{"as_of":"2026-08-14T18:38:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:66ef3dee546796531f228832dfd009c4fb1e7a6626facf3588bfbb73e9f0fd03","coverage":[{"denominator":44,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":44,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-02T06:30:57.585806Z","state":"measured"},{"denominator":44,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":44,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.14147/citation-record","integrity":"/paper/2607.14147/integrity","json":"/paper/2607.14147/citation-record.json","paper":"/paper/2607.14147"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:51.484354Z","title":"International Conference on Learning Representations (ICLR) , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:51.484354Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:a8ad0a022213a49316ae03404c38e6cb3f4e592cc0d016a6fccc67abe2ef7ec4","observation_id":"df200c88-f912-46fe-9c1a-cf8ee85f9bcd","resolution":{"observed_at":"2026-08-02T06:30:51.484354Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:51.565855Z","title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:51.565855Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:526519267677c56d8a2f7985e76dca9110de3fe1cf8a6b63f1d13a834998b8b7","observation_id":"9d0e9505-e038-4ef6-9c7f-77710fd6ff79","resolution":{"observed_at":"2026-08-02T06:30:51.565855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:51.857128Z","title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:51.857128Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:982daffb60cc64a4ff0c1918f61d4e5bbbd3ec5ecaa309aed4d10cbe698fa1ea","observation_id":"15fcd98a-b060-4801-8af1-cc49e43e8891","resolution":{"observed_at":"2026-08-02T06:30:51.857128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:52.210431Z","title":"and Guo, K","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:52.210431Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:acd61f0e444f7b59f614b2564224511755278d7657e888521844a90ba6035414","observation_id":"9bb78f12-f9f3-4ce2-be76-08e0e9b3376e","resolution":{"observed_at":"2026-08-02T06:30:52.210431Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:52.586943Z","title":"BlackboxNLP Workshop , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:52.586943Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:96e8c6e70ffe46cbdac21c8714b7bb24b9a67cff16449bfa2fa623ea6607da1c","observation_id":"5647f612-1ef6-4037-8356-3e471cd1d3d4","resolution":{"observed_at":"2026-08-02T06:30:52.586943Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:52.729064Z","title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:52.729064Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:f7f7a79585242fb43bb92ae1f591daa4f8e411314d6f5ee453a14012597664d5","observation_id":"d3db1c2e-74c4-4ce7-ae4a-38abe2b86bd3","resolution":{"observed_at":"2026-08-02T06:30:52.729064Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:52.791346Z","title":"NAACL , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:52.791346Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:bdbe636c25e99c40236524e53cef31771aa776d486ab85ac507659aca3ecb9fe","observation_id":"7d2c4e6f-3470-45de-a6cd-c74dcef5d52b","resolution":{"observed_at":"2026-08-02T06:30:52.791346Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:52.859621Z","title":"2026 , howpublished =","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:52.859621Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:7054db3566120c8a8d24791c5bff2d028fe96aef0747c8cdc19592db251fc838","observation_id":"b3dd62ce-13ad-4363-8759-cca3d4f8b9f4","resolution":{"observed_at":"2026-08-02T06:30:52.859621Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.224053Z","title":", year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.224053Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:2b396e0b7e175b47ad70da036e1414ac0e028057725b15f6cb7c845f41419c8e","observation_id":"c5675ead-84e6-4952-b418-9c4bdd0c6585","resolution":{"observed_at":"2026-08-02T06:30:53.224053Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.302184Z","title":"Catastrophic Jailbreak of Open-source","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.302184Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:6291419b5885c8d04055ba677c83a3891bd361536c4fe160a6b06882e3ca3d1c","observation_id":"63ce70c7-27a6-45a8-a09d-39ede7f6888a","resolution":{"observed_at":"2026-08-02T06:30:53.302184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.422009Z","title":"Think You Have Solved Question Answering? Try","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.422009Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:5fb2384fb0497dff06e379801277b6ff8188f380e7b52099288823493b9a985d","observation_id":"d716021f-8fb1-4964-a39d-aac893415aed","resolution":{"observed_at":"2026-08-02T06:30:53.422009Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.528719Z","title":"Which