{"as_of":"2026-08-18T05:26:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:9119707857c4625a3e32f0f0ee1054f9ec8cd4a0a4d3832f51b4a4d149304aad","coverage":[{"denominator":39,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":39,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T05:59:28.771885Z","state":"measured"},{"denominator":39,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":39,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-17T06:30:58.91139+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2509.04615/citation-record","integrity":"/paper/2509.04615/integrity","json":"/paper/2509.04615/citation-record.json","paper":"/paper/2509.04615"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-15T10:16:52.688429Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-05T05:59:27.764800Z","title":"Jailbroken: How does llm safety training fail?, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.764800Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:491f51a7940337b5ef61c88a2590e7c92cd484c2ed9faf1d272552cea3d03854","observation_id":"d699f37f-a263-477c-99ca-1399f0870c93","resolution":{"observed_at":"2026-08-05T05:59:27.764800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14965","last_updated":"2024-03-27T04:38:44Z","snapshot_observed_at":"2026-08-16T15:30:15.240091Z","submitted_at":"2023-05-24T09:57:37Z","title":"Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14965","snapshot_observed_at":"2026-08-05T05:59:27.810979Z","title":"Tricking llms into disobedience: Formalizing, analyzing, and detecting jailbreaks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.810979Z"},"links":{"cited_paper":"/paper/2305.14965","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:274f91e4ccc5dc815bb86d721b1ea39a8dc8a1da95e5698348f158912026d88c","observation_id":"136d3e88-d9a6-4115-8fb7-a6fef4e511d6","resolution":{"observed_at":"2026-08-05T05:59:27.810979Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.05733","last_updated":"2023-02-11T15:57:44Z","snapshot_observed_at":"2026-08-17T16:48:00.928053Z","submitted_at":"2023-02-11T15:57:44Z","title":"Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.05733","snapshot_observed_at":"2026-08-05T05:59:27.941873Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.941873Z"},"links":{"cited_paper":"/paper/2302.05733","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:bae2a9e107c5c5f396d9dcfd6d18fb549217f26bf726f07f6aa778aac734ad92","observation_id":"7f0c4c94-9fea-4cec-b91e-ed6b9cb57b4e","resolution":{"observed_at":"2026-08-05T05:59:27.941873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-05T05:59:28.044849Z","title":"Prompt injection attack against llm- integrated applications, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.044849Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c3ee71884868d63f1e1e55db1a6b655101dfa3a2420601c4734daf49927942f8","observation_id":"f297b84b-23f3-4024-89bd-8efb53814954","resolution":{"observed_at":"2026-08-05T05:59:28.044849Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-08-12T14:45:22.117576Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-05T05:59:28.139852Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.139852Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8f7b353909f55f6b229f4abced035131d2aeb3dd871d5c126d068bfa22cb0580","observation_id":"a206467c-f860-4403-8b1d-a41e70f2405d","resolution":{"observed_at":"2026-08-05T05:59:28.139852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.04528","last_updated":"2024-07-16T07:29:49Z","snapshot_observed_at":"2026-08-16T15:25:47.059809Z","submitted_at":"2023-06-07T15:37:00Z","title":"PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.04528","snapshot_observed_at":"2026-08-05T05:59:28.243698Z","title":"Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.243698Z"},"links":{"cited_paper":"/paper/2306.04528","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:6ab187eb2c414b350dc94cf49402a1a84164600e8268c4c3f5f53ac40ac2aa3c","observation_id":"7b63df69-81fe-40e7-a062-bae3a724ff7f","resolution":{"observed_at":"2026-08-05T05:59:28.243698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.04237","last_updated":"2023-05-29T17:06:45Z","snapshot_observed_at":"2026-08-16T15:56:44.589600Z","submitted_at":"2023-02-08T18:07:31Z","title":"Black Box Adversarial Prompting for Foundation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.04237","snapshot_observed_at":"2026-08-05T05:59:28.348384Z","title":"Black box adversarial prompting for foundation models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.348384Z"},"links":{"cited_paper":"/paper/2302.04237","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a51d0fb1ef3baa789072f5ac95c29a37c2a3990f6edd05040c856040e2cb2848","observation_id":"920fb974-f6f7-4760-8b40-0a8b9717d708","resolution":{"observed_at":"2026-08-05T05:59:28.348384Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.552055Z","title":"A