ai-research-survey

scan-v5.json (29814B)

---

 {
   "scan_version": 5,
   "paper_type": "empirical",
   "paper": {
     "title": "Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks",
     "authors": [
       "Maksym Andriushchenko",
       "Francesco Croce",
       "Nicolas Flammarion"
     ],
     "year": 2024,
     "venue": "ICLR 2025",
     "arxiv_id": "2404.02151",
     "doi": null
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 100% ASR on all listed models via adaptive attacks; Tables 1–4 and Table 22 provide per-model empirical confirmation across 21 models using GPT-4 judge.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The causal claim that 'adaptivity is crucial' is supported by controlled ablation studies comparing prompt-only vs. prompt+RS vs. prompt+RS+self-transfer (Table 2), with clear incremental improvement at each stage.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Results are explicitly bounded to 50 AdvBench behaviors curated by Chao et al. (2023) and specific named model API versions; the paper does not claim the attacks generalize to arbitrary harmful requests or future model variants.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses GPT-4 judge false positives (~20% for Claude 2.1, Table 19), compares four judges (GPT-4, rule-based, Llama-3-70B, Llama Guard 2, Table 20), and acknowledges that 10/10 scores do not guarantee practical attacker utility.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states 'Even a perfect jailbreak score (10/10) from the GPT-4 judge does not always imply that the generated content is actually beneficial for an attacker,' clearly distinguishing the proxy measure from real-world harm.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 is titled 'Discussion, Recommendations, and Limitations' and contains a dedicated Limitations paragraph addressing judge reliability, false positive rates, and unevaluated defenses.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats are quantified: ~20% false positive rate for Claude 2.1 (Table 19), Llama Guard 2 shows only 86% ASR on Phi-3 vs. GPT-4 judge's 100% (Table 20), and adaptive attacks against test-time defenses like SmoothLLM are explicitly noted as out of scope.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states evaluation is limited to 50 AdvBench behaviors, specific API snapshots (e.g., gpt-3.5-turbo-1106), and notes that test-time defenses require separate work; Section A.2 clarifies the adaptive attack definition boundary.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements disclose: Google Fellowship, Open Phil AI Fellowship, unrestricted gift from Google, and Swiss National Science Foundation grant 212111.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors are listed as affiliated with EPFL; no author is employed by any of the companies whose models are evaluated.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Google funds the paper via an unrestricted gift but Google's own Gemma model is shown 100% vulnerable; the paper attacks all major labs equally and the gift is explicitly described as unrestricted.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present; the acknowledgements list funding sources but do not declare whether authors have equity, patents, or consulting relationships with OpenAI, Anthropic, Meta, or Google.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Section A.2 formally defines 'adaptive attacks' as 'attacks that are specifically designed to target a given defense'; Section 3.1 gives a mathematical formulation of the jailbreaking objective; success is defined as GPT-4 judge score of 10/10.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The 'Contributions' paragraph explicitly enumerates four algorithmic contributions: manually designed prompt template, random search on logprobs, self-transfer, and prefilling attack for Claude.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 systematically categorizes prior work into manual, direct search, and LLM-assisted attacks; the paper directly compares ASR against GCG, PAIR, TAP, PAP on the same models and task in each results table.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": true,
           "justification": "The abstract provides a GitHub URL (https://github.com/tml-epfl/llm-adaptive-attacks) with code, logs, and jailbreak artifacts in JailbreakBench format.",
           "source": "haiku"
         },
         "data_released": {
           "applies": true,
           "answer": true,
           "justification": "Evaluation uses 50 behaviors from AdvBench (Zou et al., 2023) curated by Chao et al. (2023), which are publicly available standard benchmarks used unmodified.",
           "source": "haiku"
         },
         "environment_specified": {
           "applies": true,
           "answer": false,
           "justification": "The paper mentions 'a single A100 GPU with an implementation based on HuggingFace transformers' but provides no requirements.txt, Dockerfile, or versioned dependency specification.",
           "source": "haiku"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": true,
