{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,9]],"date-time":"2026-10-09T15:58:48Z","timestamp":1791561528402,"version":"4.3.4"},"reference-count":37,"publisher":"Elsevier BV","issue":"10","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,31]],"date-time":"2026-08-31T00:00:00Z","timestamp":1788134400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U25B2024"],"award-info":[{"award-number":["U25B2024"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62602005"],"award-info":[{"award-number":["62602005"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["cell.com","elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Patterns"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.patter.2026.101686","type":"journal-article","created":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T15:13:54Z","timestamp":1790349234000},"page":"101686","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":1,"title":["AI safety is a system property, not a sum of individual defenses"],"prefix":"10.1016","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0249-9664","authenticated-orcid":false,"given":"Xiang","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chenxi","family":"Lin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Longlong","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yiheng","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiajie","family":"Su","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chunming","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.patter.2026.101686_bib1","unstructured":"Civil Resolution Tribunal of British Columbia (2024). Moffatt v. Air Canada. British Columbia Civil Resolution Tribunal, 2024 BCCRT 149. https:\/\/www.canlii.org\/en\/bc\/bccrt\/doc\/2024\/2024bccrt149\/2024bccrt149.html.Decisionrendered February 14, 2024; accessed August 26, 2026."},{"key":"10.1016\/j.patter.2026.101686_bib2","unstructured":"Carter, L. (2023). Chevrolet dealer\u2019s AI chatbot goes rogue thanks to pranksters. Jalopnik. https:\/\/www.jalopnik.com\/chevrolet-dealer-ai-help-chatbot-goes-rogue-pranksters-1851112556\/. Published December 19, 2023; accessed August 26, 2026."},{"key":"10.1016\/j.patter.2026.101686_bib3","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1126\/science.aax2342","article-title":"Dissecting racial bias in an algorithm used to manage the health of populations","volume":"366","author":"Obermeyer","year":"2019","journal-title":"Science"},{"key":"10.1016\/j.patter.2026.101686_bib4","doi-asserted-by":"crossref","first-page":"1486","DOI":"10.1038\/s42256-023-00765-8","article-title":"Defending ChatGPT against jailbreak attack via self-reminders","volume":"5","author":"Xie","year":"2023","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib5","doi-asserted-by":"crossref","first-page":"852","DOI":"10.1038\/s42256-024-00881-z","article-title":"Factuality challenges in the era of large language models and opportunities for fact-checking","volume":"6","author":"Augenstein","year":"2024","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib6","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1038\/s42256-025-01152-1","article-title":"Benchmarking large language models on safety risks in scientific laboratories","volume":"8","author":"Zhou","year":"2026","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib7","doi-asserted-by":"crossref","first-page":"1780","DOI":"10.1038\/s42256-025-01113-8","article-title":"Language models cannot reliably distinguish belief from knowledge and fact","volume":"7","author":"Suzgun","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib8","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1038\/s43588-024-00741-1","article-title":"Generative language models exhibit social identity biases","volume":"5","author":"Hu","year":"2025","journal-title":"Nat. Comput. Sci."},{"key":"10.1016\/j.patter.2026.101686_bib9","doi-asserted-by":"crossref","DOI":"10.1126\/sciadv.adz2924","article-title":"Source framing triggers systematic bias in large language models","volume":"11","author":"Germani","year":"2025","journal-title":"Sci. Adv."