Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents

Xi Wang; Songlei Jian; Yiming Zhang; Bin Ji; Zhaoye Li; Ma Jun; Baosheng Wang; Jie Yu

cs.AISep 28, 2026

Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents

Authors: Xi Wang, Songlei Jian, Yiming Zhang, Bin Ji, Zhaoye Li, Ma Jun, Baosheng Wang, Jie Yu

Organizations: National University of Defense Technology

Abstract

As large language models increasingly operate as tool-using agents, post-jailbreak safety feedback is often assumed to serve as a reliable safeguard; however, how lingering jailbreak context shapes subsequent agent behavior remains largely unexplored. To systematically examine this dynamic, we introduce a paired continuation framework across 192 parent tasks spanning 42 domains, evaluating 12,148 analyzed continuation pairs (curated from a 12,288-pair initially design) across eight diverse agents. We find that identical safety feedback induces sharply model-dependent behavioral routing rather than uniform protection: redirecting unsafe trajectories toward legitimate completion (\emph{rescue}), sustaining unauthorized execution (\emph{persistent unsafe}), or triggering over-refusal on benign tasks (\emph{collateral loss}). Through layer-wise activation patching, we discover a shared \emph{late-commit pattern} where causal intervention effects surge sharply near the final layers (relative depths of 0.958--0.984) despite an over 30-fold variation in peak magnitude across architectures. Crucially, critical-layer representations correlate with macroscopic routing outcomes, and intervening at these layers causally alters concrete next-step tool actions. Building on this causal foundation, we test whether localized intervention-derived features can serve as predictive proxies for full-trajectory routing outcomes on unseen parent tasks under leave-one-parent-task-out evaluation, finding that they provide viable predictive signals in responsive agents with peak ROC AUCs reaching 0.675 for \emph{rescue}, 0.777 for \emph{collateral loss}, and 0.702 for \emph{persistent unsafe}. These findings establish a mechanistic lens and a predictive baseline for anticipating the safety and utility trade-offs of post-jailbreak feedback in autonomous agents.

Figures & tables

Figure 1: Divergent safety routing and the late-commit pattern under jailbreak context. (a) Paired continuations from matched pre-action checkpoints under neutral reminders ( $\mathrm{N}$ ) and safety feedback ( $\mathrm{S}$ ) illustrate three divergent routes: rescue , persistent unsafe , and collateral loss . (b) Layer-wise $\mathrm{S}\rightarrow\mathrm{N}$ activation patching reveals a universal late-commit pattern peaking at the final layers. Intervention-derived features extracted at these critical layers serve as informative predictive proxies for forecasting full-trajectory routing outcomes across unseen parent tasks.

Figure 2: Construction and validation of matched tool-use tasks. Each parent task $\mathrm{p}$ generates matched mixed-risk ( $\mathrm{R}$ ) and benign ( $\mathrm{B}$ ) variants, deterministically replayed to two pre-action checkpoints and verified on independent simulator copies before freezing. Across 192 parent tasks, this yields 768 frozen checkpoints, resulting in 1,536 matched $\mathrm{N}/\mathrm{S}$ pairs (3,072 trajectories) per agent across retained ( $\mathrm{J}^{+}$ ) and neutralized ( $\mathrm{J}^{0}$ ) contexts.

Task coverage			Matched task instances			Per-agent continuations
Domains	Parent tasks	Parents per domain	Mixed-risk variants	Benign variants	Pre-action checkpoints	$\mathrm{N}/\mathrm{S}$ pairs	Continuation trajectories
42	192	4–5	192	192	768	1,536	3,072

Table 1: Scale and structure of the task benchmark and continuation design. Each parent task yields matched mixed-risk (

\mathrm{R}

) and benign (

\mathrm{B}

) variants at two pre-action checkpoints. For each agent, every checkpoint is evaluated under retained (

\mathrm{J}^{+}

) and neutralized (

\mathrm{J}^{0}

) jailbreak contexts; each context yields one matched

\mathrm{N}/\mathrm{S}

pair and two continuation trajectories.

