{"as_of":"2026-08-21T07:51:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:97012520723861697b5493ceb566cc7d4042f147c3b44c4c52049d76fdbf0357","coverage":[{"denominator":67,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":67,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T00:22:49.865192Z","state":"measured"},{"denominator":67,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":67,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-21T06:32:19.484+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.08212/citation-record","integrity":"/paper/2608.08212/integrity","json":"/paper/2608.08212/citation-record.json","paper":"/paper/2608.08212"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2510.11288","last_updated":"2026-04-20T09:09:30Z","snapshot_observed_at":"2026-08-16T04:38:29.771426Z","submitted_at":"2025-10-13T11:23:56Z","title":"Emergent Misalignment via In-Context Learning: Narrow in-context examples can produce broadly misaligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.11288","snapshot_observed_at":"2026-08-12T00:22:49.530177Z","title":"Emergent misalignment via in-context learning: Narrow in-context examples can produce broadly misaligned llms","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.530177Z"},"links":{"cited_paper":"/paper/2510.11288","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:5520700727fcd8f5404fb4d588cc5c83b0626bea6ae5f802fcfe1e1e3d86ed39","observation_id":"30f2de63-4956-4b3a-8e2e-ddeb207cfd9c","resolution":{"observed_at":"2026-08-12T00:22:49.530177Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.054703Z","title":"Many-shot in-context learning","venue":null,"work_id":"0d58123a-085c-4c32-bf48-fb02f6589c90","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.536944Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:74eeed57aa625ef4f7b6b990b5a5ac2581941f15ca0fd99cb49dc62b47d947c3","observation_id":"b3d0543b-02d0-4d6f-ab46-3fcea3315427","resolution":{"observed_at":"2026-08-12T00:22:51.059538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.541983Z","title":"Bowman, Ethan Perez, Roger Grosse, and David Duvenaud","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.541983Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fbf72f9536b25593b7cb586dea8bacf2ded378c927322ce594cfa0a82fc6110b","observation_id":"34b672a5-4256-405a-87d6-ffe7704fd03d","resolution":{"observed_at":"2026-08-12T00:22:49.541983Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.547731Z","title":"Refusal in language models is mediated by a single direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.547731Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:92621a53de7ba2278647ce8558476503d413acf4d3a1adfccb7ab7045b0b579c","observation_id":"9e017570-f999-433d-9489-8145da40862b","resolution":{"observed_at":"2026-08-12T00:22:49.547731Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-16T03:49:00.703994Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-12T00:22:49.552757Z","title":"Bowman, Zac Hatfield-Dodds, Ben Mann, Dario Amodei, Nicholas Joseph, Sam McCandlish, Tom Brown, and Jared Kaplan","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.552757Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:46f68ac4a02eb2714b1153c1c05097028cfb135a3392614e7fec5a13c390fe57","observation_id":"aae8d46c-7a70-48f2-9e1b-da1be140e47c","resolution":{"observed_at":"2026-08-12T00:22:49.552757Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.018074Z","title":"Tell me about yourself: Llms are aware of their learned behaviors","venue":null,"work_id":"b44f4cbf-fb86-4ee6-903c-4e2013819c62","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.558154Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:5a7c17b5b66a0d931791794a214123d10b62a12052de505703f1ecce34e4d82b","observation_id":"639a3367-cad2-4e19-9d0b-8c672c1cfc80","resolution":{"observed_at":"2026-08-12T00:22:51.023208Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.002202Z","title":"Emergent misalignment: Narrow finetuning can produce broadly misaligned LLM s","venue":null,"work_id":"9d81ee82-7e37-4fdc-b9db-fbf050adc547","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.563493Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:cfd5726880ee5af3edd40a352fd6f9982be3ba8477a8769cbbade3b8a42f20f0","observation_id":"7eec4d22-4c79-4d89-8749-33db422aa9f1","resolution":{"observed_at":"2026-08-12T00:22:51.007811Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.21509","last_updated":"2025-09-05T07:44:31Z","snapshot_observed_at":"2026-08-16T18:18:57.742267Z","submitted_at":"2025-07-29T05:20:14Z","title":"Persona