},{"key":"10.1016\/j.patter.2026.101686_bib10","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1038\/s42256-024-00976-7","article-title":"What large language models know and what people think they know","volume":"7","author":"Steyvers","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib11","doi-asserted-by":"crossref","first-page":"388","DOI":"10.1038\/s43588-025-00789-7","article-title":"Evaluating and mitigating bias in AI-based medical text generation","volume":"5","author":"Chen","year":"2025","journal-title":"Nat. Comput. Sci."},{"key":"10.1016\/j.patter.2026.101686_bib12","article-title":"Demographic bias of expert-level vision-language foundation models in medical imaging","volume":"11","author":"Yang","year":"2025","journal-title":"Sci. Adv."},{"key":"10.1016\/j.patter.2026.101686_bib13","doi-asserted-by":"crossref","first-page":"629","DOI":"10.1038\/s43588-024-00695-4","article-title":"The lost data: how AI systems censor LGBTQ+ content in the name of safety","volume":"4","author":"Chen","year":"2024","journal-title":"Nat. Comput. Sci."},{"key":"10.1016\/j.patter.2026.101686_bib14","doi-asserted-by":"crossref","first-page":"476","DOI":"10.1038\/s42256-023-00651-3","article-title":"Translating intersectionality to fair machine learning in health sciences","volume":"5","author":"Lett","year":"2023","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib15","doi-asserted-by":"crossref","first-page":"525","DOI":"10.1038\/s42256-024-00832-8","article-title":"Augmenting large language models with chemistry tools","volume":"6","author":"M Bran","year":"2024","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib16","doi-asserted-by":"crossref","first-page":"1373","DOI":"10.1038\/s42256-025-01110-x","article-title":"Towards agentic science for advancing scientific discovery","volume":"7","author":"Xin","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib17","article-title":"Is there a half-life for the success rates of AI agents?","author":"Ord","year":"2025","journal-title":"arXiv"},{"key":"10.1016\/j.patter.2026.101686_bib18","doi-asserted-by":"crossref","unstructured":"Tabassi, E. Artificial Intelligence Risk Management Framework (AI RMF 1.0). Tech. Rep. NIST AI 100-1 National Institute of Standards and Technology Gaithersburg, MD (2023). https:\/\/doi.org\/10.6028\/NIST.AI.100-1.","DOI":"10.6028\/NIST.AI.100-1"},{"key":"10.1016\/j.patter.2026.101686_bib19","unstructured":"European Parliament and Council of the European Union (2024). Regulation (EU) 2024\/1689 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300\/2008, (EU) No 167\/2013, (EU) No 168\/2013, (EU) 2018\/858, (EU) 2018\/1139 and (EU) 2019\/2144 and Directives 2014\/90\/EU, (EU) 2016\/797 and (EU) 2020\/1828 (Artificial Intelligence Act). Official Journal of the European Union L, 2024\/1689. https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj."},{"key":"10.1016\/j.patter.2026.101686_bib20","doi-asserted-by":"crossref","first-page":"246","DOI":"10.1038\/s42256-024-00811-z","article-title":"The democratization of global AI governance and the role of tech companies","volume":"6","author":"Erman","year":"2024","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib21","doi-asserted-by":"crossref","first-page":"531","DOI":"10.1038\/s42256-025-01020-y","article-title":"AI safety for everyone","volume":"7","author":"Gyevn\u00e1r","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib22","doi-asserted-by":"crossref","first-page":"6421","DOI":"10.3390\/app11146421","article-title":"What disease does this patient have? A large-scale open domain question answering dataset from medical exams","volume":"11","author":"Jin","year":"2021","journal-title":"Appl. Sci."},{"key":"10.1016\/j.patter.2026.101686_bib23","series-title":"2025 IEEE Conference on Secure and Trustworthy Machine Learning","first-page":"23","article-title":"Jailbreaking black box large language models in twenty queries","author":"Chao","year":"2025"},{"key":"10.1016\/j.patter.2026.101686_bib24","doi-asserted-by":"crossref","first-page":"1572","DOI":"10.1038\/s42256-025-01084-w","article-title":"Mechanistic understanding and validation of large AI models with SemanticLens","volume":"7","author":"Dreyer","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib25","doi-asserted-by":"crossref","first-page":"412","DOI":"10.1038\/s42256-025-01000-2","article-title":"Explainable