{"as_of":"2026-08-17T05:44:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6409a26f7812c473f2fe0d9ecf5eb015394e52d6982f5ed663e376ac67242bbb","coverage":[{"denominator":91,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":91,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T16:25:35.794271Z","state":"measured"},{"denominator":92,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":92,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-16T06:30:59.297886+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-27T03:24:24.714121Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"cited_work":{"arxiv_id":"2509.08000","doi":"10.48550/arxiv.2509.08000","metadata_source":"arxiv_reference","pith_arxiv_id":"2509.08000","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AntiDote: Bi-level","venue":"ArXiv.org","work_id":"7d6e4861-2820-4faf-9483-cf8770bdbfbb","year":null},"citing_paper":{"arxiv_id":"2606.15980","last_updated":"2026-06-18T23:56:29Z","snapshot_observed_at":"2026-08-13T20:15:46.535466Z","submitted_at":"2026-06-14T19:07:22Z","title":"Do Activation Monitors Survive Model Updates? Benchmarking, Predicting, and Repairing Activation-Monitor Staleness","version":2},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-06-27T03:24:24.714121Z"},"links":{"cited_paper":"/paper/2509.08000","citing_paper":"/paper/2606.15980"},"observation_digest":"sha256:c12317763bb994e4ed7a0d6f27fdb508536478e9e68940db18fd0187c972091f","observation_id":"9d9a0935-e55e-49d7-b954-564f6fade08c","resolution":{"observed_at":"2026-06-27T03:30:26.978682Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2509.08000/citation-record","integrity":"/paper/2509.08000/integrity","json":"/paper/2509.08000/citation-record.json","paper":"/paper/2509.08000"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.382342Z","title":", \" * write output.state after.block = add.period write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.382342Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5f88dde9ac197a0cd4f5a005b6ae5bdefb1c4774c324707aa5d1abe406439fa2","observation_id":"ad25e298-6573-45c4-85c6-f3496b163bae","resolution":{"observed_at":"2026-08-15T16:25:35.382342Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.387959Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.387959Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6867c65270c788a08fe096c67ba7f151a74ab0c9ab121024d6ddbb71f33745e0","observation_id":"aa8a2ef4-2be3-40f2-a0b0-5e1d45d5e73c","resolution":{"observed_at":"2026-08-15T16:25:35.387959Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04652","last_updated":"2025-01-21T10:12:05Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-07T16:52:49Z","title":"Yi: Open Foundation Models by 01.AI","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04652","snapshot_observed_at":"2026-08-15T16:25:35.392417Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.392417Z"},"links":{"cited_paper":"/paper/2403.04652","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:0bf7cbdae091e5c7c43e227de57e2ed54a8efc820a931a8e405e9f3327282f42","observation_id":"5cb1a105-d857-45f5-bd98-f79924b9a913","resolution":{"observed_at":"2026-08-15T16:25:35.392417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.16867","last_updated":"2023-11-29T19:45:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-11-28T15:12:47Z","title":"The Falcon Series of Open Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.16867","snapshot_observed_at":"2026-08-15T16:25:35.397446Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.397446Z"},"links":{"cited_paper":"/paper/2311.16867","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7ef16f8bb2fa8e224166d637b69609d645513402f4b36455e74f0a1889fcba0b","observation_id":"63e14614-66d4-4149-b35d-a0c099c42125","resolution":{"observed_at":"2026-08-15T16:25:35.397446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.401443Z","title":"E.; Hubinger, E.; Bai, Y.; Bricken, T.; Maxwell, T.; Schiefer, N.; Sully, J.; Tamkin, A.; Lanham, T.; Nguyen, K.; Korbak, T.; Kaplan, J.; Ganguli, D.; Bowman, S","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.401443Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6add0536a427a8a60c5241c10cc7d132131dbf536df5b4c1b7fc60c15aa40ed5","observation_id":"00948fef-d163-4498-bb1e-14fb8d997059","resolution":{"observed_at":"2026-08-15T16:25:35.401443Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.11717","last_updated":"2024-10-30T18:57:07Z","snapshot_observed_at":"2026-08-15T09:21:47.572546Z","submitted_at":"2024-06-17T16:36:12Z","title":"Refusal in Language Models Is Mediated by a Single Direction","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.11717","snapshot_observed_at":"2026-08-15T16:25:35.405667Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.405667Z"},"links":{"cited_paper":"/paper/2406.11717","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:24b6e15a07bca992fea84a5f6d3d9079646d9f3281c0a18ba536fb1e936e966c","observation_id":"8f4c4d3c-4ac2-414d-a932-56dd9d53052f","resolution":{"observed_at":"2026-08-15T16:25:35.405667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.409950Z","title":"Do Anything Now","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.409950Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:ba1b658e0f69a15a4ff002e75cf23e37f4b2dae4622bfde2b8540ce58b4ca6f3","observation_id":"af39a24f-0b0c-427b-9445-15d5df9c7f85","resolution":{"observed_at":"2026-08-15T16:25:35.409950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.413726Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.413726Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:562d4303b688c855e4c0472180c891ab4246ba3812a5b89216de716cd4ac00b9","observation_id":"a601b59f-ea31-4e22-a836-625c583ea314","resolution":{"observed_at":"2026-08-15T16:25:35.413726Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.418714Z","title":"A.; and Hill, E","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.418714Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b159d9c022b04f599a6ccd5836303b7ab23c3f2d5a4aa9c83dde537503492c97","observation_id":"da90c372-54be-4d7a-a2d3-25ba07ff3003","resolution":{"observed_at":"2026-08-15T16:25:35.418714Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.423138Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.423138Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f538c9637e9436eb96eb5d009eb29c76db6467b6f06a68ec47c12d2cd7d2e0a2","observation_id":"19928a12-01f7-45d0-af60-33a7fee39670","resolution":{"observed_at":"2026-08-15T16:25:35.423138Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.429822Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.429822Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:aa83dab8636672fb156c87ef576b8e53548bd7487b04347d200b61831e39edb8","observation_id":"9179db64-dab0-43ef-b687-c3e2d825e606","resolution":{"observed_at":"2026-08-15T16:25:35.429822Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.438338Z","title":"J.; and