Vectors: Monitoring and Controlling Character Traits in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.21509","snapshot_observed_at":"2026-08-12T00:22:49.568072Z","title":"Persona vectors: Monitoring and controlling character traits in language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.568072Z"},"links":{"cited_paper":"/paper/2507.21509","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:b876553849de0a1bb060bf330d71038e7fad30042adb61d289bc31c9c1ed07a3","observation_id":"6987c8c9-ac37-4a9f-81f8-310a38e9980e","resolution":{"observed_at":"2026-08-12T00:22:49.568072Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.985113Z","title":"\\ StruQ \\ : Defending against prompt injection with structured queries","venue":null,"work_id":"9cf7686e-8634-4a8f-8e9b-352161691fb8","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.573255Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:46b8ca10a332abc660fbe79e23196dc1d07e0d647f1a08e3d4cd53ed8ccc6b76","observation_id":"621d6d3f-6678-4dac-ba54-539ce9a0e19f","resolution":{"observed_at":"2026-08-12T00:22:50.991287Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.967860Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":"67b42e65-93c5-4704-a775-471136652bd5","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.578105Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a406917a8cd4ddea0efff35eb98618c7102d9ef68d2e5cca0b02fd4f8baa78c6","observation_id":"555278eb-af8b-4711-8b0d-782113f92ac2","resolution":{"observed_at":"2026-08-12T00:22:50.973490Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.951831Z","title":null,"venue":null,"work_id":"0d27a8fd-b4bb-48f1-9b4c-28d8a62eccbe","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.582662Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e9f37aa407cd88c3754bcf82659c74ccacc7997db16ee77773b3fd06751f041d","observation_id":"287aaccf-420c-43a8-ac28-a9fd9141759d","resolution":{"observed_at":"2026-08-12T00:22:50.956682Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04132","last_updated":"2024-03-07T01:22:38Z","snapshot_observed_at":"2026-08-02T17:55:33.750637Z","submitted_at":"2024-03-07T01:22:38Z","title":"Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04132","snapshot_observed_at":"2026-08-12T00:22:49.587294Z","title":"Chatbot arena: An open platform for evaluating llms by human preference","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.587294Z"},"links":{"cited_paper":"/paper/2403.04132","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:c418f66434dac252a4ed7cd7fac4eedfa9955bfa690edcee4cad31a0f56003db","observation_id":"e6d33028-ef89-4f53-9770-0574c9340885","resolution":{"observed_at":"2026-08-12T00:22:49.587294Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.05466","last_updated":"2024-05-11T04:45:59Z","snapshot_observed_at":"2026-08-20T00:04:24.672577Z","submitted_at":"2024-05-08T23:44:08Z","title":"Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.05466","snapshot_observed_at":"2026-08-12T00:22:49.592032Z","title":"Poser: Unmasking alignment faking llms by manipulating their internals","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.592032Z"},"links":{"cited_paper":"/paper/2405.05466","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:31b915b4d086a25b644005496881b5eb42376ded06c8ef6d24579a959443b09f","observation_id":"2a708400-657c-4e5d-8fd3-9a4a967e2a09","resolution":{"observed_at":"2026-08-12T00:22:49.592032Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.935730Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents","venue":null,"work_id":"d1131db1-089a-4f54-9887-8aa305fb3774","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.597204Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:181ad6c5b1c2e11a1b3403a2c026b5e6f8abaa9ca0e8ead1bd3e70128f75344b","observation_id":"c34faec4-3895-4a1b-915d-106b7bb08079","resolution":{"observed_at":"2026-08-12T00:22:50.941303Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2107.07002","last_updated":"2021-07-14T21:08:30Z","snapshot_observed_at":"2026-08-19T06:03:25.160551Z","submitted_at":"2021-07-14T21:08:30Z","title":"The Benchmark Lottery","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2107.07002","snapshot_observed_at":"2026-08-12T00:22:49.601913Z","title":"Gritsenko, Zhe Zhao, Neil Houlsby, Fernando Diaz, Donald Metzler, and Oriol