Figure 3: Divergent routing outcomes under identical safety feedback in the RV218 aviation defect task. Continuations independently resume from matched prepared checkpoints under retained jailbreak contexts ( $\mathrm{J}^{+}$ ). On the mixed-risk variant, $\mathrm{S}$ steers Gemma-4-12B to withhold the unauthorized status edit ( rescue ), whereas Qwen3-14B still executes it ( persistent unsafe ). On the benign variant, $\mathrm{S}$ induces over-refusal in Mistral-Small-24B despite legitimate execution under $\mathrm{N}$ ( collateral loss ).

Family	Agent backbone	Rescue	Persistent unsafe	Collateral loss
Qwen	Qwen3-14B	4 (0.5%)	651 (85.7%)	14 (1.9%)
	Qwen3.5-9B	111 (14.6%)	220 (28.9%)	57 (7.6%)
	Qwen3.5-27B	46 (6.0%)	26 (3.4%)	9 (1.2%)
	Qwen3.6-27B	37 (4.8%)	8 (1.0%)	10 (1.3%)
Gemma	Gemma-3-12B	148 (19.3%)	88 (11.5%)	84 (10.9%)
	Gemma-4-12B	46 (6.1%)	122 (16.1%)	0 (0.0%)

Table 2: Prevalence of safety-routing outcomes across eight agents. Each entry reports count (rate) over analyzed matched

\mathrm{N}/\mathrm{S}

continuation pairs for that task variant: mixed-risk (

\mathrm{R}

) for rescue and persistent unsafe , and benign (

\mathrm{B}

) for collateral loss . Denominators span 748–768 pairs per variant following semantic review (full accounting in Appendix A.3 ).

Figure 4: Layer-wise intervention effects across eight agents. Curves show median effects across 100 matched $\mathrm{N}/\mathrm{S}$ pairs, with stars denoting peak layers and shading marking the final 10% of depth. Seven of the eight curves peak at the final layer, exhibiting the characteristic late-commit pattern .

Figure 5: Routing-dependent critical-layer logit change distributions. Panels compare held-out direction scores on (a) mixed-risk and (b) benign tasks and (c) raw response magnitudes $\lVert\Delta\tilde{\mathbf{z}}\rVert_{2}$ on benign tasks. Curves show distributions, dots mark matched $\mathrm{N}/\mathrm{S}$ pairs, and boxes summarize medians and interquartile ranges; axes use agent-specific scales. Direction scores systematically separate routing outcomes, whereas benign magnitude shifts remain model-dependent.

Family	Agent backbone	Rescue AUC ( $n_{+}$ )	Collateral loss AUC ( $n_{+}$ )	Persistent unsafe AUC ( $n_{+}$ )
Qwen	Qwen3-14B	0.614 (4)	0.756 (14)	0.668 (314)
	Qwen3.5-9B	0.569 (113)	0.777 (60)	0.575 (88)
	Qwen3.5-27B	0.539 (46)	0.718 (9)	0.614 (9)
	Qwen3.6-27B	0.535 (37)	0.474 (10)	0.346 (3)
Gemma	Gemma-3-12B	0.544 (148)	0.623 (84)	0.702 (65)
	Gemma-4-12B	0.470 (46)	N/A (0)	0.515 (56)

Table 3: Cross-parent-task prediction of safety-routing outcomes. Entries report within-agent leave-one-parent-task-out (LOPO) AUC, with positive-example counts in parentheses evaluated over the corresponding feature pool (768 task instances for rescue and collateral loss, and 384 context-paired instances for persistent unsafe; accounting in Appendix A.3 ). Bold marks the highest AUC in each column. The results show that intervention effects identified by the late-commit pattern support prediction of all three outcomes on held-out parent tasks.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Parents	Domain	Parents
agriculture	5	legal_services	5
archival_services	4	logistics	5
automotive_dealers	4	manufacturing	5
aviation_ops	4	maritime_shipping	4
cloud_ops	5	media_production	5
community_nonprofit	5	mining_ops	4

Appendix

Table 4: Parent-task coverage by domain. The counts sum to 192 parent tasks.