Wong, E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.438338Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:163a0069e1ed99616a7de51f6d01d3d06b2495bdafe681e9ded13db543db9220","observation_id":"37912514-015c-4863-89a5-7890860e2bbb","resolution":{"observed_at":"2026-08-15T16:25:35.438338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-15T16:25:35.442838Z","title":"E.; Gandikota, R.; Ewart, A.; Rosati, D.; Wu, Z.; et al","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.442838Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b1c0a5522ac9bd62f924a22bb7268f3ee86930151627dc95ba0d30aec4694789","observation_id":"d4017d78-8c14-4e7f-a732-46170f55fb0a","resolution":{"observed_at":"2026-08-15T16:25:35.442838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.447097Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.447097Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e6f49d09eda7379ed2444c2e75c54c29023c5eeb28e0c3fa82bb023976823d1c","observation_id":"4859decf-14a6-450c-af55-fa9e40cf246a","resolution":{"observed_at":"2026-08-15T16:25:35.447097Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2110.14168","last_updated":"2021-11-18T00:23:45Z","snapshot_observed_at":"2026-08-14T02:43:01.480086Z","submitted_at":"2021-10-27T04:49:45Z","title":"Training Verifiers to Solve Math Word Problems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2110.14168","snapshot_observed_at":"2026-08-15T16:25:35.450756Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.450756Z"},"links":{"cited_paper":"/paper/2110.14168","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3ea494e87f46115cb3e8d09aa68e9f9320936479e9f7bc00bb5edfe882751a31","observation_id":"3d6f2e35-02f0-4520-9bab-70d7fe82028a","resolution":{"observed_at":"2026-08-15T16:25:35.450756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2006.16362","last_updated":"2021-05-20T14:48:30Z","snapshot_observed_at":"2026-08-09T06:13:20.021836Z","submitted_at":"2020-06-29T20:28:52Z","title":"Multi-Head Attention: Collaborate Instead of Concatenate","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2006.16362","snapshot_observed_at":"2026-08-15T16:25:35.454813Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.454813Z"},"links":{"cited_paper":"/paper/2006.16362","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d72160d46a021abf1e9f0a9e2f5af5a515a9ada70912de9e66bbc6908a8c23c0","observation_id":"c9f372f3-b706-4e65-b29e-3c151c9d96a2","resolution":{"observed_at":"2026-08-15T16:25:35.454813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-08-15T17:27:11.980940Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-15T16:25:35.459056Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.459056Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d52a73b5cf4cae2167846f88f12aa6395fa5434fbaeceb3c9b5d2a3474dbea79","observation_id":"029c671a-408e-49ce-810b-7cc95ca2f8b1","resolution":{"observed_at":"2026-08-15T16:25:35.459056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.463314Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.463314Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d48a0b620d779872de363fdfa790675341f2c0a6cb39f14bc22ec87ef6cb3d66","observation_id":"e86dd41e-677f-408d-91a9-fb22a54ff9e6","resolution":{"observed_at":"2026-08-15T16:25:35.463314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.466791Z","title":"C.; Allen, E","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.466791Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c423acfa45c939c01f5d8f6fef30604412a9c0ab84b4fdafc4caa2bc6b9b69eb","observation_id":"3647b421-971a-4cfb-9afb-4c2ce60a1fb3","resolution":{"observed_at":"2026-08-15T16:25:35.466791Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.470899Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.470899Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3f4c1213ca6300ebe286a595ca82ad3eb05555109c72ae5a444dcd2884a747d6","observation_id":"40ca8320-99af-4c93-ae36-9989f479325e","resolution":{"observed_at":"2026-08-15T16:25:35.470899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.242134Z","title":null,"venue":null,"work_id":"667a51c0-b134-4a30-a1d3-0a1fb84c59e8","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.475467Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:af277a10c71bbccd17d4a9afdc6cc5a20756cfb5e5fb380c2a854758b9e06bc2","observation_id":"c35178b1-326b-458b-af3d-87ab63237d04","resolution":{"observed_at":"2026-08-15T16:25:37.246678Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.227467Z","title":null,"venue":null,"work_id":"1d3dd58c-e4ce-47be-8c52-f14541cf77b1","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.479137Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:1de8c8de06f638ed7e6db9e96a46ed5562b50683acf0752290fa22a14f73d54b","observation_id":"45c5d733-ba60-419d-916d-8e2335e4d032","resolution":{"observed_at":"2026-08-15T16:25:37.231653Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-08-16T14:44:33.111232Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-15T16:25:35.482899Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.482899Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:67039b5766830b7b7f02f96c18b018a0fee623aab7aa66471e6c9168cb8fb95b","observation_id":"4c40d6e0-a570-4127-b746-4696d7e71c9f","resolution":{"observed_at":"2026-08-15T16:25:35.482899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-15T16:25:35.486772Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.486772Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5cd48b4a07f99604bc76d6b372f50a463cdcb76e21352456786902e54c6decdd","observation_id":"9009f364-c983-445c-afc9-abd99ed4df17","resolution":{"observed_at":"2026-08-15T16:25:35.486772Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.212914Z","title":null,"venue":null,"work_id":"b37072b0-234d-468a-8d69-2884dc22a41d","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.491734Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:8ea1c2f2093ad76a69482f2894df3441e0ce867a4d0b130f184a15fe10bb2d06","observation_id":"31fbdf9e-ce32-419c-bb86-c8bc84d5287a","resolution":{"observed_at":"2026-08-15T16:25:37.218168Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.01886","last_updated":"2024-05-03T07:14:07Z","snapshot_observed_at":"2026-08-16T13:55:43.876157Z","submitted_at":"2024-05-03T07:14:07Z","title":"Aloe: A