           "justification": "Algorithm 1 gives a formal random search procedure; full prompt templates are in Figure 1 and Tables 6–14; code with logs is released on GitHub enabling end-to-end reproduction.",
           "source": "haiku"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": false,
           "justification": "No confidence intervals or error bars are reported for any ASR results; all results are presented as single-run point estimates.",
           "source": "haiku"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "No statistical significance tests are applied when comparing attack success rates across methods; differences are reported as raw percentage point changes without any hypothesis testing.",
           "source": "haiku"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "Effect sizes are implicitly reported as percentage point improvements with baseline context (e.g., 0% prompt alone → 50% prompt+RS → 100% prompt+RS+self-transfer on Llama-2-Chat-7B vs. prior best 92%).",
           "source": "haiku"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "The 50-behavior test set is adopted from Chao et al. (2023) for comparability but no power analysis or sample size justification is provided to confirm it reliably estimates 100% ASR.",
           "source": "haiku"
         },
         "variance_reported": {
           "applies": true,
           "answer": false,
           "justification": "ASR results are single-run point estimates; Figure 3 shows logprob variance for GPT-4 Turbo queries but variance across repeated attack runs is not reported for any ASR metric.",
           "source": "haiku"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Extensive baselines included throughout: GCG, PAIR, TAP, PAP, AIM, and persona modulation are compared per-model in Tables 2–4 and Table 22.",
           "source": "haiku"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "All major baselines (GCG 2023, PAIR 2023, TAP 2023, PAP 2024) are recent and state-of-the-art at time of writing; no suspiciously weak or outdated baselines.",
           "source": "haiku"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Table 2 ablates attack components (prompt only vs. prompt+RS vs. prompt+RS+self-transfer); Figure 4 ablates suffix length (5–60 tokens); Tables 15–17 ablate restart count and request structure for Claude.",
           "source": "haiku"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Four evaluation judges are used: GPT-4 semantic judge (primary), rule-based judge from Zou et al., Llama-3-70B judge, and Llama Guard 2; Table 20 compares all four across representative models.",
           "source": "haiku"
         },
         "human_evaluation": {
           "applies": false,
           "answer": false,
           "justification": "No systematic human evaluation; manual inspection of generations is mentioned only to flag false positives for Claude 2.1, which is quality control rather than evaluation.",
           "source": "haiku"
         },
         "held_out_test_set": {
           "applies": false,
           "answer": false,
           "justification": "Not applicable: adversarial suffixes are optimized per-request on the same 50 behaviors used for evaluation; this is not a prediction task requiring train/test splits.",
           "source": "haiku"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": false,
           "justification": "Results are broken down by model and attack method but no breakdown by behavior category (violence vs. hate speech vs. misinformation) is provided within the 50 AdvBench behaviors.",
           "source": "haiku"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "Failure cases are explicitly analyzed: transfer attacks get 0% on Claude 2.1 and Claude 3 Opus (Table 4), long suffixes cause off-topic generation (Figure 4), and false positive failure modes are documented (Table 19).",
           "source": "haiku"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "Negative results are prominently reported: prompt alone achieves 0% on Llama-2-Chat (Table 2), the standard template is completely ineffective on GPT-4o (0%), and self-transfer is explicitly noted as ineffective against R2D2.",
           "source": "haiku"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": true,
           "justification": "Exact API checkpoint names are specified: gpt-3.5-turbo-1106, gpt-4-1106-preview, gpt-4o-2024-05-13; open-weight models are specified with parameter count and release context.",
           "source": "haiku"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "Full prompt templates are provided in Figure 1 (main template), Table 6 (in-context prompt), Table 7 (GPT-4o custom prompt), and Tables 8–14 (system prompts for each model family) with all fill values specified.",
           "source": "haiku"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": true,
           "justification": "Key hyperparameters reported: suffix length 25 tokens (ablated in Figure 4), up to 10,000 iterations, up to 10 random restarts, target token 'Sure', contiguous token modification schedule.",
           "source": "haiku"
         },
         "scaffolding_described": {
           "applies": false,