Vinyals","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.601913Z"},"links":{"cited_paper":"/paper/2107.07002","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:9dfe160b03116a9fc90a8d9b35a7f5c97677f4be12c5471eda61e8c0f8906aa6","observation_id":"0b928a21-9e6c-4d1d-ab14-36878b3288e1","resolution":{"observed_at":"2026-08-12T00:22:49.601913Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.10162","last_updated":"2024-06-29T00:28:47Z","snapshot_observed_at":"2026-08-18T14:49:13.384384Z","submitted_at":"2024-06-14T16:26:20Z","title":"Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.10162","snapshot_observed_at":"2026-08-12T00:22:49.606931Z","title":"Bowman, Ethan Perez, and Evan Hubinger","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.606931Z"},"links":{"cited_paper":"/paper/2406.10162","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:847b1adf0cd888f86834e3fa6db2cf9b6700fa6108184a8675fba04dacc1b871","observation_id":"f2dee1c2-19d9-41ec-9e01-97332837ef01","resolution":{"observed_at":"2026-08-12T00:22:49.606931Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.612207Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.612207Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:933873ccbc3a28f4fcadf2fb688d810b125b1c212f5fdde85a2a6aafd4127369","observation_id":"fe8b9d1e-32ad-40d5-b753-bca601da0d05","resolution":{"observed_at":"2026-08-12T00:22:49.612207Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.617371Z","title":"The hitchhiker ' s guide to testing statistical significance in natural language processing","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.617371Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:39c55f4fe0c79ba8a14c7487e46dc2182827a8cce9c1bc7cf0f28905d8879e29","observation_id":"271749fd-1904-46b7-98f6-0486be589366","resolution":{"observed_at":"2026-08-12T00:22:49.617371Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.04475","last_updated":"2025-03-10T09:27:03Z","snapshot_observed_at":"2026-07-06T17:56:23.317089Z","submitted_at":"2024-04-06T02:29:02Z","title":"Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluators","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.04475","snapshot_observed_at":"2026-08-12T00:22:49.622390Z","title":"Length-controlled alpacaeval: A simple way to debias automatic evaluators","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.622390Z"},"links":{"cited_paper":"/paper/2404.04475","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a2bf84acb958644129aacf9ec9c16f15c93f0187e44a6d0142216e83c1d87508","observation_id":"4cafb2b8-5361-417e-893a-f445a07474bd","resolution":{"observed_at":"2026-08-12T00:22:49.622390Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.920041Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks","venue":null,"work_id":"70354176-0f74-4103-8b40-ee0e4073347d","year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.627513Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:bf55bf72fcbe75f2161054df61e31a16f6a5ab03dc4ee77ec419461d9826bba1","observation_id":"011eecbf-38bf-4d25-b9a0-115bb38a7fa3","resolution":{"observed_at":"2026-08-12T00:22:50.925148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.632374Z","title":"Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.632374Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:97b1210a3ff17969b7559402edb204af8532d389a820250bd14d62b210b2a831","observation_id":"7ed41a84-9f6d-476d-b3c1-03ad84828a3a","resolution":{"observed_at":"2026-08-12T00:22:49.632374Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.903162Z","title":"Position: Anthropomorphic misalignment research needs stronger evidence","venue":null,"work_id":"cb0ac595-67f9-4e7b-953f-155abfdea3d6","year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.637059Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:80790dc4d777c5ea6d5797e08719b5db73afde62f419878b9a4a6b5239525e34","observation_id":"f3b8397d-f8b9-4ca6-8209-559019f8cdd5","resolution":{"observed_at":"2026-08-12T00:22:50.908290Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-20T21:11:43.445033Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-12T00:22:49.641681Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.641681Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e6815f8ca130a7fad1ca68f543aedef18fbe7cf1601a1fb21734f2c17f4f1ba7","observation_id":"a7ddc839-af7e-409e-a758-618ac23869c1","resolution":{"observed_at":"2026-08-12T00:22:49.641681Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05566","last_updated":"2024-01-17T20:26:01Z","snapshot_observed_at":"2026-08-15T14:10:05.296241Z","submitted_at":"2024-01-10T22:14:35Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05566","snapshot_observed_at":"2026-08-12T00:22:49.646499Z","title":"Sleeper