Family of Fine-tuned Open Healthcare LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.01886","snapshot_observed_at":"2026-08-15T16:25:35.495639Z","title":"K.; Lopez-Cuena, E.; Bayarri-Planas, J.; Tormos, A.; Hinjos, D.; Perez, P","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.495639Z"},"links":{"cited_paper":"/paper/2405.01886","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4dac832e405648393946483ba5f5a88d59a486297bc343ad75b51a97229f3836","observation_id":"4114cf85-cd5d-4040-aece-c1df0a48ff81","resolution":{"observed_at":"2026-08-15T16:25:35.495639Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2009.03300","last_updated":"2021-01-12T18:57:11Z","snapshot_observed_at":"2026-08-13T20:44:28.824685Z","submitted_at":"2020-09-07T17:59:25Z","title":"Measuring Massive Multitask Language Understanding","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.03300","snapshot_observed_at":"2026-08-15T16:25:35.500101Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.500101Z"},"links":{"cited_paper":"/paper/2009.03300","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:ffef80f2ad1895cdd9610bbd8b8a9a76c773e06622e5bd47d83813739f8aec75","observation_id":"d062791c-dbb2-4b6b-b6a7-21ede5e85ef2","resolution":{"observed_at":"2026-08-15T16:25:35.500101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2103.03874","last_updated":"2021-11-08T21:30:18Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-03-05T18:59:39Z","title":"Measuring Mathematical Problem Solving With the MATH Dataset","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2103.03874","snapshot_observed_at":"2026-08-15T16:25:35.504361Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.504361Z"},"links":{"cited_paper":"/paper/2103.03874","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6bd50227f2e7e86582410cfcc3a6a2b97192cf36ed129dc06a9d92873da659d5","observation_id":"48e79834-71bf-48de-b8f7-b22018b76567","resolution":{"observed_at":"2026-08-15T16:25:35.504361Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.09689","last_updated":"2022-12-19T18:21:00Z","snapshot_observed_at":"2026-08-16T16:07:35.215298Z","submitted_at":"2022-12-19T18:21:00Z","title":"Unnatural Instructions: Tuning Language Models with (Almost) No Human Labor","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.09689","snapshot_observed_at":"2026-08-15T16:25:35.508322Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.508322Z"},"links":{"cited_paper":"/paper/2212.09689","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:65f8950dd747327c3dce612fab560f0a0e5aa9b2a67f0b3125ba651efd0b4d85","observation_id":"9980664b-b9ad-4173-a854-2838d6d1b1b1","resolution":{"observed_at":"2026-08-15T16:25:35.508322Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-11T08:20:29.798517Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-15T16:25:35.512022Z","title":"J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.512022Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5886bcf3ea47ba952a5903abd46ba596a609999bc8ecc08f1740c8aa3ac44cc2","observation_id":"bc112cc0-46f6-4001-9b2d-bd1e020d062c","resolution":{"observed_at":"2026-08-15T16:25:35.512022Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.01586","last_updated":"2025-03-17T17:17:16Z","snapshot_observed_at":"2026-08-16T13:21:54.714128Z","submitted_at":"2024-09-03T03:59:22Z","title":"Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbation","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.01586","snapshot_observed_at":"2026-08-15T16:25:35.520496Z","title":"F.; and Liu, L","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.520496Z"},"links":{"cited_paper":"/paper/2409.01586","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:bda5c0aace8c484fed36acfaeabee0691b84b96ecb37c83ec3e3056774836280","observation_id":"468945ff-c394-4a8b-aae3-214d259cdeb7","resolution":{"observed_at":"2026-08-15T16:25:35.520496Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.17433","last_updated":"2025-01-29T06:24:58Z","snapshot_observed_at":"2026-08-16T12:58:26.918057Z","submitted_at":"2025-01-29T06:24:58Z","title":"Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.17433","snapshot_observed_at":"2026-08-15T16:25:35.524521Z","title":"F.; and Liu, L","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.524521Z"},"links":{"cited_paper":"/paper/2501.17433","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c29334ddcf2cd499c6f0c3671d04330cff9e5b5765ea408e17bb76ad186b5c63","observation_id":"f5f1cb5b-891b-44da-950b-d6cac8a6d69c","resolution":{"observed_at":"2026-08-15T16:25:35.524521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01109","last_updated":"2024-11-24T20:09:55Z","snapshot_observed_at":"2026-08-16T14:22:17.262996Z","submitted_at":"2024-02-02T02:56:50Z","title":"Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attack","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01109","snapshot_observed_at":"2026-08-15T16:25:35.533528Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.533528Z"},"links":{"cited_paper":"/paper/2402.01109","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:12ccaf4e5d1f744e679294c2e6ddfc2ef6f4918e0580017c4f1bf1655cccdcf0","observation_id":"18be176f-584e-40d0-86c2-d944de26f4f9","resolution":{"observed_at":"2026-08-15T16:25:35.533528Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.200671Z","title":null,"venue":null,"work_id":"982fd8e5-c645-4731-b161-11cd2f3be5aa","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.537145Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:89a0374dd8ef5ffd93dd815060d4a94e135f555678c497b8452e1c85aa82e303","observation_id":"d04578d6-677e-4791-b157-4fac8425e1a4","resolution":{"observed_at":"2026-08-15T16:25:37.205244Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.07137","last_updated":"2025-04-07T22:32:46Z","snapshot_observed_at":"2026-08-16T12:43:12.296102Z","submitted_at":"2025-04-07T22:32:46Z","title":"Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.07137","snapshot_observed_at":"2026-08-15T16:25:35.540991Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.540991Z"},"links":{"cited_paper":"/paper/2504.07137","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:0b2855df1c7543758f1ebaa2cf5c5c43799f6f92862615426cdd0e372e417902","observation_id":"8dbbecfb-e8b7-4477-a8ea-9051a1b85c0a","resolution":{"observed_at":"2026-08-15T16:25:35.540991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.545273Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.545273Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:42c6d77d87bd61dbac4b362b5b1934cc39408b285a09f2f52d54f64f66347ef3","observation_id":"10c4157a-e12b-43ce-80dc