prompting-based approach for adversarial example generation and robustness enhancement,","venue":null,"work_id":"dc43e8a4-eadc-4bf3-b2fb-083b352265e1","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.437962Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:1b27e58faa0f0506ef6f30af1692b23427dc516093f0949f6a2d058e2cf355de","observation_id":"ddf146e1-f23e-4c65-82b4-f542fbedbb27","resolution":{"observed_at":"2026-08-05T05:59:29.555851Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.12242","last_updated":"2024-01-20T04:53:35Z","snapshot_observed_at":"2026-08-18T02:04:48.029193Z","submitted_at":"2024-01-20T04:53:35Z","title":"BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.12242","snapshot_observed_at":"2026-08-05T05:59:28.656669Z","title":"Badchain: Backdoor chain-of-thought prompting for large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.656669Z"},"links":{"cited_paper":"/paper/2401.12242","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:0687f2b2af0f43a56f851e09f4abd948865e5f754134c0ebbf0a275f43a36e60","observation_id":"bb8d0d41-f8b3-4413-999a-3e438355bff2","resolution":{"observed_at":"2026-08-05T05:59:28.656669Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.539614Z","title":"Preemptive answer \"attacks\" on chain-of-thought reasoning,","venue":null,"work_id":"c6f5b8cb-23ee-40c7-b2e2-b326e003aaf4","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.660854Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:246a982b01a2ecf09318ff6f0b02c062ddc5c5218311d030b976eefed1ef4bcf","observation_id":"f2d41310-3d0c-4ca4-b2ec-0ba12563f06f","resolution":{"observed_at":"2026-08-05T05:59:29.543605Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-08-16T14:42:53.638640Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-05T05:59:28.669109Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.669109Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:36afe42315b236d6f44a78f0c309db0e5f28a5537ede973181165e0ea066c301","observation_id":"4166b559-ecfe-405c-863f-59b3cf19d032","resolution":{"observed_at":"2026-08-05T05:59:28.669109Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09097","last_updated":"2024-12-17T04:34:32Z","snapshot_observed_at":"2026-08-16T13:11:18.846990Z","submitted_at":"2024-10-09T01:35:38Z","title":"Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09097","snapshot_observed_at":"2026-08-05T05:59:28.673407Z","title":"Recent advancements in llm red-teaming: Techniques, defenses, and ethical considerations, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.673407Z"},"links":{"cited_paper":"/paper/2410.09097","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:9a3751ad8e09fdeb1a941a4b47f4cfb684a99e936564e1bb1fbd041804570163","observation_id":"31c492b0-4cdc-4a9f-8ee3-0cb730eaf08d","resolution":{"observed_at":"2026-08-05T05:59:28.673407Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.13459","last_updated":"2025-05-29T14:42:38Z","snapshot_observed_at":"2026-08-16T14:16:46.279116Z","submitted_at":"2024-02-21T01:30:03Z","title":"Learning to Poison Large Language Models for Downstream Manipulation","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.13459","snapshot_observed_at":"2026-08-05T05:59:28.677245Z","title":"Learning to poison large language models during instruction tuning, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.677245Z"},"links":{"cited_paper":"/paper/2402.13459","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:b4c7d6c7382bb826aa545903aa2edb7f6635238ac1752aa3ede83a0bcdb16f77","observation_id":"ac8b7e90-5ad0-47ad-9fc9-ef0b23088d0b","resolution":{"observed_at":"2026-08-05T05:59:28.677245Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.02946","last_updated":"2025-07-17T01:19:42Z","snapshot_observed_at":"2026-08-16T13:28:17.879542Z","submitted_at":"2024-08-06T04:14:29Z","title":"Scaling Trends for Data Poisoning in LLMs","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.02946","snapshot_observed_at":"2026-08-05T05:59:28.681100Z","title":"Data poisoning in llms: Jailbreak-tuning and scaling laws, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.681100Z"},"links":{"cited_paper":"/paper/2408.02946","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:73155219736ed9c9571fb91d2eb22e458f7c70b7c9546ddaac7b366b2a744504","observation_id":"ce3add1f-4311-42ca-981e-7ac8553dd870","resolution":{"observed_at":"2026-08-05T05:59:28.681100Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.527148Z","title":"Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems ,","venue":null,"work_id":"316d50a6-ce83-4616-b4c3-3b72db8fcc33","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.684816Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:39dea6067a4ba4b164dce5324b04333724712783ebebae0a448b4bcd23652cba","observation_id":"f18dd2eb-61be-4e89-ba1b-557fb7d014ed","resolution":{"observed_at":"2026-08-05T05:59:29.531127Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T05:59:28.692055Z","title":"Universal