Agent Causes Task Failures and When? On Automated Failure Attribution of","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.528719Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:0c3e33f76115d7e18abff7567cc433c4a5241f7cb5aa13ce1d9336abf7f17753","observation_id":"b7e9a1de-4f94-4f60-b462-474168c1c2d2","resolution":{"observed_at":"2026-08-02T06:30:53.528719Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.690667Z","title":"Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations , pages =","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.690667Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:02dcd85eeaafbdf9811a335ed40690295d7d7ed142381250a6bdb99109e1e84a","observation_id":"507b4e42-50fd-457e-ab8d-21744068cc00","resolution":{"observed_at":"2026-08-02T06:30:53.690667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.857418Z","title":"Advances in Neural Information Processing Systems (NeurIPS) , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.857418Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:a512aecc301f470cf91bdafa30d9856efb1c9daadf2f3394bf4d78ee166f1a36","observation_id":"8b4013b2-691d-443a-8178-b36d08622fbb","resolution":{"observed_at":"2026-08-02T06:30:53.857418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:53.944415Z","title":"Journal of Machine Learning Research , volume =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:53.944415Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:be163acaa4028a656f709109a0aed71799ffedc66ab447f288b79e920daa4ec2","observation_id":"44b7fa37-8b3a-46c7-a919-c9bd54058df4","resolution":{"observed_at":"2026-08-02T06:30:53.944415Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.14219","last_updated":"2024-08-30T21:17:17Z","snapshot_observed_at":"2026-08-10T14:07:02.234322Z","submitted_at":"2024-04-22T14:32:33Z","title":"Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.14219","snapshot_observed_at":"2026-08-02T06:30:54.033545Z","title":"Phi-3 technical report: A highly capable language model locally on your phone","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.033545Z"},"links":{"cited_paper":"/paper/2404.14219","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:541e48fdb4128b70d93b91366710d09f14b07f87c2ec91cc8a3389a371a30ce9","observation_id":"8b50241c-85c4-4de9-b334-12ccbdb6ccc4","resolution":{"observed_at":"2026-08-02T06:30:54.033545Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.02737","last_updated":"2025-02-04T21:43:16Z","snapshot_observed_at":"2026-08-14T05:03:05.661970Z","submitted_at":"2025-02-04T21:43:16Z","title":"SmolLM2: When Smol Goes Big -- Data-Centric Training of a Small Language Model","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.02737","snapshot_observed_at":"2026-08-02T06:30:54.093344Z","title":"Smollm2: When smol goes big -- data-centric training of a small language model","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.093344Z"},"links":{"cited_paper":"/paper/2502.02737","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:7f665931fa0ebac1f7e47005adc0599c9c873055679ae908dc8c06f15c308dc5","observation_id":"923f07c8-eff0-4ca8-9b1d-82c03acb122f","resolution":{"observed_at":"2026-08-02T06:30:54.093344Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.11717","last_updated":"2024-10-30T18:57:07Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-17T16:36:12Z","title":"Refusal in Language Models Is Mediated by a Single Direction","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.11717","snapshot_observed_at":"2026-08-02T06:30:54.196799Z","title":"Refusal in language models is mediated by a single direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.196799Z"},"links":{"cited_paper":"/paper/2406.11717","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:f96d3d486cb7303896e3987c31449004e6c360bf140e7cd1a2c092a163ac5368","observation_id":"fb22f92b-2d6e-4398-ad1a-8fd1a1793758","resolution":{"observed_at":"2026-08-02T06:30:54.196799Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:54.296338Z","title":"What features in prompts jailbreak llms? investigating the mechanisms behind attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.296338Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:d993ac585ef178283f7d6e89f2015f3c0c35580a7c71679d730115e9a9eb25dc","observation_id":"ca5aadf8-cf17-4b91-9b66-a7519657a5d8","resolution":{"observed_at":"2026-08-02T06:30:54.296338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.12726","last_updated":"2026-07-09T09:24:42Z","snapshot_observed_at":"2026-08-11T01:29:27.858821Z","submitted_at":"2026-05-12T20:30:24Z","title":"Before the Last Token: Diagnosing Final-Token Safety Probe Failures","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.12726","snapshot_observed_at":"2026-08-02T06:30:54.427031Z","title":"Before the last token: Diagnosing final-token safety probe failures","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.427031Z"},"links":{"cited_paper":"/paper/2605.12726","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:24bac17d324a6ad17d391ebf3842d07488753eb0acafe1aeb87a3f0eb1a7ad67","observation_id":"415a905c-23db-48d8-a56d-cbb56e48baff","resolution":{"observed_at":"2026-08-02T06:30:54.427031Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:54.594655Z","title":"Arcanum prompt injection taxonomy","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.594655Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:dd86e60da750c0e480a15b9e131e784d682b2e84b4d7262c0f20c2c4793987be","observation_id":"20f6e9c9-cbc4-4d71-a8c2-d1936b93d2b6","resolution":{"observed_at":"2026-08-02T06:30:54.594655Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:54.769346Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.769346Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:2ed48acc476ff5ba343bbe7ec680831b02135be66b24501aa0989ce88fcab31f","observation_id":"1d592932-b1f2-4557-a19f-940be68fc7d7","resolution":{"observed_at":"2026-08-02T06:30:54.769346Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06987","last_updated":"2023-10-10T20:15:54Z","snapshot_observed_at":"2026-07-06T16:30:46.321160Z","submitted_at":"2023-10-10T20:15:54Z","title":"Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06987","snapshot_observed_at":"2026-08-02T06:30:54.931280Z","title":"Catastrophic jailbreak of open-source LLMs via exploiting generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:54.931280Z"},"links":{"cited_paper":"/paper/2310.06987","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:1efe71aa8e5a9c1f63d3ac52ee43ac2d948e160d37f72857dbf3f7dc96ff99d4","observation_id":"1b365633-993d-4c42-92e2-0b4d58f41721","resolution":{"observed_at":"2026-08-02T06:30:54.931280Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-02T06:30:55.091334Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.091334Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:9a337e1ea3901c23740b987d7b1539c27e9c484e034962757220c5e45aac70d9","observation_id":"7f491374-b78d-4e27-a488-091acdda10af","resolution":{"observed_at":"2026-08-02T06:30:55.091334Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.14744","last_updated":"2025-06-23T06:11:32Z","snapshot_observed_at":"2026-08-07T18:01:22.772663Z","submitted_at":"2025-02-20T17:14:34Z","title":"HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden States","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.14744","snapshot_observed_at":"2026-08-02T06:30:55.207937Z","title":"Jiang, X","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.207937Z"},"links":{"cited_paper":"/paper/2502.14744","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:2a78e4d84192921d91ae7fe9db9ace88aeb8018155e95ef98032a8367b0afb9c","observation_id":"be50c1f4-ba70-4939-be24-6620ae2bb353","resolution":{"observed_at":"2026-08-02T06:30:55.207937Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:55.313505Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.313505Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:6a1821452711cf86112a619d945ae556f07764966a2816d4b729325cbd5a2b23","observation_id":"3f97aa5c-0fa7-46fe-bc60-1a31d2ea3caa","resolution":{"observed_at":"2026-08-02T06:30:55.313505Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2607.03598","last_updated":"2026-07-03T20:49:37Z","snapshot_observed_at":"2026-08-14T13:56:41.662469Z","submitted_at":"2026-07-03T20:49:37Z","title":"They Infer What You Meant: Models Represent Communicative Intent More Reliably Than They Act On It","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2607.03598","snapshot_observed_at":"2026-08-02T06:30:55.454000Z","title":"They infer what you meant: Models represent communicative intent more reliably than they act on it","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.454000Z"},"links":{"cited_paper":"/paper/2607.03598","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:7cecaba70909da217bb2e8f2be04de3ecb810b598698581d151a686c9215a692","observation_id":"5518f8a9-0b0d-4239-aff8-99f5d3fdfdcb","resolution":{"observed_at":"2026-08-02T06:30:55.454000Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.21038","last_updated":"2025-08-25T20:17:00Z","snapshot_observed_at":"2026-08-12T01:20:17.298418Z","submitted_at":"2025-04-28T07:38:43Z","title":"Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.21038","snapshot_observed_at":"2026-08-02T06:30:55.577560Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.577560Z"},"links":{"cited_paper":"/paper/2504.21038","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:89f5724219590ccb07d42566ec28c7a393a0b22abde47e5aefc21ab8e21c5cb2","observation_id":"074e01f3-5f73-4ca1-bd9b-859ab30fa036","resolution":{"observed_at":"2026-08-02T06:30:55.577560Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.05262","last_updated":"2023-01-13T15:16:16Z","snapshot_observed_at":"2026-08-13T01:40:21.606634Z","submitted_at":"2022-02-10T18:59:54Z","title":"Locating