-ec8054f35342","resolution":{"observed_at":"2026-08-15T16:25:35.545273Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-08-17T02:13:39.510069Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-15T16:25:35.548883Z","title":"Q.; Sablayrolles, A.; Mensch, A.; Bamford, C.; Chaplot, D","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.548883Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d348191ccee3055893e14dc4718a6b0f11fca50302fe57202d92186b9812af04","observation_id":"96d1e257-d944-45cf-9a65-8e2a6c5847ff","resolution":{"observed_at":"2026-08-15T16:25:35.548883Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.188055Z","title":null,"venue":null,"work_id":"81902c8d-6de6-4286-8eea-e03170daf9cb","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.553625Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:66e0a57ce3cd0002dccb2459c810a32d6e57d4a9f4ce3e82bfc2e5547cf3e29b","observation_id":"70274a89-1af6-4411-8775-a947129265ee","resolution":{"observed_at":"2026-08-15T16:25:37.192162Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11596","last_updated":"2025-02-17T09:28:51Z","snapshot_observed_at":"2026-08-16T12:57:48.709307Z","submitted_at":"2025-02-17T09:28:51Z","title":"LLM Embeddings for Deep Learning on Tabular Data","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.11596","snapshot_observed_at":"2026-08-15T16:25:35.558732Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.558732Z"},"links":{"cited_paper":"/paper/2502.11596","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d04b2390996e29d51a8fa262bccdf960310fb8cf2271972749b55b36152e606a","observation_id":"e6ae978d-4772-4f3f-a900-1d9ec49f6752","resolution":{"observed_at":"2026-08-15T16:25:35.558732Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15593","last_updated":"2024-06-06T04:53:25Z","snapshot_observed_at":"2026-08-16T15:12:29.041340Z","submitted_at":"2023-07-28T14:52:08Z","title":"Robust Distortion-free Watermarks for Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15593","snapshot_observed_at":"2026-08-15T16:25:35.562902Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.562902Z"},"links":{"cited_paper":"/paper/2307.15593","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:98542c3b6b7248962a896bdcd6dbec21690c07529e0ffbea2ee28c293bb2e0d1","observation_id":"3dde08bb-842c-49fb-869d-762eabf1e434","resolution":{"observed_at":"2026-08-15T16:25:35.562902Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.174620Z","title":null,"venue":null,"work_id":"525532e6-f600-4e1e-a06b-08b7d76b9077","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.566932Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:cf610a20d97078ff6bf993a2c9ccb5b882c348f693af5a104f7c757424492034","observation_id":"46e0b858-00b3-4787-9db8-d7fe7ad30e9e","resolution":{"observed_at":"2026-08-15T16:25:37.178690Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.05197","last_updated":"2023-11-01T05:14:01Z","snapshot_observed_at":"2026-08-16T20:14:11.472465Z","submitted_at":"2023-04-11T13:05:04Z","title":"Multi-step Jailbreaking Privacy Attacks on ChatGPT","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.05197","snapshot_observed_at":"2026-08-15T16:25:35.570589Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.570589Z"},"links":{"cited_paper":"/paper/2304.05197","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:ae6cd73d1ae3b389a899458ef5ae62d0fefdb58b32f4e4e68c7589ffc13e01b3","observation_id":"926a9815-7dac-4d80-a119-e24de3292678","resolution":{"observed_at":"2026-08-15T16:25:35.570589Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03218","last_updated":"2024-05-15T19:16:09Z","snapshot_observed_at":"2026-08-15T06:18:34.739211Z","submitted_at":"2024-03-05T18:59:35Z","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","version":7},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03218","snapshot_observed_at":"2026-08-15T16:25:35.574328Z","title":"D.; and Dombrowski, A.-K","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.574328Z"},"links":{"cited_paper":"/paper/2403.03218","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4d99a53b83726ace01a6c04f445c846fd5c60bd1d0f160446468213c92802f98","observation_id":"c75d8f18-27c6-478c-aa7e-ace93bf76c7e","resolution":{"observed_at":"2026-08-15T16:25:35.574328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.20228","last_updated":"2025-03-26T04:46:31Z","snapshot_observed_at":"2026-08-16T12:46:46.372020Z","submitted_at":"2025-03-26T04:46:31Z","title":"TeleLoRA: Teleporting Model-Specific Alignment Across LLMs","version":1},"cited_work":{"arxiv_id":"2503.20228","doi":null,"metadata_source":"pith","pith_arxiv_id":"2503.20228","snapshot_observed_at":"2026-08-15T16:25:36.523427Z","title":"TeleLoRA: Teleporting Model-Specific Alignment Across LLMs","venue":"cs.LG","work_id":"be9f2cf2-272d-4498-8505-4aa0835d5af0","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.582429Z"},"links":{"cited_paper":"/paper/2503.20228","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4a0bc3818d3fdf66e639d0c3998481d3a62a4890f61a7c06502ef60b47a2735f","observation_id":"b91a5ea8-9ede-4d8a-87b6-4166cec6f27f","resolution":{"observed_at":"2026-08-15T16:25:36.529377Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2504.01444","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:36.503105Z","title":null,"venue":null,"work_id":"9d477498-117c-47e5-a575-6ef6ba261079","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.586017Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:10247dd5f348a6c9f8f1ac0d19ada3b9ab47e78b62165723c67a295947f49dfe","observation_id":"2d16c294-5216-4998-9779-f7dbae85971a","resolution":{"observed_at":"2026-08-15T16:25:36.509939Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-15T16:37:22.396444Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-15T16:25:35.589876Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.589876Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:32729d1a8411afaf898b3115f4ba5fe9d406190def256e11a602171f26d590d4","observation_id":"0e368ff1-ba39-4568-88d8-30414caf00aa","resolution":{"observed_at":"2026-08-15T16:25:35.589876Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12975","last_updated":"2024-08-21T11:57:05Z","snapshot_observed_at":"2026-08-16T14:06:33.074285Z","submitted_at":"2024-06-18T18:00:03Z","title":"SHIELD: Evaluation and Defense Strategies for Copyright Compliance in LLM