{"id":"W4407185097","doi":"10.48550/arxiv.2502.01925","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","year":2025,"lang":"en","type":"preprint","venue":"ArXiv.org","topic":"Adversarial Robustness in Machine Learning","field":"Computer Science","cited_by":0,"is_retracted":false,"has_abstract":true,"ca_institutions":"","funders":"Natural Sciences and Engineering Research Council of Canada; Government of Canada; Canadian Institute for Advanced Research","keywords":"Shot (pellet); Sampling (signal processing); Computer science; Psychology; Chemistry; Telecommunications","routes":{"ca_aff":false,"ca_fund":true,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":true},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.0007110633,0.0005772239,0.000573879,0.0003332114,0.0007885974,0.0004168996,0.001103787,0.0004038972,0.00001261806],"category_scores_gemma":[0.0006062613,0.0006238075,0.000142099,0.0004710908,0.0001700738,0.0009977799,0.00312219,0.001553906,0.00001435127],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0002687131,"about_ca_system_score_gemma":0.00037423,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0004640715,"about_ca_topic_score_gemma":0.00003978821,"domain_scores_codex":[0.9966461,0.000405969,0.0006956297,0.001338619,0.0004097452,0.0005039175],"domain_scores_gemma":[0.9968978,0.0008571817,0.0008024918,0.0007965132,0.0005086199,0.0001373931],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0002528659,0.0002884844,0.2741512,0.001086584,0.001635494,0.0002185223,0.04987005,0.2420692,0.003277477,0.07909585,0.00008118714,0.3479731],"study_design_scores_gemma":[0.0008913568,0.0001101318,0.1988453,0.00123283,0.0001944642,0.00005392125,0.0007226211,0.7807462,0.002797619,0.01311324,0.00003904265,0.001253279],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.1163863,0.0002466569,0.8796293,0.0006608063,0.0008534814,0.0006282279,0.00002035984,0.0003446007,0.001230242],"genre_scores_gemma":[0.8365642,0.00002846431,0.1627145,0.000249509,0.0002486897,0.0000620108,0.00003387915,0.0000249473,0.0000737759],"genre_candidate":"methods","genre_consensus":null,"teacher_disagreement_score":0.7201779,"threshold_uncertainty_score":0.9996213,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.0412861917263239,"score_gpt":0.2938946394752073,"score_spread":0.2526084477488834,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}