agents: Training deceptive llms that persist through safety training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.646499Z"},"links":{"cited_paper":"/paper/2401.05566","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fd085a95df3c9dc5dedf7d22c7f358209a4a2cd715611d4aec5f5a09273c0bf8","observation_id":"707eb619-952f-477e-9c6a-ad3ac84840bb","resolution":{"observed_at":"2026-08-12T00:22:49.646499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.21038","last_updated":"2025-08-25T20:17:00Z","snapshot_observed_at":"2026-08-19T20:02:43.262792Z","submitted_at":"2025-04-28T07:38:43Z","title":"Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.21038","snapshot_observed_at":"2026-08-12T00:22:49.651555Z","title":"Prefill-level jailbreak: A black-box risk analysis of large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.651555Z"},"links":{"cited_paper":"/paper/2504.21038","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:c3b300f5a1168fadabd2551712a956612f79b92e90526e47732661d4ff086389","observation_id":"3af5cd8e-7a50-4e32-8e75-375ad1ea6fba","resolution":{"observed_at":"2026-08-12T00:22:49.651555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09110","last_updated":"2023-10-01T21:44:23Z","snapshot_observed_at":"2026-08-10T23:10:13.900680Z","submitted_at":"2022-11-16T18:51:34Z","title":"Holistic Evaluation of Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09110","snapshot_observed_at":"2026-08-12T00:22:49.656331Z","title":"Manning, Christopher Ré, Diana Acosta-Navas, Drew A","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.656331Z"},"links":{"cited_paper":"/paper/2211.09110","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:188f4224ad1b133951d483facf127ebc56ca026802ac3c46f78ea061d65ebe58","observation_id":"943297e2-9f8b-4204-809a-eb77597ee23e","resolution":{"observed_at":"2026-08-12T00:22:49.656331Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.661445Z","title":"T ruthful QA : Measuring how models mimic human falsehoods","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.661445Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:f629d037aba300d443ff8cdb642d09b83d7dc980ce9a80eb767fc0aee5933286","observation_id":"a957594b-48bf-4dee-a815-a3bdbd0f359b","resolution":{"observed_at":"2026-08-12T00:22:49.661445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1807.03341","last_updated":"2018-07-26T12:54:30Z","snapshot_observed_at":"2026-08-16T21:16:05.764247Z","submitted_at":"2018-07-09T18:59:17Z","title":"Troubling Trends in Machine Learning Scholarship","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1807.03341","snapshot_observed_at":"2026-08-12T00:22:49.666283Z","title":"Lipton and Jacob Steinhardt","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.666283Z"},"links":{"cited_paper":"/paper/1807.03341","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:4453aef3d759a9e0ee55c03b3adaa260d85572d7ae45d1317826fe53119a063f","observation_id":"6cc4a7ec-b8ed-41f7-b751-0b973dd54bc7","resolution":{"observed_at":"2026-08-12T00:22:49.666283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.671474Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.671474Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:2ae69299a5394a10ed126c469c4d641ad04cb324b21690bdb1f2cbb31674d4db","observation_id":"b0bfcf0f-6a85-4219-a202-965e0d18b19c","resolution":{"observed_at":"2026-08-12T00:22:49.671474Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.877676Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks","venue":null,"work_id":"fc1a3511-babf-44c7-a0dd-b2ee8a2c3b1e","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.676173Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:6130df3d5299f6d73d20ed3f55ca3f1afe45a2a3bf86237f39b78c45a802e7cc","observation_id":"6b497d54-f1bd-41c8-a238-7675a2f36cde","resolution":{"observed_at":"2026-08-12T00:22:50.882879Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.681164Z","title":"Fantastically ordered prompts and where to find them: Overcoming few-shot prompt order