Text Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12975","snapshot_observed_at":"2026-08-15T16:25:35.597800Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.597800Z"},"links":{"cited_paper":"/paper/2406.12975","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:75f078338b855ed2032398c5435c2eb63dfd8ee1a90c72969d7dc3947ac92d05","observation_id":"c47c0b94-a64a-4edc-8d32-104d6ebbdb54","resolution":{"observed_at":"2026-08-15T16:25:35.597800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-16T14:36:14.029419Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-15T16:25:35.601622Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.601622Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:df981fa208037ff926806f079f25a3962728c3b768fbdc98bed51553315efceb","observation_id":"ca700848-885d-4c03-8a6f-32e5254d0726","resolution":{"observed_at":"2026-08-15T16:25:35.601622Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-08-16T09:07:20.265665Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-15T16:25:35.612838Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.612838Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:329e312ba2f3664a1d8a3f07643d99011a19b5a4cbac5ec7b315ac0b3daeed16","observation_id":"98430e03-cf23-443b-9007-c53b22089ba1","resolution":{"observed_at":"2026-08-15T16:25:35.612838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.616456Z","title":"R.; and Papernot, N","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.616456Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6398a2a78eed7f0fec86a8279d5f50143d2f33119270124df0f3c232e36d460e","observation_id":"ca845d39-ef48-4bbc-9588-f5a40d6a5c14","resolution":{"observed_at":"2026-08-15T16:25:35.616456Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02138","last_updated":"2026-04-15T01:27:38Z","snapshot_observed_at":"2026-08-15T12:46:13.472024Z","submitted_at":"2024-04-02T17:49:40Z","title":"Topic-Based Watermarks for Large Language Models","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02138","snapshot_observed_at":"2026-08-15T16:25:35.620427Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.620427Z"},"links":{"cited_paper":"/paper/2404.02138","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:735370222ab8a41197574f2ac9073c8fefc1d5beb1802e7ee0acd1c3f1b3ef41","observation_id":"833a1260-eedb-4242-bd8a-bccd6a290aab","resolution":{"observed_at":"2026-08-15T16:25:35.620427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.157777Z","title":"J.; Hassani, H.; Robey, A.; and Wong, E","venue":null,"work_id":"7c1804fc-fbfc-4dd2-9ce1-2324e56978d9","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.625006Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:edbc06d054abe867ea22b479db865e8aae89bb3ed0bccb3f223e55a212b254f3","observation_id":"eb29432f-9822-466a-b1fa-8fa53f9fb69f","resolution":{"observed_at":"2026-08-15T16:25:37.165178Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.07579","last_updated":"2024-06-06T06:31:08Z","snapshot_observed_at":"2026-08-16T14:53:01.775752Z","submitted_at":"2023-10-11T15:19:31Z","title":"In-Context Unlearning: Language Models as Few Shot Unlearners","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.07579","snapshot_observed_at":"2026-08-15T16:25:35.629057Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.629057Z"},"links":{"cited_paper":"/paper/2310.07579","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d53644c3d16b1e8b987d4eb51a5d308e34f631ecf7ff2ab05db3e0d01a4d6ba6","observation_id":"0edacc3f-f76f-4b44-b7a7-038ce3b123f5","resolution":{"observed_at":"2026-08-15T16:25:35.629057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.143701Z","title":null,"venue":null,"work_id":"d9b2ab0f-df21-40f9-b0c3-e77a3e3e1af9","year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.633450Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e1e1e6cd3c618f0a0ff20c5446c21bb32afd20a45daf6a4070ff9bc997e30196","observation_id":"c3ff32b1-5882-4710-a2ed-0495bdeabd70","resolution":{"observed_at":"2026-08-15T16:25:37.148810Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-16T13:23:25.577041Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-15T16:25:35.637678Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.637678Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:ad8a6d7eb5f380f667477e94d72176727cff33004e0be97fd87624b14d16aaa2","observation_id":"ddceaa23-7b54-4660-a7df-0af32dfa13e8","resolution":{"observed_at":"2026-08-15T16:25:35.637678Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.18290","last_updated":"2024-07-29T22:26:36Z","snapshot_observed_at":"2026-08-01T16:34:38.795326Z","submitted_at":"2023-05-29T17:57:46Z","title":"Direct Preference Optimization: Your Language Model is Secretly a Reward Model","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.18290","snapshot_observed_at":"2026-08-15T16:25:35.641624Z","title":"D.; and Finn, C","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.641624Z"},"links":{"cited_paper":"/paper/2305.18290","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f1d990c2cdfe86b7407cc63dc4f1af70d27d468967b11743d50793c03d8b0624","observation_id":"53b212db-a8ec-46fa-84a7-f7fea271f2ea","resolution":{"observed_at":"2026-08-15T16:25:35.641624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.129959Z","title":null,"venue":null,"work_id":"b1a2ce07-340c-48a9-b29d-0347a95aa8a3","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.645915Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:559bc1b0943f4179d0f1046ca1deeca98832bc29ae1849e744a6198fdd6b8a21","observation_id":"3ce97506-2eff-4deb-b347-a0fcd6367b25","resolution":{"observed_at":"2026-08-15T16:25:37.134159Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01263","last_updated":"2024-04-01T11:50:35Z","snapshot_observed_at":"2026-08-14T04:19:38.572552Z","submitted_at":"2023-08-02T16:30:40Z","title":"XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01263","snapshot_observed_at":"2026-08-15T16:25:35.649342Z","title":"R.; Vidgen, B.; Attanasio, G.; Bianchi, F.; and Hovy, D","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.649342Z"},"links":{"cited_paper":"/paper/2308.01263","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7e1feb2014589cd8e46bac43eaa9b6a3ebf95960d6c4d706f51b560fce08b754","observation_id":"e76398f4-5be7-4001-bc36-72747e6bb4ad","resolution":{"observed_at":"2026-08-15T16:25:35.649342Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.118388Z","title":null,"venue":null,"work_id":"bbe86ab0-7878-4de1-9a12-3ed37fc4fbf7","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.653241Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b480e6b33852f73206f72da8c8eada425ce1dba6023aad4e2db0c8ec2450b403","observation_id":"0cf543b4-961c-4339-a167-43334dd940df","resolution":{"observed_at":"2026-08-15T16:25:37.122424Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.01240","last_updated":"2023-03-02T03:54:28Z","snapshot_observed_at":"2026-08-16T16:27:11.895195Z","submitted_at":"2022-10-03T21:34:32Z","title":"Language