and Editing Factual Associations in GPT","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.05262","snapshot_observed_at":"2026-08-02T06:30:55.735960Z","title":"Locating and editing factual associations in gpt","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.735960Z"},"links":{"cited_paper":"/paper/2202.05262","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:2e4291c9c01c97c30077f71f61c61de8c521d407f0727174bf8f1aea9766942b","observation_id":"acd5e376-82aa-4604-a0d9-afa751ed6fa2","resolution":{"observed_at":"2026-08-02T06:30:55.735960Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:55.952145Z","title":"Pytorch: An imperative style, high-performance deep learning library","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:55.952145Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:8ecfdf8f212226e997233419f8c22de54540080714c91bcded88e37d9f169f47","observation_id":"38200510-10ac-437d-8e64-518b75d22ad4","resolution":{"observed_at":"2026-08-02T06:30:55.952145Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:56.114183Z","title":"Scikit-learn: Machine learning in python","venue":null,"work_id":null,"year":2011},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.114183Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:5249e7f7a6214fbb92dec31335de705f4e0a3cfe197ea60546f8a22f62a5288b","observation_id":"60cdd544-a2da-4832-b3a9-8698c54cf68f","resolution":{"observed_at":"2026-08-02T06:30:56.114183Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.05946","last_updated":"2024-06-10T00:35:23Z","snapshot_observed_at":"2026-08-12T23:46:49.092229Z","submitted_at":"2024-06-10T00:35:23Z","title":"Safety Alignment Should Be Made More Than Just a Few Tokens Deep","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.05946","snapshot_observed_at":"2026-08-02T06:30:56.251349Z","title":"Safety alignment should be made more than just a few tokens deep","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.251349Z"},"links":{"cited_paper":"/paper/2406.05946","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:56f8250af56b8fff1d319c58ea1c3349666dda85244568b6588184fff44c190d","observation_id":"54e89284-a98d-4c11-8add-40007f5d5d99","resolution":{"observed_at":"2026-08-02T06:30:56.251349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.15115","last_updated":"2025-01-03T02:18:21Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-12-19T17:56:09Z","title":"Qwen2.5 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.15115","snapshot_observed_at":"2026-08-02T06:30:56.355016Z","title":"Qwen2.5 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.355016Z"},"links":{"cited_paper":"/paper/2412.15115","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:6bacc5ac8b147109223ae4c4ca4370746b83c061de4aa32d7b85acbd69f97254","observation_id":"7b160040-6e0a-4f45-9244-f75d8d1a9334","resolution":{"observed_at":"2026-08-02T06:30:56.355016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01263","last_updated":"2024-04-01T11:50:35Z","snapshot_observed_at":"2026-08-14T04:19:38.572552Z","submitted_at":"2023-08-02T16:30:40Z","title":"XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01263","snapshot_observed_at":"2026-08-02T06:30:56.465152Z","title":"Xstest: A test suite for identifying exaggerated safety behaviours in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.465152Z"},"links":{"cited_paper":"/paper/2308.01263","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:887a68f05c646c9e14668788528b89344db1b6bbef6aebfaa22af08bdce86c8e","observation_id":"77d348d4-989c-415f-8233-89b4325eacb5","resolution":{"observed_at":"2026-08-02T06:30:56.465152Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:56.607129Z","title":"Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.607129Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:c95b7b1c67722efad0102c03b66d1b1d247faeb0075dab6aa9f6d296bb6c5894","observation_id":"2cf8436d-1764-4e0e-9e72-e5d0acc30d5c","resolution":{"observed_at":"2026-08-02T06:30:56.607129Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-08T18:11:45.725753Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-02T06:30:56.670122Z","title":"Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems (NeurIPS), 