{
  "slug": "inference_time_safety",
  "generated": "2026-05-08",
  "status": "public-draft-source-linted",
  "verified_public": [
    {
      "id": "arxiv:2404.02151",
      "title": "Simple Adaptive Attacks on LLM Defenses",
      "role": "Bill 7 and Bill 13 adaptive-attacker public anchor"
    },
    {
      "id": "arxiv:2406.13352",
      "title": "AgentDojo",
      "role": "Bill 14 cross-deployment-surface public anchor"
    },
    {
      "id": "anthropic:constitutional-classifiers",
      "title": "Constitutional Classifiers",
      "role": "Bill 17 partial-closure candidate, not a clean break"
    }
  ],
  "quarantined": [
    {
      "id": "source_lint_quarantine:2503.14211",
      "reason": "Prior steering/cross-surface row quarantined pending public-source verification.",
      "replacement_status": "Not used as public evidence."
    },
    {
      "id": "source_lint_quarantine:2407.06908",
      "reason": "Prior HOLISTIC-style safety row quarantined pending public-source verification.",
      "replacement_status": "Not used as public evidence."
    },
    {
      "id": "source_lint_quarantine:2410.18234",
      "reason": "Prior Hu-Sharma-Belinkov equivalence row quarantined pending public-source verification.",
      "replacement_status": "Not used as public evidence."
    },
    {
      "id": "source_lint_quarantine:2411.07984",
      "reason": "Universal-jailbreak row quarantined in classifier benchmark.",
      "replacement_status": "Not used as public evidence."
    },
    {
      "id": "source_lint_quarantine:2501.07404",
      "reason": "Prior AISI row quarantined pending public-source verification.",
      "replacement_status": "Not used as public evidence."
    }
  ],
  "internal_or_synthesis": [
    {
      "id": "bills_draft.md",
      "role": "Bill definitions, meta-costs, escape gates, and public-summary counts."
    },
    {
      "id": "corpus_batch_1.json",
      "role": "Batch 1 corpus export."
    },
    {
      "id": "bill_classifier_benchmark.json",
      "role": "Classifier benchmark fixtures."
    }
  ],
  "notes": [
    "Anthropic Constitutional Classifiers is recorded as partial closure rather than full breakage."
  ]
}