Models Are Greedy Reasoners: A Systematic Formal Analysis of Chain-of-Thought","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.01240","snapshot_observed_at":"2026-08-15T16:25:35.657150Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.657150Z"},"links":{"cited_paper":"/paper/2210.01240","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:2a957f2c564069870dec3d6ec2eb8d88bab0abc376b8c1622c66c7d4664cf4f7","observation_id":"529d0413-b7ce-4b21-969d-7682e60c144b","resolution":{"observed_at":"2026-08-15T16:25:35.657150Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03348","last_updated":"2023-11-24T12:50:31Z","snapshot_observed_at":"2026-08-16T14:45:33.781904Z","submitted_at":"2023-11-06T18:55:18Z","title":"Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03348","snapshot_observed_at":"2026-08-15T16:25:35.661660Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.661660Z"},"links":{"cited_paper":"/paper/2311.03348","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:00b30720365c051dfcf606c8902a31dc9e4f601be2f0d53428191625c0ac6b10","observation_id":"0054103c-e053-4a9b-87c5-b95df03abe64","resolution":{"observed_at":"2026-08-15T16:25:35.661660Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.105377Z","title":null,"venue":null,"work_id":"6247b603-4c3c-411f-8d77-3025191cc339","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.666208Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e3e93e446a533706c417bda520b0cbdc4af7f91e4337ddb95df58304c1c71e57","observation_id":"399fe1e5-aac0-4f27-a586-77d9448e3b04","resolution":{"observed_at":"2026-08-15T16:25:37.110048Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-08-16T14:51:35.122183Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-15T16:25:35.669919Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.669919Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:adeb3e5ef1a61aadef72f46ec32e45a2d3189004f6a931c77af8d2d5a484f8f1","observation_id":"36314a39-cde8-4e78-9130-60869cbd74c4","resolution":{"observed_at":"2026-08-15T16:25:35.669919Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.093900Z","title":"Do Anything Now","venue":null,"work_id":"29c6f1f1-1c81-45c9-bd3d-088222e7d112","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.673744Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:81aadf0c8f3d335720d64286ab98e3ef973b3c1d7d04f8cb9cf7ede6126f0f9e","observation_id":"9ac3813f-9ba9-4c50-a3b5-403f03f45be1","resolution":{"observed_at":"2026-08-15T16:25:37.097746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03825","last_updated":"2024-05-15T12:06:31Z","snapshot_observed_at":"2026-08-16T09:32:10.049300Z","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.03825","snapshot_observed_at":"2026-08-15T16:25:35.677147Z","title":"Do Anything Now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.677147Z"},"links":{"cited_paper":"/paper/2308.03825","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5826ee6b25180a6850cd2a92a6b8f10b9689621ebd4dcb3484260033c05afce6","observation_id":"d1af0da0-2d5e-4a04-80e3-98009e17e73c","resolution":{"observed_at":"2026-08-15T16:25:35.677147Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.09292","last_updated":"2024-07-17T16:23:28Z","snapshot_observed_at":"2026-08-16T13:34:44.375914Z","submitted_at":"2024-07-12T14:26:14Z","title":"Counterfactual Explainable Incremental Prompt Attack Analysis on Large Language Models","version":2},"cited_work":{"arxiv_id":"2407.09292","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.09292","snapshot_observed_at":"2026-08-15T16:25:36.155292Z","title":"Counterfactual Explainable Incremental Prompt Attack Analysis on Large Language Models","venue":"cs.CR","work_id":"42115274-22d0-4dac-b6d8-cf18d2cb126d","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.681487Z"},"links":{"cited_paper":"/paper/2407.09292","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:068785ffbaebe0bf4a4db70dc27ea6181794a9a0073b97c61e3a44d51824a1ad","observation_id":"0df81bd0-f189-401c-b4da-e05e884a8bfa","resolution":{"observed_at":"2026-08-15T16:25:36.160505Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.10260","last_updated":"2024-08-27T03:32:47Z","snapshot_observed_at":"2026-08-04T21:32:35.483431Z","submitted_at":"2024-02-15T18:58:09Z","title":"A StrongREJECT for Empty Jailbreaks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.10260","snapshot_observed_at":"2026-08-15T16:25:35.685837Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.685837Z"},"links":{"cited_paper":"/paper/2402.10260","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5306e64d8407bfb83e78bf6abaa0172363c5bfc5156493931cd0e9479677ea2a","observation_id":"6d520293-7269-4cab-88c1-5d92ee86b72c","resolution":{"observed_at":"2026-08-15T16:25:35.685837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00761","last_updated":"2025-02-10T18:26:14Z","snapshot_observed_at":"2026-08-16T13:29:08.472050Z","submitted_at":"2024-08-01T17:59:12Z","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00761","snapshot_observed_at":"2026-08-15T16:25:35.689623Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.689623Z"},"links":{"cited_paper":"/paper/2408.00761","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:2732ba98a501e6c17ac25dcd10bd200b736330bc8980edff07c9dd0f23031a89","observation_id":"b5dffa9a-35b4-4ccc-af4a-d3635da1ee57","resolution":{"observed_at":"2026-08-15T16:25:35.689623Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.19786","last_updated":"2025-03-25T15:52:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-03-25T15:52:34Z","title":"Gemma 3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.19786","snapshot_observed_at":"2026-08-15T16:25:35.694213Z","title":"M.; Goedeckemeyer, A.; Saade, A.; Feng, A.; Kolesnikov, A.; Bendebury, A.; Abdagic, A.; Vadi, A.; György, A.; Pinto, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.694213Z"},"links":{"cited_paper":"/paper/2503.19786","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:491543e051b3ea6c99ef22ecf761a507bdd3b3cc1b490ea365b9e3fd905b9069","observation_id":"8e6337e5-00e5-4a69-9bae-f25b6ef9dfa9","resolution":{"observed_at":"2026-08-15T16:25:35.694213Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.698672Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.698672Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:636b2e42812a500ed5a6d95de6bf84d20575de87f7e7ebd1e00c782f685c50ac","observation_id":"9af2336c-692a-4b0d-a3fa-f783b16507e6","resolution":{"observed_at":"2026-08-15T16:25:35.698672Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.21598","last_updated":"2025-03-27T15:19:55Z","snapshot_observed_at":"2026-08-16T12:46:15.666788Z","submitted_at":"2025-03-27T15:19:55Z","title":"Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.21598","snapshot_observed_at":"2026-08-15T16:25:35.702135Z","title":"M.; and