{"as_of":"2026-08-15T15:38:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:255f747e419cf7e5af63a6dcc168d76778c746be5ca30426d7977b03a2279a07","coverage":[{"denominator":30,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":30,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T12:44:04.461847Z","state":"measured"},{"denominator":35,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":35,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":5,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":5,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T20:49:20.247547Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"cited_work":{"arxiv_id":"2510.02999","doi":"10.48550/arxiv.2510.02999","metadata_source":"arxiv_reference","pith_arxiv_id":"2510.02999","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"CoRRabs/2510.02999(2025).https://doi.org/ 10.48550/ARXIV.2510.02999,https://doi.org/10.48550/arXiv.2510.02999 Title Suppressed Due to Excessive Length 25","venue":"ArXiv.org","work_id":"ee58edc7-6068-428b-bf28-12bf49a0e00c","year":2025},"citing_paper":{"arxiv_id":"2605.10764","last_updated":"2026-06-29T08:36:15Z","snapshot_observed_at":"2026-08-14T11:40:57.330485Z","submitted_at":"2026-05-11T15:59:02Z","title":"Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-12T03:37:02.206788Z"},"links":{"cited_paper":"/paper/2510.02999","citing_paper":"/paper/2605.10764"},"observation_digest":"sha256:4d1eb94c1719478ff74a9ff8a87e87ebe029c6b93bab4729ce369719ebadf024","observation_id":"ab0e3d04-815c-404d-a926-28f32950a061","resolution":{"observed_at":"2026-07-09T01:19:04.946819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"cited_work":{"arxiv_id":"2510.02999","doi":"10.48550/arxiv.2510.02999","metadata_source":"arxiv_reference","pith_arxiv_id":"2510.02999","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"CoRRabs/2510.02999(2025).https://doi.org/ 10.48550/ARXIV.2510.02999,https://doi.org/10.48550/arXiv.2510.02999 Title Suppressed Due to Excessive Length 25","venue":"ArXiv.org","work_id":"ee58edc7-6068-428b-bf28-12bf49a0e00c","year":2025},"citing_paper":{"arxiv_id":"2605.10764","last_updated":"2026-06-29T08:36:15Z","snapshot_observed_at":"2026-08-14T11:40:57.330485Z","submitted_at":"2026-05-11T15:59:02Z","title":"Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-30T22:36:35.008744Z"},"links":{"cited_paper":"/paper/2510.02999","citing_paper":"/paper/2605.10764"},"observation_digest":"sha256:6d9daf2cc209b548edbcecb7eff40cf4ad797b3d7d55ea46af03cfc173b2ed9f","observation_id":"4d471524-fb69-49e7-a637-52a4588d4159","resolution":{"observed_at":"2026-07-09T01:19:04.946819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"cited_work":{"arxiv_id":"2510.02999","doi":"10.48550/arxiv.2510.02999","metadata_source":"arxiv_reference","pith_arxiv_id":"2510.02999","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"CoRRabs/2510.02999(2025).https://doi.org/ 10.48550/ARXIV.2510.02999,https://doi.org/10.48550/arXiv.2510.02999 Title Suppressed Due to Excessive Length 25","venue":"ArXiv.org","work_id":"ee58edc7-6068-428b-bf28-12bf49a0e00c","year":2025},"citing_paper":{"arxiv_id":"2605.24817","last_updated":"2026-05-24T02:06:44Z","snapshot_observed_at":"2026-08-12T14:46:06.700910Z","submitted_at":"2026-05-24T02:06:44Z","title":"RouteScan: A Non-Intrusive Approach to Auditing MoE LLMs Safety via Expert Routing Telemetry","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-30T00:33:35.235214Z"},"links":{"cited_paper":"/paper/2510.02999","citing_paper":"/paper/2605.24817"},"observation_digest":"sha256:cf67329198a9686a6edd2c91c7db4c8b6ee99abc7b8abb83c0577940cf67779f","observation_id":"ca9c06c3-4896-4420-bc99-9c0576a0a024","resolution":{"observed_at":"2026-07-09T01:19:04.946819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.02999","snapshot_observed_at":"2026-08-01T11:40:26.849024Z","title":"Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19829","last_updated":"2026-07-22T07:08:59Z","snapshot_observed_at":"2026-08-11T08:08:11.528412Z","submitted_at":"2026-07-22T07:08:59Z","title":"DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-01T11:40:26.849024Z"},"links":{"cited_paper":"/paper/2510.02999","citing_paper":"/paper/2607.19829"},"observation_digest":"sha256:b97440e9c1358a12a1a392f126195ba7aa584812c26c81f1caecde7c2c6718fe","observation_id":"e8aaf750-6a18-4fec-9160-935d9589216e","resolution":{"observed_at":"2026-08-01T11:40:26.849024Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.02999","snapshot_observed_at":"