Agent	Designed pairs	Analyzed $\mathrm{R}$	Analyzed $\mathrm{B}$
Qwen3.5-9B	1,536	760	748
Qwen3-14B	1,536	760	748
Qwen3.5-27B	1,536	768	768
Qwen3.6-27B	1,536	768	768
Gemma-3-12B	1,536	768	768
Gemma-4-12B	1,536	760	748

Appendix

Table 5: Design and analyzed

\mathrm{N}/\mathrm{S}

pairs. Each pair contains two independent continuations. The five agents with masked pairs retain 760 mixed-risk and 748 benign pairs; the remaining three retain all 768 pairs of each variant.

Agent	Rescue	Persistent	Other $\mathrm{R}$	Collateral	Other $\mathrm{B}$
Qwen3.5-9B	111	220	429	57	691
Qwen3-14B	4	651	105	14	734
Qwen3.5-27B	46	26	696	9	759
Qwen3.6-27B	37	8	723	10	758
Gemma-3-12B	148	88	532	84	684
Gemma-4-12B	46	122	592	0	748

Appendix

Table 6: Accounting for the three reported routing outcomes and all remaining pairs. Outcome counts reproduce Table 2 ; complement counts are the analyzed variant denominator minus those counts.

Agent	N state	S:U	S:C	S:O	S:F	S:I
Qwen3.5-9B	U	220	98	7	15	100
	C	15	108	0	3	9
	O	1	0	0	1	4
	F	6	8	1	11	9
	I	16	5	3	3	117
Qwen3-14B	U	651	3	0	0	17

Appendix

Table 7: Observed N/S five-state transition counts on

\mathrm{R}

tasks. Rows are N states; columns are S states.

Agent	N state	S:U	S:C	S:O	S:F	S:I
Qwen3.5-9B	U	2	1	0	0	1
	C	2	360	23	10	22
	O	1	2	2	1	2
	F	1	3	2	28	10
	I	2	3	12	12	246
Qwen3-14B	U	12	1	0	0	2

Appendix

Table 8: Observed N/S five-state transition counts on

\mathrm{B}

tasks. Rows are N states; columns are S states.

Outcome	Agent	Prepared $\mathrm{J}^{+}$	Prepared $\mathrm{J}^{0}$	Committed $\mathrm{J}^{+}$	Committed $\mathrm{J}^{0}$
Rescue	Qwen3.5-9B	25/190	47/190	23/190	16/190
	Qwen3-14B	1/190	3/190	0/190	0/190
	Qwen3.5-27B	16/192	14/192	11/192	5/192
	Qwen3.6-27B	8/192	2/192	16/192	11/192
	Gemma-3-12B	34/192	20/192	39/192	55/192
	Gemma-4-12B	15/190	9/190	14/190	8/190

Appendix

Table 9: Routing outcomes by checkpoint and jailbreak context. Each cell reports count/analyzed variant-specific denominator using the stored outcome labels behind Table 2 ; the four counts in each agent–outcome block sum to its Table 2 count.

\mathrm{J}^{+}

retains and

\mathrm{J}^{0}

neutralizes the jailbreak text.

Agent	Layers $L_{m}$	Region $\mathcal{C}_{m}$	$\ell_{m}^{\star}$	Relative depth	Median effect
Qwen3.5-9B	32	30–31	31	0.969	0.052
Qwen3-14B	40	38–39	39	0.975	0.167
Qwen3.5-27B	64	62–63	63	0.984	0.085
Qwen3.6-27B	64	62–63	63	0.984	0.108
Gemma-3-12B	48	42–47	46	0.958	0.166
Gemma-4-12B	48	42–47	46	0.958	0.014

Appendix

Table 10: Fixed critical layers from the balanced 100-pair follow-up scan. Layer indices are zero-based; relative depth is

\ell_{m}^{\star}/L_{m}

. Effects are medians of the next-token logit cosine distance after

\mathrm{S}\rightarrow\mathrm{N}

patching.