Papadimitratos, P","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.702135Z"},"links":{"cited_paper":"/paper/2503.21598","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e5a843532c34c52fbe11fe4617ed3c1d298cb10e23dcd87956608f86ea57b9eb","observation_id":"5655b3f3-d956-4b39-99a4-a1fa20e609ec","resolution":{"observed_at":"2026-08-15T16:25:35.702135Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.13387","last_updated":"2023-09-04T01:47:30Z","snapshot_observed_at":"2026-08-16T15:05:47.548037Z","submitted_at":"2023-08-25T14:02:12Z","title":"Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.13387","snapshot_observed_at":"2026-08-15T16:25:35.706234Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.706234Z"},"links":{"cited_paper":"/paper/2308.13387","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3a78d17c815ff507536319996937803dce829e07d2c28b5390999a21c0ea4994","observation_id":"874015b7-cb02-40d5-924a-cdcdf96b9abf","resolution":{"observed_at":"2026-08-15T16:25:35.706234Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-15T10:16:52.688429Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-15T16:25:35.713916Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.713916Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:68a60c8ed9fa0d4cc06c89843a1a3fe64f5f961cc815c5541e233da5a3a4fa68","observation_id":"51df8078-f20f-4b92-8d42-72156df20f57","resolution":{"observed_at":"2026-08-15T16:25:35.713916Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15641","last_updated":"2024-10-21T05:01:50Z","snapshot_observed_at":"2026-08-16T13:07:33.574456Z","submitted_at":"2024-10-21T05:01:50Z","title":"SMILES-Prompting: A Novel Approach to LLM Jailbreak Attacks in Chemical Synthesis","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15641","snapshot_observed_at":"2026-08-15T16:25:35.717645Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.717645Z"},"links":{"cited_paper":"/paper/2410.15641","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:8305a3cc8eddd1096b93e35ee85a2fb33eaa64360e62c735c5e68fb9b55424a1","observation_id":"54f0fe5f-a4cd-4e81-974e-d7c8efcbbd7b","resolution":{"observed_at":"2026-08-15T16:25:35.717645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.081142Z","title":null,"venue":null,"work_id":"105eb211-1821-4855-9563-27a65b9046ea","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.721358Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:10b2c2a05c2cf8b0f7decf6dc9033b61e44416557388b9fc89a7390ca791939f","observation_id":"e8441d64-02c5-48ec-880f-9169d9c2e1e5","resolution":{"observed_at":"2026-08-15T16:25:37.085522Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.064287Z","title":null,"venue":null,"work_id":"3b50257b-db7a-4b15-b83b-37c06aa4b51a","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.724987Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:8291a705ce13940a0caa4642b325fda99534342311d99fe95e60805c0e330781","observation_id":"b33b4b48-4e00-4557-b1d1-80b2dd061767","resolution":{"observed_at":"2026-08-15T16:25:37.069441Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.16667","last_updated":"2024-07-23T17:34:36Z","snapshot_observed_at":"2026-08-17T05:36:23.549711Z","submitted_at":"2024-07-23T17:34:36Z","title":"RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.16667","snapshot_observed_at":"2026-08-15T16:25:35.728642Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.728642Z"},"links":{"cited_paper":"/paper/2407.16667","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f16491819cba619954adc62aaff85b10cc8ad6837c9a6d3c97e31ff4552d7f2a","observation_id":"7744cce7-13fd-4e4c-a439-05382bd6f77b","resolution":{"observed_at":"2026-08-15T16:25:35.728642Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.049030Z","title":null,"venue":null,"work_id":"6fece501-45d1-48b2-b514-4fd1adc19ea9","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.732524Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c33c709b2b91c769943d7ada3c18e7b93e61b6d1b2ac3bff043a98e4b6e148d4","observation_id":"6600dd76-3429-4677-9637-7463b1b07cf3","resolution":{"observed_at":"2026-08-15T16:25:37.053075Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-08-15T16:25:35.736230Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.736230Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:37cd009d00c3d2b1babf1297a5dea79059e56fd456d5cb686f268ad23fa46d4a","observation_id":"602c5ab8-683e-42e2-b488-b0ba8192c37d","resolution":{"observed_at":"2026-08-15T16:25:35.736230Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.11459","last_updated":"2024-10-15T10:07:15Z","snapshot_observed_at":"2026-08-16T13:09:14.856774Z","submitted_at":"2024-10-15T10:07:15Z","title":"Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.11459","snapshot_observed_at":"2026-08-15T16:25:35.740179Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.740179Z"},"links":{"cited_paper":"/paper/2410.11459","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3e80fedfab1c28460d5a5563157f5d6571b072493ad79d9fbc9698a15a03d015","observation_id":"6737df63-0dd1-4039-b648-154aac2f6535","resolution":{"observed_at":"2026-08-15T16:25:35.740179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.11407","last_updated":"2024-11-18T09:28:58Z","snapshot_observed_at":"2026-08-15T04:36:37.002692Z","submitted_at":"2024-11-18T09:28:58Z","title":"The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.11407","snapshot_observed_at":"2026-08-15T16:25:35.744416Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.744416Z"},"links":{"cited_paper":"/paper/2411.11407","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:a12b1993103d941788c4cb9c3cfb72765b7ffd5e993874f4e5757d89b75b3ad0","observation_id":"7bd9f140-c927-4bba-9625-210afbdebf6d","resolution":{"observed_at":"2026-08-15T16:25:35.744416Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-08-13T01:25:06.346704Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-15T16:25:35.748405Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.748405Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d6ac64ebf66bb436cad964495460dfcf1dc1e38a1630da8566b8c5517f8ddd5e","observation_id":"a969486c-572c-44f7-aaab-60fbad43883b","resolution":{"observed_at":"2026-08-15T16:25:35.748405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.02958","last_updated":"2025-06-17T07:41:08Z","snapshot_observed_at":"2026-08-16T07:14:56.294634Z","submitted_at":"2025-02-05T07:51:32Z","title":"Position: Editing Large Language Models Poses Serious Safety Risks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.02958","snapshot_observed_at":"2026-08-15T16:25:35.752237Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.752237Z"},"links":{"cited_paper":"/paper/2502.02958","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7e1384a18f95f309c5c00987be38b8ef35cbae1f7d9c45c676b7ab36a7432e90","observation_id":"6b76a273-6f9b-4777-8418-4253fb003343","resolution":{"observed_at":"2026-08-15T16:25:35.752237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.17336","last_updated":"2024-09-30T21:25:23Z","snapshot_observed_at":"2026-08-16T23:58:31.409857Z","submitted_at":"2024-03-26T02:47:42Z","title":"Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.17336","snapshot_observed_at":"2026-08-15T16:25:35.760832Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.760832Z"},"links":{"cited_paper":"/paper/2403.17336","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:df2351a52eb234285150dd82a00696703a25d28738e0216eec16ce475c185c70","observation_id":"c7c025be-ad8a-434b-ab31-d3acc0e091cb","resolution":{"observed_at":"2026-08-15T16:25:35.760832Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1905.07830","last_updated":"2019-05-19T23:57:23Z","snapshot_observed_at":"2026-08-15T09:37:44.321271Z","submitted_at":"2019-05-19T23:57:23Z","title":"HellaSwag: Can a Machine Really Finish Your Sentence?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1905.07830","snapshot_observed_at":"2026-08-15T16:25:35.765564Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.765564Z"},"links":{"cited_paper":"/paper/1905.07830","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6829866434ced753cc265ae9c5f767a3bd8fdfd2823c0f4821928296d23a16dc","observation_id":"2d1cdad1-23db-49bf-973b-2304ef7d8878","resolution":{"observed_at":"2026-08-15T16:25:35.765564Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-16T14:27:54.649783Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-15T16:25:35.773425Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":95,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.773425Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:90afa7c01baeda8eec54e07e2b184e37843ba8e1bc61527f3c414552b6d2fffb","observation_id":"f7125f4b-9524-4f2f-bb51-c7472aa3e70c","resolution":{"observed_at":"2026-08-15T16:25:35.773425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07395","last_updated":"2024-10-09T19:46:30Z","snapshot_observed_at":"2026-08-16T13:10:57.033545Z","submitted_at":"2024-10-09T19:46:30Z","title":"LLM Embeddings Improve Test-time Adaptation to Tabular $Y|X$-Shifts","version":1},"cited_work":{"arxiv_id":"2410.07395","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.07395","snapshot_observed_at":"2026-08-15T16:25:35.862352Z","title":"LLM Embeddings Improve Test-time Adaptation to Tabular $Y|X$-Shifts","venue":"cs.LG","work_id":"5f4ed496-f7a6-41b6-8b7f-9245f9026219","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":96,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.777182Z"},"links":{"cited_paper":"/paper/2410.07395","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6cf4a08c410cbd0a3745882ca9283b0fe7684616ca3d85c811bc6536542f8de2","observation_id":"51ede104-63ed-4a65-95df-a7068fb2edba","resolution":{"observed_at":"2026-08-15T16:25:35.868451Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.034110Z","title":null,"venue":null,"work_id":"0bd32fd0-acf6-4ffa-97f9-22e2ac1b6190","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":97,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.781938Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:29eb4b2d30e1d860c4e5a46ffcd32f1bbdfe5d92659530722711a8c196461475","observation_id":"7e84904e-ce8f-4cf2-b123-5d300a9c3e9d","resolution":{"observed_at":"2026-08-15T16:25:37.038890Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.18104","last_updated":"2024-06-10T11:20:43Z","snapshot_observed_at":"2026-08-16T18:08:19.232075Z","submitted_at":"2024-02-28T06:50:14Z","title":"Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.18104","snapshot_observed_at":"2026-08-15T16:25:35.786739Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":98,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.786739Z"},"links":{"cited_paper":"/paper/2402.18104","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:30fd57e89042d13ebe428d99f73971b7fee1f629a70c6bdf61dc4fad427ce00b","observation_id":"7d03a866-8998-4115-942f-ca7cbea3c008","resolution":{"observed_at":"2026-08-15T16:25:35.786739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.11206","last_updated":"2023-05-18T17:45:22Z","snapshot_observed_at":"2026-08-08T19:18:06.171048Z","submitted_at":"2023-05-18T17:45:22Z","title":"LIMA: Less Is More for Alignment","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.11206","snapshot_observed_at":"2026-08-15T16:25:35.790232Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":99,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.790232Z"},"links":{"cited_paper":"/paper/2305.11206","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:0bf96bb3335e426edb91658541a0a9c825939ada11967a9b761a2d80e2f0cbe2","observation_id":"2511efdb-5ff7-41fc-acc9-8bd3f5727caf","resolution":{"observed_at":"2026-08-15T16:25:35.790232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.07827","last_updated":"2024-02-12T17:34:13Z","snapshot_observed_at":"2026-08-16T14:19:15.735686Z","submitted_at":"2024-02-12T17:34:13Z","title":"Aya Model: An Instruction Finetuned Open-Access Multilingual Language Model","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.07827","snapshot_observed_at":"2026-08-15T16:25:35.794271Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":100,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.794271Z"},"links":{"cited_paper":"/paper/2402.07827","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:49c912fe26b41f73885185776ee6f310a820bb16a2e2c737163add4883bd5092","observation_id":"82f303b1-65e0-4869-8233-fc05e3500b2e","resolution":{"observed_at":"2026-08-15T16:25:35.794271Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-16T18:08:21.756485Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs"},"reference_resolution":{"displayed":91,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":85,"verified_exact":4,"verified_fuzzy":2},"total_outbound_references":91},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"thesis":"As of 17 August 2026, this Paper Citation Record lists 91 of 91 outbound references and 1 inbound Pith citation observation for arXiv:2509.08000."}