           "answer": false,
           "justification": "No agentic scaffolding is used; the attack is direct API interaction with random search optimization, fully described in Algorithm 1.",
           "source": "haiku"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "The 50-behavior subset of AdvBench is cited to Chao et al. (2023) with the selection criterion noted; no further preprocessing beyond behavior selection is required.",
           "source": "haiku"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": true,
           "justification": "The GitHub repository includes 'logs and jailbreak artifacts in the JailbreakBench format,' providing per-behavior raw results for independent verification.",
           "source": "haiku"
         },
         "data_collection_described": {
           "applies": true,
           "answer": false,
           "justification": "The 50 AdvBench behaviors are referenced from Chao et al. (2023) without re-describing the curation process; the paper treats them as a given dataset without documenting its own collection procedure.",
           "source": "haiku"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants; the study uses a standard benchmark with no recruitment.",
           "source": "haiku"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "The full pipeline from harmful behavior → attack optimization → judge evaluation is described in Section 3 and Algorithm 1, with model-specific variations detailed in Section 4.",
           "source": "haiku"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": false,
           "answer": false,
           "justification": "This is an adversarial attack paper, not a benchmark capability evaluation; training data contamination with attack behaviors does not affect the validity of demonstrating attack success rates.",
           "source": "haiku"
         },
         "train_test_overlap_discussed": {
           "applies": false,
           "answer": false,
           "justification": "NA — the paper evaluates attack success rates, not model knowledge; the concept of train/test overlap does not apply to this attack evaluation setting.",
           "source": "haiku"
         },
         "benchmark_contamination_addressed": {
           "applies": false,
           "answer": false,
           "justification": "NA — models are being attacked, not evaluated on knowledge; whether models saw AdvBench behaviors in training is irrelevant to whether adversarial attacks succeed.",
           "source": "haiku"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants; the paper has an ethics/responsible disclosure statement (Appendix A.1) but no IRB approval.",
           "source": "haiku"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants.",
           "source": "haiku"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": true,
           "justification": "Section C.2 reports: '4000 iterations of random search on Llama-3-8B take 20.9 minutes on a single A100 GPU'; total experiment time stated as 'a few hours.'",
           "source": "haiku"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": true,
           "justification": "Single A100 GPU specified for open-weight experiments; OpenAI Researcher Access Program credits and Anthropic free evaluation access are acknowledged, giving a rough cost picture.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "Adaptive jailbreaking attacks achieve 100% attack success rate on all 21 tested safety-aligned LLMs including GPT-4o and Claude 3.5 Sonnet.",
       "evidence": "Tables 1 and 22 show 100% ASR via GPT-4 judge across 21 models using combinations of prompt templates, random search, self-transfer, and prefilling.",
       "supported": "strong"
     },
     {
       "claim": "Random search on logprobs can find adversarial suffixes without gradient information, outperforming gradient-based GCG in API-access scenarios.",
       "evidence": "Table 2 shows Prompt+RS+Self-Transfer achieves 100% vs. GCG's 54% on Llama-2-Chat-7B; Section 6 notes random search requires only logprobs and has lower memory demands.",
       "supported": "strong"
     },
     {
       "claim": "Self-transfer—initializing random search with adversarial suffixes from simpler requests—significantly improves query efficiency and attack success rates.",
       "evidence": "Figure 2 convergence curves show self-transfer achieves 100% ASR far faster than RS alone; Table 2 shows RS alone achieves 50% while RS+Self-Transfer achieves 100% on Llama-2-Chat-7B.",
       "supported": "strong"
     },
     {
       "claim": "Claude models, which do not expose logprobs, can be jailbroken with 100% ASR using the API prefilling feature.",
       "evidence": "Table 4 shows 100% ASR on all seven Claude models (2.0 through 3.5 Sonnet) using Prompt+Prefilling Attack; Tables 16–17 provide detailed ablation across restart counts and prompt structures.",
       "supported": "strong"
     },
     {
       "claim": "Static attack suites significantly overestimate LLM robustness compared to model-specific adaptive attacks.",
       "evidence": "Prior best ASRs on Llama-2-Chat-13B/70B were 30–38% (GCG via HarmBench); this paper achieves 100%; Section 6 argues this gap shows static evaluations give 'false sense of safety.'",