2026-08-12T20:49:20.247547Z","title":"arXiv:2510.02999","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.10621","last_updated":"2026-08-11T08:08:41Z","snapshot_observed_at":"2026-08-14T23:10:58.386334Z","submitted_at":"2026-08-11T08:08:41Z","title":"ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-12T20:49:20.247547Z"},"links":{"cited_paper":"/paper/2510.02999","citing_paper":"/paper/2608.10621"},"observation_digest":"sha256:f2324cfcd1ef779b4ed9544d1aa843d55ca0eb79634c478737671dd6e2f2956f","observation_id":"f3717779-6bdb-480c-86bb-46559091b8f2","resolution":{"observed_at":"2026-08-12T20:49:20.247547Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2510.02999/citation-record","integrity":"/paper/2510.02999/integrity","json":"/paper/2510.02999/citation-record.json","paper":"/paper/2510.02999"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:01.737579Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.737579Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:84d197fbd692b75129d731f91ec2524902db33858dd91720c2bcc40b69ca0064","observation_id":"82f96f9a-b0a9-4f8f-ac2d-7706310b02d7","resolution":{"observed_at":"2026-08-04T12:44:01.737579Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:01.801628Z","title":"Detecting language model attacks with perplexity, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.801628Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:32d7f50c2cbb8c1f1a352f3290d9f69dc9d53ef7c228f7d8247e209876a49ba6","observation_id":"f8c0db2f-5f99-4ce6-aee7-d9bdc022b6e6","resolution":{"observed_at":"2026-08-04T12:44:01.801628Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:01.838175Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.838175Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:c65de81675ee31f8e8c2a0b723a0be9c540bb7306470f757f78f08acb9f45b34","observation_id":"fbf97da5-0632-4a24-b406-ea975802cafa","resolution":{"observed_at":"2026-08-04T12:44:01.838175Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:01.853490Z","title":"When llm meets drl: Advancing jailbreaking efficiency via drl-guided search, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.853490Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:420211e752f1aa50dd5492cc1b54edbea8ec534887d31090d14e6540780cc82a","observation_id":"f4e7b09f-f16f-44a9-bf22-7d086c6f9127","resolution":{"observed_at":"2026-08-04T12:44:01.853490Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:01.906304Z","title":"The llama 3 herd of models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.906304Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:6da41bcd93cd23d435f31c8a37dd842b0e3c4a326f29f9589af293ebae390243","observation_id":"0655558e-3480-4fac-8b8a-c19c5d93c94a","resolution":{"observed_at":"2026-08-04T12:44:01.906304Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.12948","last_updated":"2026-01-04T03:57:36Z","snapshot_observed_at":"2026-08-15T12:33:55.451951Z","submitted_at":"2025-01-22T15:19:35Z","title":"DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.12948","snapshot_observed_at":"2026-08-04T12:44:01.973418Z","title":"Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:01.973418Z"},"links":{"cited_paper":"/paper/2501.12948","citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:1bbe3352ef46695c5dead64d6bdfbdb914d2094a2fb4ed4d2c97aaa5666f57e0","observation_id":"65e9bb05-6045-47f1-947a-ed2c986149ff","resolution":{"observed_at":"2026-08-04T12:44:01.973418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.127701Z","title":"COLD -attack: Jailbreaking LLM s with stealthiness and controllability","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.127701Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:af7a2e7d9b3c2d96db40b0deeb29b2ce1f48a791a51a3ccf3a76d8baaa516081","observation_id":"f85f29fa-0e5a-4a00-9619-75833c22f9b9","resolution":{"observed_at":"2026-08-04T12:44:02.127701Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.271719Z","title":"Dualbreach: Efficient dual-jailbreaking via target-driven initialization and multi-target optimization, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.271719Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:d8d24e9a65f11634443d120d08a162b15a52bf8669b4c96b25eae9c75a1ed4db","observation_id":"a5e43586-68ea-4a67-8ec3-00cd0cc12845","resolution":{"observed_at":"2026-08-04T12:44:02.271719Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.387598Z","title":"Baseline defenses for adversarial attacks against aligned