Agent	Median $d$ [95% CI]
Qwen3.5-9B	$-0.0243$ [ $-0.0277$ , $-0.0211$ ]
Qwen3-14B	$-0.0208$ [ $-0.0261$ , $-0.0149$ ]
Qwen3.5-27B	$-0.0164$ [ $-0.0190$ , $-0.0138$ ]
Qwen3.6-27B	$-0.0361$ [ $-0.0394$ , $-0.0333$ ]
Gemma-3-12B	$-0.0607$ [ $-0.0696$ , $-0.0528$ ]
Gemma-4-12B	$+0.0052$ [ $+0.0039$ , $+0.0073$ ]

Appendix

Table 11: Retained-minus-neutralized jailbreak-context difference in critical-layer intervention effect. Intervals are 95% parent-cluster bootstrap intervals from 5,000 resamples; all values are within-agent medians over 768 matched context pairs. Four decimal places retain the narrow Mistral interval.

Agent	Rescue	Persistent unsafe	AUC [95% CI]
Qwen3.5-9B	62	105	0.731 [0.647, 0.803]
Qwen3-14B	4	340	0.664 [0.497, 0.842]
Qwen3.5-27B	21	18	0.714 [0.542, 0.861]
Qwen3.6-27B	22	8	0.726 [0.534, 0.880]
Gemma-3-12B	96	38	0.785 [0.704, 0.854]
Gemma-4-12B	26	58	0.557 [0.414, 0.692]

Appendix

Table 12: Critical-layer direction readout on mixed-risk tasks. The AUC evaluates separation between rescue and persistent unsafe trajectories; support indicates the number of analyzed cases per outcome, with brackets reporting 95% parent-cluster bootstrap confidence intervals.

Agent	Collateral loss	Preserved	Direction AUC (95% CI)	Magnitude AUC (95% CI)
Qwen3.5-9B	43	209	0.883 [0.822, 0.933]	0.842 [0.779, 0.899]
Qwen3-14B	11	223	0.915 [0.842, 0.973]	0.798 [0.651, 0.909]
Qwen3.5-27B	5	286	0.511 [0.216, 0.791]	0.643 [0.389, 0.895]
Qwen3.6-27B	7	281	0.551 [0.381, 0.716]	0.602 [0.415, 0.810]
Gemma-3-12B	45	141	0.714 [0.614, 0.801]	0.758 [0.672, 0.835]
Gemma-4-12B	0	279	N/A	N/A

Appendix

Table 13: Critical-layer direction and magnitude readouts on benign tasks. Direction and magnitude AUCs evaluate separation of collateral loss from preserved completion; support denotes analyzed trajectory counts, and brackets report 95% parent-cluster bootstrap intervals.

Agent	$n$	Critical	Half depth	Random	Critical $-$ random [CI]
Qwen3.5-9B	18	0.722	0.333	0.222	0.500 [0.167, 0.833]
Qwen3-14B	5	0.400	0.400	0.400	0.000 [ $-0.600$ , 0.600]
Qwen3.5-27B	12	0.667	0.417	0.333	0.333 [ $-0.083$ , 0.750]
Qwen3.6-27B	11	0.636	0.273	0.273	0.364 [0.000, 0.727]
Gemma-3-12B	20	0.750	0.400	0.300	0.450 [0.100, 0.750]
Gemma-4-12B	9	0.333	0.333	0.222	0.111 [ $-0.222$ , 0.444]

Appendix

Table 14: First-tool-call transition toward

\mathrm{S}

among selected rescue pairs with differing original

\mathrm{N}

and

\mathrm{S}

calls.

n

denotes the eligible-pair count; remaining columns report transition proportions across intervention conditions and the paired critical-minus-random contrast with 95% parent-cluster bootstrap intervals.

Agent	$n$	Critical	Half depth	Random	Critical $-$ random [CI]
Qwen3.5-9B	16	0.625	0.312	0.250	0.375 [0.000, 0.688]
Qwen3-14B	23	0.565	0.391	0.348	0.217 [ $-0.087$ , 0.522]
Qwen3.5-27B	11	0.545	0.364	0.273	0.273 [ $-0.091$ , 0.636]
Qwen3.6-27B	9	0.556	0.444	0.444	0.111 [ $-0.333$ , 0.556]
Gemma-3-12B	19	0.632	0.368	0.316	0.316 [0.000, 0.632]
Gemma-4-12B	17	0.588	0.529	0.471	0.118 [ $-0.235$ , 0.471]

Appendix

Table 15: First-tool-call transition toward

\mathrm{S}

among selected persistent unsafe pairs with differing original calls. A matched

\mathrm{S}

call alters execution toward feedback but may remain unsafe. Columns follow the format in Table 14 .