sensitivity","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.681164Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a09912c06fcdf33c8ca7ab9110a7d0ca7057e6e30522a37cd94557be83c27c61","observation_id":"44779ca1-8a59-498b-9a96-739c8251ba73","resolution":{"observed_at":"2026-08-12T00:22:49.681164Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.862799Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":"9e0727d9-fc54-41f3-aa3c-23523007d4b7","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.686546Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:9e0560cc73b4d126384c5134fc0268d24299b392f5374a92ae2be92fedaa5cae","observation_id":"6097cff1-42b8-4d28-88d9-1490e17c7d2d","resolution":{"observed_at":"2026-08-12T00:22:50.867771Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.691804Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.691804Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:5a744b429c2684a1b1f011ebb82ac4565ca484b982243e38b1ac6254cffc35d9","observation_id":"06198c22-fefc-4138-8fc5-8c0afef9c2a1","resolution":{"observed_at":"2026-08-12T00:22:49.691804Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.11895","last_updated":"2022-09-24T00:43:19Z","snapshot_observed_at":"2026-08-18T21:12:50.808922Z","submitted_at":"2022-09-24T00:43:19Z","title":"In-context Learning and Induction Heads","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.11895","snapshot_observed_at":"2026-08-12T00:22:49.696753Z","title":"In-context learning and induction heads","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.696753Z"},"links":{"cited_paper":"/paper/2209.11895","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:414865397236c5444cef8062dbf93c7326519640a852254c8b876e0ed63e66ae","observation_id":"f8ca78fb-49b4-49c5-82ed-3ef9b3d422ba","resolution":{"observed_at":"2026-08-12T00:22:49.696753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.701739Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.701739Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:ee0e09bcda5f7e26e9334f319441d99881a734bdf7a115f9343e7d2c27836c6c","observation_id":"7b11e404-96c9-4ba4-903d-ad3ed9c08048","resolution":{"observed_at":"2026-08-12T00:22:49.701739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.706357Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.706357Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:711f4b97ff7da4daa657782d35be591bb43233bb624da868466447ecc8e784d9","observation_id":"e62d3fa4-7db8-4f62-86f7-a53fcf23a849","resolution":{"observed_at":"2026-08-12T00:22:49.706357Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.847853Z","title":null,"venue":null,"work_id":"cf8bed6e-716b-43d2-9b41-35959fda0db3","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.711447Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e3893430210f7831eb1df4c54698937ebdb3e684d5503b9d6a5f633c98995aac","observation_id":"8af15e0e-5c6a-4abe-9cd6-e04a16c2ecd4","resolution":{"observed_at":"2026-08-12T00:22:50.852490Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.830838Z","title":"Safety alignment should be made more than just a few tokens deep","venue":null,"work_id":"01e157e6-2fed-4c0e-b374-c8a94f390a3d","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.716887Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:4d942007b477124e7f96de394326aa3bae7b62f0ce68a53cb4e8f4376c312ae0","observation_id":"6c9fde20-01e1-4d2f-ade2-8b20f8760903","resolution":{"observed_at":"2026-08-12T00:22:50.836554Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.721543Z","title":"Steering llama 2 via contrastive activation addition","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.721543Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:7f408cb86339f63f002256448f47239f23d92e7b3d5e5be2718e164fa8f1cb80","observation_id":"1d6c92fa-476f-4f9b-a90e-df61fb8bfc51","resolution":{"observed_at":"2026-08-12T00:22:49.721543Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.814473Z","title":"In-context impersonation reveals large language models' strengths and biases","venue":null,"work_id":"1cf71da6-0c2f-43ac-bba2-12736022ae83","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.726219Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:d79bf247a76b50666dab991790e0ab533969ff37244a51ffb5beeb2253f4c659","observation_id":"d797a939-59dc-4ca1-8447-11448dabf0ef","resolution":{"observed_at":"2026-08-12T00:22:50.819833Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.796740Z","title":"Quantifying language models' sensitivity to spurious features in prompt design or: How i learned to start worrying about prompt formatting","venue":null,"work_id":"fc9e73cb-4fb2-4bf3-b2a7-fc42a9638e23","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.731100Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:cfd0683780643cbc997f25adc6b1888f6086955818a6ad4752619c22fda11aa4","observation_id":"08a2ffe9-6d5a-4180-add7-e0ecdb619067","resolution":{"observed_at":"2026-08-12T00:22:50.802724Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.16367","last_updated":"2023-05-25T11:36:52Z","snapshot_observed_at":"2026-08-16T15:29:47.050417Z","submitted_at":"2023-05-25T11:36:52Z","title":"Role-Play with Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.16367","snapshot_observed_at":"2026-08-12T00:22:49.735823Z","title":"Role-play with large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.735823Z"},"links":{"cited_paper":"/paper/2305.16367","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:8b5efeef5a1dc6c0ecc2ea57f86b18c9d655a8cd4529ff52d45a5679256a21e8","observation_id":"a32a04f3-3381-4b68-9e3d-45ef6dab5ac0","resolution":{"observed_at":"2026-08-12T00:22:49.735823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.779883Z","title":"Judging the judges: A systematic study of position bias in llm-as-a-judge","venue":null,"work_id":"8adf25dc-1ea9-4353-9674-b816264b10ed","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.741322Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:213ddf9afb06d4ab4b22bdd7b3364094c5d9d70663abf3bc19a0f63ce397b798","observation_id":"f48c357c-f6d7-4264-9f4b-5f2b0b83337d","resolution":{"observed_at":"2026-08-12T00:22:50.784805Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.11618","last_updated":"2025-06-20T17:23:55Z","snapshot_observed_at":"2026-08-14T04:57:36.012123Z","submitted_at":"2025-06-13T09:39:54Z","title":"Convergent Linear Representations of Emergent Misalignment","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.11618","snapshot_observed_at":"2026-08-12T00:22:49.747675Z","title":"Convergent linear representations of emergent misalignment","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.747675Z"},"links":{"cited_paper":"/paper/2506.11618","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:2a2b3fb91d01100923ac97a43645847b2d845701abf91c46b7489a03c8bf4d90","observation_id":"e00827f3-94be-42f4-bccf-f8692ea9bdba","resolution":{"observed_at":"2026-08-12T00:22:49.747675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.752615Z","title":"Extracting latent steering vectors from pretrained language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.752615Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:de7934f00ce7ad6446de3c7c65b6109ec729c6994f152cedd57e8d5041d61cb6","observation_id":"094bf606-34ba-4f86-8738-0cc34bc864e2","resolution":{"observed_at":"2026-08-12T00:22:49.752615Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.763875Z","title":"Function vectors in large language models","venue":null,"work_id":"92558521-a5ff-42fa-ab61-1fedddf7afea","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.757488Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:ae0d6fa41132f48140aa0d73cf121f57e4d5c88dda4ac5f28f129feabd456db0","observation_id":"66c2b156-72be-4896-8993-2f3a708ed2b0","resolution":{"observed_at":"2026-08-12T00:22:50.768991Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.10248","last_updated":"2024-10-10T13:20:13Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-08-20T12:21:05Z","title":"Steering Language Models With Activation Engineering","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.10248","snapshot_observed_at":"2026-08-12T00:22:49.761954Z","title":"Vazquez, Ulisse Mini, and Monte MacDiarmid","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.761954Z"},"links":{"cited_paper":"/paper/2308.10248","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:cba8da7226cd063dcb7bf82d1e53ef94bf965cb321661c676bf1234e1273e59a","observation_id":"1c5d85c5-f224-4b3b-a920-24e93a739553","resolution":{"observed_at":"2026-08-12T00:22:49.761954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.11613","last_updated":"2025-06-13T09:34:25Z","snapshot_observed_at":"2026-08-17T09:29:38.464156Z","submitted_at":"2025-06-13T09:34:25Z","title":"Model Organisms for Emergent Misalignment","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.11613","snapshot_observed_at":"2026-08-12T00:22:49.766759Z","title":"Model organisms for emergent misalignment","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.766759Z"},"links":{"cited_paper":"/paper/2506.11613","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fdf676ff4873b8070030742294496ddba7de41dabe0f369f6ab7ad04555005aa","observation_id":"0cf35d45-3bd8-4b67-9c32-630c9aa32987","resolution":{"observed_at":"2026-08-12T00:22:49.766759Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.748098Z","title":"Transformers learn in-context by gradient