language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.387598Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:cb044b170dc2b1d7084af4e53a3e428475236a1ee12c807680815e8cc416e664","observation_id":"3f93b502-44bc-4e6f-83d2-814a79c7a246","resolution":{"observed_at":"2026-08-04T12:44:02.387598Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.442919Z","title":"Improved techniques for optimization-based jailbreaking on large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.442919Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:5a36e019618eef0b9a289d6b304ed9c3ef515507dc8abdd9d76e17ab21e5eba6","observation_id":"fff08df8-39aa-41d5-b004-62c15b0ab9fb","resolution":{"observed_at":"2026-08-04T12:44:02.442919Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-04T12:44:02.493204Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.493204Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:ce2e1bb8ba57d10b2a2fecee4a99e333a749eccae842de7923913ee2e41f7a74","observation_id":"8bfc140f-61b2-4c86-86fb-b6828864a443","resolution":{"observed_at":"2026-08-04T12:44:02.493204Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.560937Z","title":"Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.560937Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:d796c72c720de652f73b120bc87295d9873bbb39f7d871fd8149a7bf380a4091","observation_id":"7dba98d0-cf5b-4e8a-99c1-a17eb67de622","resolution":{"observed_at":"2026-08-04T12:44:02.560937Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.617654Z","title":"Advancing adversarial suffix transfer learning on aligned large language models, 2024 a","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.617654Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:613b68587fe280e6e8ab21015697aaef6a84a496dc85f7814cf00f0dc41c9ad9","observation_id":"58e52490-cba5-4881-a061-cd720e76e114","resolution":{"observed_at":"2026-08-04T12:44:02.617654Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.722697Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.722697Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:61b64911e4e1f82b01d398512368f15a5470adb174b0c56119adbd829be5a6a2","observation_id":"44b3c29d-f3e4-46b4-8285-6587885d555d","resolution":{"observed_at":"2026-08-04T12:44:02.722697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.854141Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.854141Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:c44ea75c1f40721c062f3267f1bb0f6b559ae4fde0eec0ad2930429a1fe971f8","observation_id":"3cd4317f-86a4-4275-8337-adf3c5de1c7a","resolution":{"observed_at":"2026-08-04T12:44:02.854141Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:02.945466Z","title":"Language models are unsupervised multitask learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:02.945466Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:8cc55c364c96126303d6b98a8e01312b52509552f5f6cc8949068645b1f3dc28","observation_id":"d5e3f272-3013-4265-819e-714de8ba0ef3","resolution":{"observed_at":"2026-08-04T12:44:02.945466Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.057308Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.057308Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:78ae29a3ca26c4b3fab344b222a986cb53d50b17993c4149c66ba440c4ce7cd4","observation_id":"99627969-14ce-4bd0-b05e-fe0ea133414e","resolution":{"observed_at":"2026-08-04T12:44:03.057308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.124554Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.124554Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:5ad9e29ac761e9c1d4461b1c06c4dee8abca22eed24f58ec88608010fb41d17c","observation_id":"32d837dd-7eaa-4fe7-8d42-732477ff0ded","resolution":{"observed_at":"2026-08-04T12:44:03.124554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.210753Z","title":"Dynamic target attack, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.210753Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:53dd462518c81501319791141d372b4b7befba3a0d5294a538b24d3c44c29ef8","observation_id":"7806188e-7aba-43ba-b7d4-a4f9f494df4e","resolution":{"observed_at":"2026-08-04T12:44:03.210753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.321275Z","title":"Qwen2 technical report, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.321275Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:afed111c411040817bb28a830c001c2a4d1d597aa1c75fbe2f5c20fe47daba94","observation_id":"b17adb40-a580-4eb9-9260-f52588f8032d","resolution":{"observed_at":"2026-08-04T12:44:03.321275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.446300Z","title":"Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.446300Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:b8972faa23aaec2b79bf94331ec9afbeceeafd9f0b51ae159f73c2f9854a8911","observation_id":"619c801a-228a-4d86-9dfc-d5b11d3d7384","resolution":{"observed_at":"2026-08-04T12:44:03.446300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.545057Z","title":"How johnny can persuade LLM s to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLM s","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.545057Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:685f01f45aa6392b7bd49ae51fa141ddf7af8b8d9d419673b0f122b6fac1196b","observation_id":"92389e98-7191-44e0-a0a7-55c69ca94434","resolution":{"observed_at":"2026-08-04T12:44:03.545057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.688438Z","title":"A survey of large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.688438Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:285b29cfb5949a8b3987c9ce7bf7d214ab71f43d51018be53f0ed2e19d19de9a","observation_id":"a48dec15-8ace-45e8-854b-6c682d6fe931","resolution":{"observed_at":"2026-08-04T12:44:03.688438Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.750088Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.750088Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:af1e3a7b23eb1d18414207a441c1766d55e7897fb4b193958d4e1ef8130ec958","observation_id":"f4366f98-df0b-4921-9643-28e5a42d7dde","resolution":{"observed_at":"2026-08-04T12:44:03.750088Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.877815Z","title":"Don't say no: Jailbreaking llm by suppressing refusal, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.877815Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:7c857a4998d45aa37401dda35a9e8c43daf7e11e322921ebb4df69d2fc444e71","observation_id":"f3904a3b-a2ad-48a4-8344-8b8da8182906","resolution":{"observed_at":"2026-08-04T12:44:03.877815Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:03.993700Z","title":"Advprefix: An objective for nuanced llm jailbreaks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:03.993700Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:cef6ed7874538fb86c8a44e7fe739d4dcf4b3b3596368603e7e89d9008e0a530","observation_id":"cf7c6c90-be23-4f6a-ac7c-75d7edf1e75e","resolution":{"observed_at":"2026-08-04T12:44:03.993700Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:04.106273Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:04.106273Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:ab6914ca9bfb8a513a57ee8cd4532698c069ca055c80fe18e09ec81c43bef2dd","observation_id":"333e0d5b-f6d2-40cd-b99a-810623c48468","resolution":{"observed_at":"2026-08-04T12:44:04.106273Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:04.216844Z","title":"@esa (Ref","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:04.216844Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:22515d88d80232873a19eaf5dc0b894b3c5febb84d7098ceb436e80449e6f2fb","observation_id":"dcd6837f-5457-4384-a74a-a6b412d7e5da","resolution":{"observed_at":"2026-08-04T12:44:04.216844Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:04.364109Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:04.364109Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:a8f3cd51466247a827f5686bcf604d55a54acba0966de04953a711bf41c296f2","observation_id":"35a50faf-5cfd-4624-b20b-e546bc9580f5","resolution":{"observed_at":"2026-08-04T12:44:04.364109Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T12:44:04.461847Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack","version":5},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-04T12:44:04.461847Z"},"links":{"citing_paper":"/paper/2510.02999"},"observation_digest":"sha256:8f60d69c37d84abb0655bc4e060f062fcf36abe1733223ae6184cd9150dc0d65","observation_id":"846fbc99-492c-400e-a1ed-32a4121e9599","resolution":{"observed_at":"2026-08-04T12:44:04.461847Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2510.02999","last_updated":"2026-07-08T01:24:56Z","latest_version":5,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-13T14:06:52.403728Z","submitted_at":"2025-10-03T13:38:56Z","title":"NonTextual Target Attack"},"reference_resolution":{"displayed":30,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":30,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":30},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 15 August 2026, this Paper Citation Record lists 30 of 30 outbound references and 5 inbound Pith citation observations for arXiv:2510.02999."}