and transferable adversarial attacks on aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.692055Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:798b9dca1b8f44eb51aa2550cad1914defcd5ea5cc6bf6c062b61eb13b6664d0","observation_id":"3b752784-8a50-4f11-b528-eb4749a35695","resolution":{"observed_at":"2026-08-05T05:59:28.692055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.501111Z","title":"0xk1h0 - github: Jailbreak prompts collection","venue":null,"work_id":"7bdf6cd0-4588-4519-8c4f-502eaa9384e7","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.696383Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:038d3f830ffa1e976c2c14b1317746a7f45c46d3c968afec36ccd6e215481e76","observation_id":"b419bb81-c754-4df2-939f-e073e4280b32","resolution":{"observed_at":"2026-08-05T05:59:29.504988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.488106Z","title":"Llm jailbreak | mitre atlas ™","venue":null,"work_id":"8deaab25-6444-47d7-8b8f-3fe7023c6381","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.700046Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:81bf17a40c7af6598ec2fe4c75fb3b219aeac4efa87927a6f70e80ac7479fa29","observation_id":"ea66c2d9-bbe0-46a2-b415-16fa02f1b69f","resolution":{"observed_at":"2026-08-05T05:59:29.492141Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.703514Z","title":"Novel jailbreak technique via typoglycemia, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.703514Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a3aa3fd222b55c2492c42df20bde2411177dd28610e10c0a36593cca3ed8c444","observation_id":"d2b95ec7-0475-4df8-b32d-ec2fb5e6ee97","resolution":{"observed_at":"2026-08-05T05:59:28.703514Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.474586Z","title":"Masterkey: Automated jailbreak across multiple large language model chatbots","venue":null,"work_id":"c591cb13-cc6f-4a1d-a65d-99cd2405803a","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.706953Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:348de56936013270e1390c720b357300237ba465754a56cfa7d8cdccd338b768","observation_id":"12091326-8877-4c50-babf-be51316f30e1","resolution":{"observed_at":"2026-08-05T05:59:29.478533Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.715705Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.715705Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a9c1436760e61931b6b10864ebc1291b4a3439417d27c2c8659ff8e954f2b7fb","observation_id":"bdc5b373-fe80-4ca4-8e9f-42aee80eec37","resolution":{"observed_at":"2026-08-05T05:59:28.715705Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.462047Z","title":"Prompt injection attacks in various llms, 2023","venue":null,"work_id":"2aa42249-dfb3-4fb6-afa5-797b5723be48","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.719336Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8c24972c1e3597c48067fdef8ccc311a1a83fda80b17d69812354855895de621","observation_id":"79d0d90e-e627-4d71-9c5f-4264af60fdc4","resolution":{"observed_at":"2026-08-05T05:59:29.465961Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.448734Z","title":"Prompt injection attack on gpt-4, March 2023","venue":null,"work_id":"1d8a1278-a12c-4604-9b69-71780cf988d4","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.722934Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:7dc285b8e2a2461bd50f8caeb4d212c4599a5213fa104ec6be919e48be044bd3","observation_id":"6cf41b30-5d43-4d9c-8cf3-abccc6a0b67a","resolution":{"observed_at":"2026-08-05T05:59:29.452580Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-08-16T15:15:58.700562Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-05T05:59:28.711730Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.711730Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:5b56daeaa2786d4aa3b3c386d89c97bcbb16b41f16853815172e0904e5cc7309","observation_id":"21332e49-ab08-4b7c-a50d-302f69aa472d","resolution":{"observed_at":"2026-08-05T05:59:28.711730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.435728Z","title":"Trojtext: Test-time invisible textual trojan insertion","venue":null,"work_id":"c596fa92-f6d8-4cc2-ae0a-12fbf2a1a413","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.730849Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:27b4283e998657b0d749b9782def52dcbba859cf9d85777da7a1abd5e53b6e3a","observation_id":"4fdcb0c3-9dff-4d51-9fb0-7ac8a5d4e349","resolution":{"observed_at":"2026-08-05T05:59:29.439908Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.737973Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.737973Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:76b0baa1362120a0607788b37360ccf07a14fc39865e87f65bdc37583f3b5585","observation_id":"0463aaac-9cd0-4aae-a5bc-d727c3db5cf0","resolution":{"observed_at":"2026-08-05T05:59:28.737973Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-08-16T14:42:53.638640Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-05T05:59:28.741450Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.741450Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:2807eb455873d0bd2d563a4d5214693bcb3da61de8965e0552ffc942b8ad10a7","observation_id":"c70146f0-2fba-4554-9a18-c148d61dcb7e","resolution":{"observed_at":"2026-08-05T05:59:28.741450Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2410.13334","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.940857Z","title":"Do