       "supported": "moderate"
     },
     {
       "claim": "No single attack method generalizes across all target models; model-specific vulnerabilities require custom attack designs.",
       "evidence": "R2D2 requires in-context learning prompts (90% in-context vs. 8% standard prompt); GPT-4o requires a custom prompt (0% default vs. 100% custom); Claude requires prefilling unavailable to other models.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "All 21 tested safety-aligned LLMs, including GPT-4o and Claude 3.5 Sonnet, achieve 100% attack success rate under simple adaptive jailbreaking attacks combining manually designed prompt templates, random search on logprobs, self-transfer initialization, and model-specific techniques such as prefilling for Claude. The central methodological insight is that adaptive attacks—specifically designed for each model's unique API and training vulnerabilities—are necessary for accurate robustness evaluation; static attack suites (e.g., GCG, PAIR) dramatically overestimate robustness, achieving as low as 30–38% ASR on models this paper breaks completely. The paper also demonstrates that random search without gradient access and prefilling without any optimization are surprisingly effective, lowering the barrier for adversarial evaluation.",
   "red_flags": [
     {
       "flag": "Tiny evaluation set",
       "detail": "Only 50 AdvBench behaviors are used; 100% ASR on 50 specific prompts may not generalize to the full distribution of harmful requests, and the small N makes statistical reliability impossible to assess."
     },
     {
       "flag": "Judge reliability undermines headline claim",
       "detail": "GPT-4 judge exhibits ~20% false positive rate on Claude 2.1 (Table 19 shows clearly non-harmful responses scoring 10/10), which partially invalidates the 100% ASR claim for that model and raises questions about other models."
     },
     {
       "flag": "No variance or CIs reported",
       "detail": "All ASR results are presented as single-run point estimates with no confidence intervals, error bars, or repeated-run variance, making result stability unassessable."
     },
     {
       "flag": "Baseline comparisons confounded",
       "detail": "Many baselines (marked with *) are from different request sets and/or different judges, making direct numerical comparison misleading despite being placed in the same tables."
     },
     {
       "flag": "No competing interests declaration",
       "detail": "While funding sources are disclosed in acknowledgements, no formal competing interests statement addresses potential equity, patents, or consulting relationships with OpenAI, Anthropic, Meta, or Google."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "relevance": "Introduces GCG attack and AdvBench benchmark; both used as primary baseline and evaluation dataset in this paper"
     },
     {
       "title": "Jailbreaking Black Box Large Language Models in Twenty Queries",
       "relevance": "Introduces PAIR attack and curates the 50-behavior AdvBench subset that serves as the primary evaluation set"
     },
     {
       "title": "HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal",
       "relevance": "Primary source of baseline ASR numbers across multiple attack methods; main comparison target demonstrating improved ASR"
     },
     {
       "title": "Jailbroken: How Does LLM Safety Training Fail?",
       "relevance": "Categorizes jailbreak failure modes (competing objectives, mismatched generalization) that motivate the adaptive attack design philosophy"
     },
     {
       "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically",
       "relevance": "Key baseline attack (TAP) that this paper significantly outperforms across all evaluated models"
     },
     {
       "title": "JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models",
       "relevance": "Standardized evaluation infrastructure; code is released in JailbreakBench format for comparability"
     },
     {
       "title": "On Adaptive Attacks to Adversarial Example Defenses",
       "relevance": "Provides the formal definition of adaptive attacks used throughout the paper, adapted from image classification adversarial robustness"
     },
     {
       "title": "Llama 2: Open Foundation and Fine-Tuned Chat Models",
       "relevance": "Primary open-weight model family attacked; provides safety system prompts used in evaluation setup"
     },
     {
       "title": "Universal Jailbreak Backdoors from Poisoned Human Feedback",
       "relevance": "Introduces trojan backdoor attack setup motivating the SaTML'24 Trojan Detection Competition described in Section 5"
     },
     {
       "title": "How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs",
       "relevance": "PAP baseline achieving prior best 92% ASR on Llama-2-Chat-7B that this paper surpasses with 100%"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Code, logs, and prompt templates are released; practitioners deploying any of the 21 tested LLMs can immediately assess vulnerability using the provided attacks."
