id":"0cf1581b-227e-41b4-9945-b6c7ee04bc4a","resolution":{"observed_at":"2026-08-06T19:46:29.529563Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-09T06:09:37.420774Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":22,"verified_exact":4,"verified_fuzzy":2},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2507.04673."}