descent","venue":null,"work_id":"2827e4c7-01d4-4642-9281-eda98e29157d","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.771799Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a34a3b5ef66442b014d7314c998ddfc04e7ed4bb253d51344dc6db7308856811","observation_id":"46490b72-1a8e-4619-94d6-c86174bfc50e","resolution":{"observed_at":"2026-08-12T00:22:50.753509Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-12T00:22:49.776344Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.776344Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:73a2a4a31ec9ddfbec9113735c57e0605864fbe00989293154c213676206de57","observation_id":"ec7a35d9-4bfe-4929-b435-e965a9bdbed7","resolution":{"observed_at":"2026-08-12T00:22:49.776344Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.781324Z","title":"Label words are anchors: An information flow perspective for understanding in-context learning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.781324Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:83518836673a63eb5f0713933deb63c3a014616271239dfdd235b03041908a7f","observation_id":"4b094c50-97c1-44ba-9ddd-1ed45fe2be86","resolution":{"observed_at":"2026-08-12T00:22:49.781324Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.786015Z","title":"Chi, Samuel Miserendino, Jeffrey Wang, Achyuta Rajaram, Johannes Heidecke, Tejal Patwardhan, and Dan Mossing","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.786015Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:3d01b85559d42b39383790a826c226afd83110aba02382f97e6977590e6197bc","observation_id":"eacf70e9-5587-4eab-b86e-fe3c99366590","resolution":{"observed_at":"2026-08-12T00:22:49.786015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.732072Z","title":"Large language models are not fair evaluators","venue":null,"work_id":"c65e0f0d-f76e-4ec8-8655-c125de337ab7","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.790803Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:8ba4e864da2b384b5f465a9d2b7c3d7b8faf85b0db9de23617138e50c36ec647","observation_id":"04ec2cc2-764e-4977-81da-a5b56ba5ba9c","resolution":{"observed_at":"2026-08-12T00:22:50.737327Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.795389Z","title":"Evaluating general-purpose ai with psychometrics","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.795389Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a7006727797d39557e57f95017824eda971015f726e0aad94f81f1e299d3bfdf","observation_id":"bde5495e-709a-4086-a340-311f6d4c8a40","resolution":{"observed_at":"2026-08-12T00:22:49.795389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.801300Z","title":"Do-not-answer: Evaluating safeguards in LLM s","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.801300Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e4663990e299948398a24593518dd5e3f7aad29f4e7b02ff225259426c464e92","observation_id":"9b8fbc86-2e1b-4f95-958e-c74bc8a148af","resolution":{"observed_at":"2026-08-12T00:22:49.801300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.03846","last_updated":"2023-03-08T07:37:43Z","snapshot_observed_at":"2026-08-18T13:27:58.239266Z","submitted_at":"2023-03-07T12:24:17Z","title":"Larger language models do in-context learning differently","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.03846","snapshot_observed_at":"2026-08-12T00:22:49.806663Z","title":"Larger language models do in-context learning differently","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.806663Z"},"links":{"cited_paper":"/paper/2303.03846","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a9585bdf22a918702c091e00b0de53236bdc038ee45b1ae0ec588f12353172f6","observation_id":"776dc142-fc57-413a-9d1c-f245d7b12027","resolution":{"observed_at":"2026-08-12T00:22:49.806663Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2111.02080","last_updated":"2022-07-21T07:44:13Z","snapshot_observed_at":"2026-08-10T22:45:29.185791Z","submitted_at":"2021-11-03T09:12:33Z","title":"An Explanation of In-context Learning as Implicit Bayesian Inference","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2111.02080","snapshot_observed_at":"2026-08-12T00:22:49.812498Z","title":"An explanation of in-context learning as implicit bayesian inference","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.812498Z"},"links":{"cited_paper":"/paper/2111.02080","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:4c73eceb0ce988d91a5084990936c5fc97bc05fe9906ac3dd7aa8fe8d14f62cb","observation_id":"fabcc8f9-20fb-44f8-bf08-f210d668cb7c","resolution":{"observed_at":"2026-08-12T00:22:49.812498Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.817510Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.817510Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:d6c7ea0dcf713b26c39d6c9b261bb8d667024f1d260c4b00b577cd382af51aa0","observation_id":"062e3273-9fc6-479b-b782-78e195b40aba","resolution":{"observed_at":"2026-08-12T00:22:49.817510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.822368Z","title":"I