AI reveals Clever Hans effects in unsupervised learning models","volume":"7","author":"Kauffmann","year":"2025","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib26","doi-asserted-by":"crossref","first-page":"383","DOI":"10.1038\/s42256-024-00820-y","article-title":"The benefits, risks and bounds of personalizing the alignment of large language models to individuals","volume":"6","author":"Kirk","year":"2024","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib27","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv"},{"key":"10.1016\/j.patter.2026.101686_bib28","series-title":"The Thirteenth International Conference on Learning Representations","first-page":"79185","article-title":"AgentHarm: A benchmark for measuring harmfulness of LLM agents","author":"Andriushchenko","year":"2025"},{"key":"10.1016\/j.patter.2026.101686_bib29","article-title":"HCAST: Human-calibrated autonomy software tasks","author":"Rein","year":"2025","journal-title":"arXiv"},{"key":"10.1016\/j.patter.2026.101686_bib30","article-title":"SHADE-Arena: Evaluating sabotage and monitoring in LLM agents","author":"Kutasov","year":"2025","journal-title":"arXiv"},{"key":"10.1016\/j.patter.2026.101686_bib31","series-title":"The Twelfth International Conference on Learning Representations","first-page":"54107","article-title":"SWE-bench: Can language models resolve real-world GitHub issues?","author":"Jimenez","year":"2024"},{"key":"10.1016\/j.patter.2026.101686_bib32","doi-asserted-by":"crossref","first-page":"764","DOI":"10.1038\/s42256-024-00858-y","article-title":"Reconciling privacy and accuracy in AI for medical imaging","volume":"6","author":"Ziller","year":"2024","journal-title":"Nat. Mach. Intell."},{"key":"10.1016\/j.patter.2026.101686_bib33","unstructured":"Templeton, A., Conerly, T., Marcus, J., Lindsey, J., Bricken, T., Chen, B., Pearce, A., Citro, C., Ameisen, E., Jones, A., et al (2024). Scaling monosemanticity: Extracting interpretable features from Claude 3 Sonnet. Transformer Circuits Thread. https:\/\/transformer-circuits.pub\/2024\/scaling-monosemanticity\/index.html."},{"key":"10.1016\/j.patter.2026.101686_bib34","doi-asserted-by":"crossref","DOI":"10.1016\/j.patter.2023.100842","article-title":"Building less-flawed metrics: Understanding and creating better measurement and incentive systems","volume":"4","author":"Manheim","year":"2023","journal-title":"Patterns"},{"key":"10.1016\/j.patter.2026.101686_bib35","article-title":"Incorporating AI incident reporting into telecommunications law and policy: Insights from India","volume":"60","author":"Agarwal","year":"2026","journal-title":"Comput. Law Secur. Rev."},{"key":"10.1016\/j.patter.2026.101686_bib36","article-title":"A federated architecture for sector-led AI governance: lessons from India","author":"Agarwal","year":"2026","journal-title":"Transforming Gov. People, Process Policy"},{"key":"10.1016\/j.patter.2026.101686_bib37","doi-asserted-by":"crossref","unstructured":"Chen, X., Lin, C., Zhu, L., Xu, Y., Su, J., and Wu, C. (2026). AI safety is a system property, not a sum of individual defenses. Zenodo. https:\/\/doi.org\/10.5281\/zenodo.22195808.","DOI":"10.1016\/j.patter.2026.101686"}],"container-title":["Patterns"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666389926001959?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666389926001959?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,10,9]],"date-time":"2026-10-09T15:47:53Z","timestamp":1791560873000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2666389926001959"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":37,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2026,10]]}},"alternative-id":["S2666389926001959"],"URL":"https:\/\/doi.org\/10.1016\/j.patter.2026.101686","relation":{},"ISSN":["2666-3899"],"issn-type":[{"value":"2666-3899","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"AI safety is a system property, not a sum of individual defenses","name":"articletitle","label":"Article Title"},{"value":"Patterns","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.patter.2026.101686","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Inc.","name":"copyright","label":"Copyright"}],"article-number":"101686"}}