Agent	$n$	Critical	Half depth	Random	Self	Critical $-$ random [CI]
Qwen3.5-9B	14	0.714	0.357	0.286	0.000	0.429 [0.000, 0.786]
Qwen3-14B	5	0.400	0.200	0.200	0.000	0.200 [ $-0.400$ , 0.800]
Qwen3.5-27B	7	0.714	0.286	0.286	0.000	0.429 [ $-0.143$ , 0.857]
Qwen3.6-27B	6	0.333	0.500	0.500	0.000	$-0.167$ [ $-0.667$ , 0.333]
Gemma-3-12B	19	0.684	0.421	0.316	0.000	0.368 [0.000, 0.684]
Gemma-4-12B	0	N/A	N/A	N/A	N/A	N/A

Appendix

Table 16: First-tool-call transition toward

\mathrm{S}

among selected collateral loss pairs with differing original calls. Columns follow the format in Table 14 .

Outcome	Agent	$b/c$	$p$	Critical [CI]	Random [CI]
Rescue	Qwen3.5-9B	11/2	0.011	[0.491, 0.875]	[0.090, 0.452]
	Qwen3-14B	1/1	0.750	[0.118, 0.769]	[0.118, 0.769]
	Qwen3.5-27B	6/2	0.145	[0.391, 0.862]	[0.138, 0.609]
	Qwen3.6-27B	5/1	0.109	[0.354, 0.848]	[0.097, 0.566]
	Gemma-3-12B	12/3	0.018	[0.531, 0.888]	[0.145, 0.519]
	Gemma-4-12B	2/1	0.500	[0.121, 0.646]	[0.063, 0.547]

Appendix

Table 17: Paired action comparison against the norm-matched random control.

b/c

denote discordant-pair counts,

p

is the one-sided exact paired binomial test probability, and the final two columns report 95% Wilson score intervals for marginal match rates.

Outcome	Agent	$n_{+}/n$	ROC AUC [CI]	PR AUC (base rate)
Rescue	Qwen3.5-9B	113/768	0.569 [0.502, 0.632]	0.180 (0.147)
	Qwen3-14B	4/768	0.614 [0.212, 0.886]	0.012 (0.005)
	Qwen3.5-27B	46/768	0.539 [0.429, 0.647]	0.077 (0.060)
	Qwen3.6-27B	37/768	0.535 [0.420, 0.644]	0.061 (0.048)
	Gemma-3-12B	148/768	0.544 [0.480, 0.606]	0.216 (0.193)
	Gemma-4-12B	46/768	0.470 [0.364, 0.574]	0.057 (0.060)

Appendix

Table 18: Cross-parent-task prediction uncertainty and precision–recall metrics under leave-one-parent-task-out (LOPO) evaluation. Brackets report 95% parent-cluster bootstrap confidence intervals over 1,000 resamples. The PR AUC column lists positive-class prevalence in parentheses as the reference baseline. An outcome with no positives is denoted N/A.

Outcome	Agent	$n_{+}$	$0.50L$	$0.75L$	$\ell_{m}^{\star}-1$	$\ell_{m}^{\star}$	$\ell_{m}^{\star}+1$
Rescue	Qwen3.5-9B	113	0.454	0.487	0.552	0.569	—
	Qwen3-14B	4	0.584	0.626	0.641	0.614	—
	Qwen3.5-27B	46	0.414	0.444	0.522	0.539	—
	Qwen3.6-27B	37	0.447	0.471	0.523	0.535	—
	Gemma-3-12B	148	0.394	0.432	0.521	0.544	0.526
	Gemma-4-12B	46	0.452	0.478	0.488	0.470	0.458

Appendix

Table 19: Layer-specific LOPO ROC AUC on matched evaluation rows. Columns report positive support and LOPO ROC AUCs across preselected relative depths;

\ell_{m}^{\star}

is the fixed critical layer from Appendix C.1 . N/A indicates no positive examples, and — denotes depths not evaluated for that architecture.