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.670122Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:2ce07a1ae6a70b67d0a1bb3cd7af178ed5166e54f2bdd78e3dcacc8823bfbd49","observation_id":"b2c6376f-b701-4b36-9a19-1227d8562983","resolution":{"observed_at":"2026-08-02T06:30:56.670122Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:56.786859Z","title":"Transformers: State-of-the-art natural language processing","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.786859Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:e3710a441584edf86a0efa43d48162564b4eb4553e434f29d337be084a607ad8","observation_id":"a5b8f13a-3dc1-4bff-874e-9de5715323a7","resolution":{"observed_at":"2026-08-02T06:30:56.786859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:56.868524Z","title":"Zhang, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.868524Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:a39fdcbf915de6ed4dc77cf883e9279c94898fffa91b99d0e793715e3389135c","observation_id":"1d0dae8b-2032-4f5f-bc6f-a33cfe7a3eaa","resolution":{"observed_at":"2026-08-02T06:30:56.868524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.00212","last_updated":"2025-06-02T03:25:55Z","snapshot_observed_at":"2026-08-14T17:45:13.727805Z","submitted_at":"2025-04-30T23:09:44Z","title":"Which Agent Causes Task Failures and When? On Automated Failure Attribution of LLM Multi-Agent Systems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.00212","snapshot_observed_at":"2026-08-02T06:30:56.999697Z","title":"Which agent causes task failures and when? on automated failure attribution of LLM multi-agent systems","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:56.999697Z"},"links":{"cited_paper":"/paper/2505.00212","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:42d002a78add7d9f9502f98003ec5311f1c9842540e571acc96d8049e4ac4e4d","observation_id":"01477f78-7530-4dde-b7eb-922974ec845e","resolution":{"observed_at":"2026-08-02T06:30:56.999697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.07557","last_updated":"2025-02-11T13:50:50Z","snapshot_observed_at":"2026-08-11T19:18:54.639349Z","submitted_at":"2025-02-11T13:50:50Z","title":"JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.07557","snapshot_observed_at":"2026-08-02T06:30:57.107494Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:57.107494Z"},"links":{"cited_paper":"/paper/2502.07557","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:c14d36dc25b4755eb38f2c133cf7a1d0e544463eac64fe3873c0fea6e37ffdd7","observation_id":"027ce574-3505-4a46-b27a-6034f87b5816","resolution":{"observed_at":"2026-08-02T06:30:57.107494Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:57.210550Z","title":"Zhang, T","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:57.210550Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:114fe8587f1b4e5594a8f22f1b3476c2425cf09d5c62f96fb65c5cae09840267","observation_id":"cb764111-1690-49cf-b86d-588f9ad8906e","resolution":{"observed_at":"2026-08-02T06:30:57.210550Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T06:30:57.331387Z","title":"Advprefix: An objective for nuanced llm jailbreaks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:57.331387Z"},"links":{"citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:af3d9d30c8824e53612d3b8240b5860db4d48d3b2de7165d83a817471b7ebb81","observation_id":"dc6ee59f-46ba-45b8-8bcd-47b207960a76","resolution":{"observed_at":"2026-08-02T06:30:57.331387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-02T06:30:57.467173Z","title":"Representation engineering: A top-down approach to ai transparency","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:57.467173Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:df2ca28ce78d80e80fd11106cf73e4bcf4b731c5a55f3734bf8ed83e5532f431","observation_id":"10b8cbda-00c7-4fde-be39-84d18798c58b","resolution":{"observed_at":"2026-08-02T06:30:57.467173Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-02T06:30:57.585806Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-02T06:30:57.585806Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2607.14147"},"observation_digest":"sha256:580a739137f70080f16585e9eab9ddf134888d8e2993b60611d3bd2bafe90fba","observation_id":"3ab08afe-e139-494c-8ada-84ea7fce3676","resolution":{"observed_at":"2026-08-02T06:30:57.585806Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.14147","last_updated":"2026-07-14T09:30:34Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-13T14:08:04.409272Z","submitted_at":"2026-07-14T09:30:34Z","title":"Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak"},"reference_resolution":{"displayed":44,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":44,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":44},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 44 of 44 outbound references and 0 inbound Pith citation observations for arXiv:2607.14147."}