llms have political correctness? analyzing ethical biases and jailbreak vulnerabilities in ai systems, 2024","venue":null,"work_id":"2c83c6a1-a8f0-49b1-aa26-0dab9735c781","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.749477Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:ab868ccc4d3d32193b4d824820e84f50947700515425383ab9e89cb46223cb42","observation_id":"b2d45d7c-98b6-4e49-a293-59861480529f","resolution":{"observed_at":"2026-08-05T05:59:28.947863Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.02242","last_updated":"2023-08-22T02:34:19Z","snapshot_observed_at":"2026-08-16T15:50:54.771613Z","submitted_at":"2023-03-03T22:19:22Z","title":"TrojText: Test-time Invisible Textual Trojan Insertion","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.02242","snapshot_observed_at":"2026-08-05T05:59:28.734338Z","title":"arXiv:2303.02242","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.734338Z"},"links":{"cited_paper":"/paper/2303.02242","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:18833d793c40aa4e91e0d8a0b0a36d69e674e7d94d8e7a1833a83bfcd64c6fd0","observation_id":"daeb5318-2729-4486-a055-f242a92723be","resolution":{"observed_at":"2026-08-05T05:59:28.734338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01424","last_updated":"2024-06-18T09:14:34Z","snapshot_observed_at":"2026-08-16T14:57:09.700860Z","submitted_at":"2023-09-27T15:15:23Z","title":"Identifying and Mitigating Privacy Risks Stemming from Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01424","snapshot_observed_at":"2026-08-05T05:59:28.757303Z","title":"Identifying and mitigating privacy risks stemming from language models: A survey, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.757303Z"},"links":{"cited_paper":"/paper/2310.01424","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:5c1f422a5745a33b625553245d7212f546326c6ba65e187db9dec1ba5f161333","observation_id":"7cf2896e-0630-4c0a-9b3d-3b63fd7d33a7","resolution":{"observed_at":"2026-08-05T05:59:28.757303Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.422271Z","title":"Reinforcement learning- driven LLM agent for automated attacks on LLMs","venue":null,"work_id":"3a4db020-07a9-4b9e-a25d-225110c942e9","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.761065Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:6963a145ac5f719c6f927832405ed3f9dda2c257505f7d432cd87f0cd12e66f6","observation_id":"56142a18-7a70-4c6b-8a25-c55c14c2c887","resolution":{"observed_at":"2026-08-05T05:59:29.426604Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01469","last_updated":"2024-08-04T16:26:14Z","snapshot_observed_at":"2026-08-16T14:55:48.051655Z","submitted_at":"2023-10-02T17:01:56Z","title":"LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examples","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01469","snapshot_observed_at":"2026-08-05T05:59:28.745638Z","title":"Llm lies: Hallucinations are not bugs, but features as adversarial examples, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.745638Z"},"links":{"cited_paper":"/paper/2310.01469","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:5c5240fe0eb4c4a35ac1d5133f4f8e1b01d226208389d75c6dadf4fd856a8aa3","observation_id":"0848b3bf-217d-4a88-a68c-a14b3f7ecd1b","resolution":{"observed_at":"2026-08-05T05:59:28.745638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13660","last_updated":"2024-04-21T13:31:16Z","snapshot_observed_at":"2026-08-16T13:59:07.948719Z","submitted_at":"2024-04-21T13:31:16Z","title":"Trojan Detection in Large Language Models: Insights from The Trojan Detection Challenge","version":1},"cited_work":{"arxiv_id":"2404.13660","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.13660","snapshot_observed_at":"2026-08-05T05:59:28.821789Z","title":"Trojan Detection in Large Language Models: Insights from The Trojan Detection