njec A gent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.822368Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:3b61ddaba478337954648155d11c815ab953a9bf02be000b3ec1ac4cd89261d3","observation_id":"81dc7557-ccf9-4bdd-a4ff-f3a5204d5ccf","resolution":{"observed_at":"2026-08-12T00:22:49.822368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.828046Z","title":"Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.828046Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:517c298c41b038e8397baed247d6169b733246adeb4987b8e9956b98c048214e","observation_id":"06574918-5741-401b-9df0-05fae534f09f","resolution":{"observed_at":"2026-08-12T00:22:49.828046Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.715840Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents","venue":null,"work_id":"b94fe8c5-28a2-48d9-8025-b312fb76c189","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.834320Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:3efde870a8796624cc3c221a0b4d5fc631491a31d4ff7d578e80474569e1432f","observation_id":"1d1f2b9f-31a1-47ff-a9c4-0d1878712b65","resolution":{"observed_at":"2026-08-12T00:22:50.721180Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.839228Z","title":"S afety B ench: Evaluating the safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.839228Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:5145d002bece3f81532cc29208cf594418447ff79d1020ecb1ba41e7c087151b","observation_id":"a3b41a47-a730-45b7-a7cf-40bb8f09ad11","resolution":{"observed_at":"2026-08-12T00:22:49.839228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.844506Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.844506Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:5f1456d2df10de927b8218be6a72b741bbcca21babd351d74f70c74e90f5c0c7","observation_id":"1462a989-03ce-4f85-97d9-9d494000fb1b","resolution":{"observed_at":"2026-08-12T00:22:49.844506Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.849554Z","title":"Poisoning retrieval corpora by injecting adversarial passages","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.849554Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:00b6e05492b6fe730c8c4d951f0fac79940c91cbd9a911b958c45ab551dae34d","observation_id":"5c8999f8-653f-426f-80c7-79ea91de4597","resolution":{"observed_at":"2026-08-12T00:22:49.849554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-12T00:22:49.854619Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.854619Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:7d19e1d1055da8675f3695ebbf973b83de009bb29da261bc16c98d266b21c105","observation_id":"82694d33-960d-4e7a-9b63-4501ef836839","resolution":{"observed_at":"2026-08-12T00:22:49.854619Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-12T00:22:49.859617Z","title":"Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.859617Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:373ce2c58c28fe900a448a0f9f09b874e4b4552127e146ab69d76f4ee9409e91","observation_id":"b92a93f7-de49-400c-bc3c-92b6e4798c5b","resolution":{"observed_at":"2026-08-12T00:22:49.859617Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.687927Z","title":"Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models","venue":null,"work_id":"8bda5f75-dea7-4c94-bf60-3df5d3841f99","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.865192Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:2bb74554d749c0b065d2245fb94b8715042a0c85207d3b453a2b172a07d22692","observation_id":"8a726419-49b6-41ea-9824-9c1fbdc9142f","resolution":{"observed_at":"2026-08-12T00:22:50.694801Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-21T06:32:19.484+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","latest_version":1,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-19T21:39:15.841192Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment"},"reference_resolution":{"displayed":67,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":48,"verified_exact":0,"verified_fuzzy":19},"total_outbound_references":67},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"thesis":"As of 21 August 2026, this Paper Citation Record lists 67 of 67 outbound references and 0 inbound Pith citation observations for arXiv:2608.08212."}