     },
     "surprise_contrarian": {
       "score": 3,
       "justification": "Directly contradicts safety claims from Anthropic, OpenAI, and Meta by demonstrating 100% ASR on models previously described as among the most robust, including Claude 3 family and Llama-2."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that every frontier safety-aligned LLM is completely non-robust to simple adaptive attacks, with direct implications for any safety-critical deployment or harm mitigation policy."
     },
     "drama_conflict": {
       "score": 3,
       "justification": "Attacks flagship products from multiple competing AI labs simultaneously and argues HarmBench-style evaluation gives 'a false sense of safety'; also discloses prefilling vulnerability to Anthropic before publication."
     },
     "demo_ability": {
       "score": 3,
       "justification": "GitHub repo provides runnable code, pre-computed adversarial suffixes, and logs; the prefilling attack on Claude requires only API access with no GPU needed."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Authors are from EPFL (not a frontier AI lab), but the paper attacks GPT-4o and Claude 3.5 Sonnet by name and won the SaTML'24 Trojan Detection Competition."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "39941576",
         "title": "Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks",
         "points": 3,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=39941576",
         "created_at": "2024-04-05T12:30:05Z"
       },
       {
         "hn_id": "40310614",
         "title": "The AI Review Lottery: Widespread AI-Assisted Peer Reviews Boost Paper Scores",
         "points": 2,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=40310614",
         "created_at": "2024-05-09T17:31:58Z"
       },
       {
         "hn_id": "39987108",
         "title": "Text-to-SQL that asks the LLM to predict the result set",
         "points": 2,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=39987108",
         "created_at": "2024-04-10T04:58:41Z"
       },
       {
         "hn_id": "43703965",
         "title": "LLMs, Syntax, and Semantics: Long-Distance Binding of Chinese Reflexive Ziji",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43703965",
         "created_at": "2025-04-16T11:22:09Z"
       },
       {
         "hn_id": "40663653",
         "title": "Poco: Policy Composition from and for Heterogeneous Robot Learning",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=40663653",
         "created_at": "2024-06-12T21:57:06Z"
       },
       {
         "hn_id": "41203499",
         "title": "Information preservation in Kerr-Newman spacetime using closed timelike curves",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=41203499",
         "created_at": "2024-08-09T16:54:20Z"
       },
       {
         "hn_id": "39257382",
         "title": "CamPro: Camera-Based Anti-Facial Recognition",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=39257382",
         "created_at": "2024-02-05T04:34:54Z"
       },
       {
         "hn_id": "39253694",
         "title": "CamPro: Camera-Based Anti-Facial Recognition",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=39253694",
         "created_at": "2024-02-04T19:50:49Z"
       },
       {
         "hn_id": "38889786",
         "title": "Learning Bimanual Mobile Manipulation with Low-Cost Whole-Body Teleoperation",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=38889786",
         "created_at": "2024-01-06T08:58:51Z"
       },
       {
         "hn_id": "35714138",
         "title": "Human-Centric Latent Diffusion Models for Fashion Image Editing",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=35714138",
         "created_at": "2023-04-26T14:25:14Z"
       }
     ],
     "top_points": 3,
     "total_points": 16,
     "total_comments": 3
   }
 }