Challenge","venue":"cs.CL","work_id":"62a51fcd-e52a-4039-8d73-93aef8cd42a6","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.768243Z"},"links":{"cited_paper":"/paper/2404.13660","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:e9c17a58b408fdb253f3c6a272bcc2bc3d3c9cdd38a0ca42a223dfdbce0afc3d","observation_id":"69d64cda-7a28-4ee3-92a3-7ff35bf5818c","resolution":{"observed_at":"2026-08-05T05:59:28.827636Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.02027","last_updated":"2024-07-02T07:49:48Z","snapshot_observed_at":"2026-08-16T13:37:50.977483Z","submitted_at":"2024-07-02T07:49:48Z","title":"Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives","version":1},"cited_work":{"arxiv_id":"2407.02027","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.02027","snapshot_observed_at":"2026-08-05T05:59:28.871326Z","title":"Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives","venue":"cs.CY","work_id":"e6fc7e2f-98b5-4940-9ead-91bfb7a9abc9","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.752957Z"},"links":{"cited_paper":"/paper/2407.02027","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c025702f94e7e42502180cf6d39d8e36411f4853a29ccbda9bff323b6475f774","observation_id":"30070107-183b-4479-be43-53eb2f806334","resolution":{"observed_at":"2026-08-05T05:59:28.876110Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.06815","last_updated":"2023-10-31T00:33:53Z","snapshot_observed_at":"2026-08-16T15:24:44.898561Z","submitted_at":"2023-06-12T01:22:39Z","title":"TrojLLM: A Black-box Trojan Prompt Attack on Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.06815","snapshot_observed_at":"2026-08-05T05:59:28.764525Z","title":"Trojllm: A black-box trojan prompt attack on large language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.764525Z"},"links":{"cited_paper":"/paper/2306.06815","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:62e9449b8d7222b265060bc6433759f2d44c2fb49ee75c7c97942875fd935c1e","observation_id":"47d134dd-4084-4a4e-96d4-d344fda06a2a","resolution":{"observed_at":"2026-08-05T05:59:28.764525Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.16119","last_updated":"2024-03-03T00:12:16Z","snapshot_observed_at":"2026-08-16T14:49:13.591635Z","submitted_at":"2023-10-24T18:18:11Z","title":"Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.16119","snapshot_observed_at":"2026-08-05T05:59:28.771885Z","title":"Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global scale prompt hacking competition, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.771885Z"},"links":{"cited_paper":"/paper/2311.16119","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:e463fd0333ca3fb2bd794dca869358d9bd2ac7abed440179d9c40e8456352e66","observation_id":"e12e604a-c60c-47cb-9b38-7618463c417f","resolution":{"observed_at":"2026-08-05T05:59:28.771885Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.10714","last_updated":"2022-03-21T03:21:32Z","snapshot_observed_at":"2026-08-16T17:13:07.931868Z","submitted_at":"2022-03-21T03:21:32Z","title":"A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement","version":1},"cited_work":{"arxiv_id":"2203.10714","doi":null,"metadata_source":"pith","pith_arxiv_id":"2203.10714","snapshot_observed_at":"2026-08-05T05:59:29.310263Z","title":"A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement","venue":"cs.CL","work_id":"980eeec5-6436-4ed8-bde0-b68ccd9aa395","year":2022},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.571988Z"},"links":{"cited_paper":"/paper/2203.10714","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a5590809abcb596e961ba54b061ce8da14c7c7caa30040c83963f6280889c14e","observation_id":"1a3834ad-20da-4726-a80a-0dce4755644f","resolution":{"observed_at":"2026-08-05T05:59:29.314470Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.513667Z","title":null,"venue":null,"work_id":"9483d04d-60a3-4b43-8ed0-c48c344ae943","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.688583Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:32af79ebac208011a63e16f48b1e0630b73c813973be8f4f2ef1366e0a08fc02","observation_id":"5b3fb305-7b4d-4a36-a6fd-9e796798e7d7","resolution":{"observed_at":"2026-08-05T05:59:29.517816Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20902","last_updated":"2024-05-31T15:15:04Z","snapshot_observed_at":"2026-08-16T13:47:23.756475Z","submitted_at":"2024-05-31T15:15:04Z","title":"Preemptive Answer \"Attacks\" on Chain-of-Thought Reasoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.20902","snapshot_observed_at":"2026-08-05T05:59:28.665142Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.665142Z"},"links":{"cited_paper":"/paper/2405.20902","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:9005df5a36c36062ee61ba7bb393362add16fb6134fecbd6f243699be8fdd4f4","observation_id":"6e3a9bb8-c7aa-43d2-85e9-c7a7d309a71e","resolution":{"observed_at":"2026-08-05T05:59:28.665142Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-14T14:57:43.999369Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs"},"reference_resolution":{"displayed":39,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":25,"verified_exact":4,"verified_fuzzy":10},"total_outbound_references":39},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 39 of 39 outbound references and 0 inbound Pith citation observations for arXiv:2509.04615."}