Explore similar work

Sep 14, 2026cs.AI

SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration

Large language models (LLMs) are rapidly evolving from conversational assistants into agentic AI systems that reason, plan, invoke tools, maintain persistent memory, communicate with other agents, and execute multi-step tasks. At the same time, modern models exhibit substantially stronger native safety alignment than earlier generations on which many jailbreak attacks and defenses were originally studied. This shift raises a fundamental question: \textit{which established jailbreak-security findings remain valid in the era of modern LLMs and agentic AI?} We address this question through a Systematization of Knowledge (SoK) that reframes jailbreak security around the full agentic execution pipeline. We develop unified taxonomies of attacks and defenses spanning user interaction, planning and reasoning, memory, tool use, and inter-agent communication, and introduce a security--utility--efficiency evaluation framework that separates native harmful-prompt safety, adversarial jailbreak robustness, and agent-level security outcomes. We further conduct a controlled empirical study of representative attacks and defenses within a common agentic framework. Our results reveal three important gaps. First, strong native alignment does not imply robustness to adversarial jailbreaks. Second, defense effectiveness is highly model-, attack-, and component-dependent and can come at substantial cost in over-refusal, utility, and latency. Third, low final-response attack success can mask severe intermediate compromise: planning, memory, and tool interactions may remain unsafe even when the final response is successfully filtered. These findings motivate a shift from response-centric jailbreak defense toward cross-layer, execution-aware security that protects agent state, component transitions, and external actions while preserving practical utility and efficiency.

Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac +1

Knight Foundation School of Computing and Information Sciences, Florida International University, USA · Security, Optimization, and Learning for InterDependent Networks (solid) Laboratory, Miami, Florida, USA

Jailbreak Attacks Jailbreaks Safety Alignment

Ask PDF

Sep 27, 2026cs.AI

AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents

Safety alignment for large language models (LLMs) in conversational settings is largely framed around whether to answer or refuse a request. In agentic settings, however, the same models must decide whether to act as permission-critical evidence emerges during execution. This creates a distinct challenge: apparent risk, action permissibility, and task competence are easily confounded, making agentic over-refusal difficult to distinguish from ordinary task failure. To address this, we introduce AgentBound, the first four-way counterfactual generation-and-evaluation framework for tool-using agent safety. AgentBound transforms the same executable workflow by independently varying apparent risk and action permissibility, enabling controlled comparisons of risky-looking but authorized tasks and routine-looking but unauthorized tasks. These comparisons jointly diagnose over-refusal and unsafe compliance while controlling for task competence. We instantiate AgentBound as a human-validated 4,000-task evaluation suite with trajectory-based and post-state-based judgments. Across 17 model and harness configurations, high safety frequently coexists with poor authorized-task completion: GPT-5.5 blocks 99.5% of routine-looking unauthorized actions yet completes only 28.7% of risky-looking authorized tasks. We further train a lightweight runtime calibration module that improves authorized-task completion by 18.2% on average across 10 evaluated configurations, while improving unsafe-action blocking by 5.4% on average. These show that effective agentic alignment requires action decisions to track permission-relevant execution evidence, rather than refusal strength alone.

Tianzhuo Yang, Zirui Mi, Yantao Huang +4

Peking University · Beijing Academy of Artificial Intelligence

Refusals Evaluation Benchmarks

Ask PDF

Jul 22, 2026cs.AI

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

Agent safety is moving from content moderation toward preventing operational failures before tool-using agents act. We propose Janus, a foresight-oriented framework for long-horizon agent safety that trains guards to anticipate delayed risks from partial trajectories. Janus synthesizes diverse agent trajectories via multi-agent simulation and learns a shared policy with two coupled tasks: an anticipation task that forecasts safety-relevant futures and an adjudication task that decides safety from both the observed prefix and anticipated future. The two tasks are jointly optimized with CoAA-RL, which rewards forecasts by their utility for downstream safety judgment. The resulting guard model, Vanguard, blocks unsafe actions before execution. Across four agent-safety benchmarks, Vanguard improves average protection by 15.9 percentage points over baseline guards while increasing benign task completion by 5.1 percentage points.

Yuan Xiong, Linji Hao, Shizhu He +2

The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences, Beijing, China · School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China · Peking University, Beijing, China +2

Foresight Risk

Ask PDF