{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:2XYCSAYA4CVQOXNJGKZZ6FPOX5","short_pith_number":"pith:2XYCSAYA","canonical_record":{"source":{"id":"2506.13161","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T07:17:34Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"89836ac2e4b1b04d2222d3cadf61b02e191037b9042246a54b21ed06640017d2","abstract_canon_sha256":"6ad8c3b9e54dbaa9779f94d5201bf56a3530a0d86df8d66e1bd0626437c86795"},"schema_version":"1.0"},"canonical_sha256":"d5f0290300e0ab075da932b39f15eebf5b24da252eb7fa37e2097b2fa712b508","source":{"kind":"arxiv","id":"2506.13161","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.13161","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"arxiv_version","alias_value":"2506.13161v1","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.13161","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_12","alias_value":"2XYCSAYA4CVQ","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_16","alias_value":"2XYCSAYA4CVQOXNJ","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_8","alias_value":"2XYCSAYA","created_at":"2026-07-05T11:22:06Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:2XYCSAYA4CVQOXNJGKZZ6FPOX5","target":"record","payload":{"canonical_record":{"source":{"id":"2506.13161","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T07:17:34Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"89836ac2e4b1b04d2222d3cadf61b02e191037b9042246a54b21ed06640017d2","abstract_canon_sha256":"6ad8c3b9e54dbaa9779f94d5201bf56a3530a0d86df8d66e1bd0626437c86795"},"schema_version":"1.0"},"canonical_sha256":"d5f0290300e0ab075da932b39f15eebf5b24da252eb7fa37e2097b2fa712b508","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:22:06.047405Z","signature_b64":"n1lIkljblB0ys+xPI4Pu6VF3f4WUznVBRl3FTr9cN10usviv0qvZa6LOK7oZyZ9FJO/LkZ6oYIaKahWeWU9xBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d5f0290300e0ab075da932b39f15eebf5b24da252eb7fa37e2097b2fa712b508","last_reissued_at":"2026-07-05T11:22:06.046817Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:22:06.046817Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.13161","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:22:06Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"I7p61vb+O9YFOwZS5An5v7lVWyc2xdcqKL4wSXApqUkF3Yy4RphfCyJjy7r4cLDBk3pQ1aAOnV9caSy/EOPoAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:46:26.107737Z"},"content_sha256":"75f3a7a48a133c67f2a49de9c9c22a6cf34a99147a47da8d8bf3ee7b6efc8972","schema_version":"1.0","event_id":"sha256:75f3a7a48a133c67f2a49de9c9c22a6cf34a99147a47da8d8bf3ee7b6efc8972"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:2XYCSAYA4CVQOXNJGKZZ6FPOX5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Using LLMs for Security Advisory Investigations: How Far Are We?","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Bayu Fedra Abdullah, Brittany Reid, Kazumasa Shimari, Kenichi Matsumoto, Raula Gaikovina Kula, Yusuf Sulistyo Nugroho","submitted_at":"2025-06-16T07:17:34Z","abstract_excerpt":"Large Language Models (LLMs) are increasingly used in software security, but their trustworthiness in generating accurate vulnerability advisories remains uncertain. This study investigates the ability of ChatGPT to (1) generate plausible security advisories from CVE-IDs, (2) differentiate real from fake CVE-IDs, and (3) extract CVE-IDs from advisory descriptions. Using a curated dataset of 100 real and 100 fake CVE-IDs, we manually analyzed the credibility and consistency of the model's outputs. The results show that ChatGPT generated plausible security advisories for 96% of given input real "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.13161","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.13161/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:22:06Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SmWOrbpypJxmMUaYjmQkpHZhL9GtrstU5xvb2pZYByR1pGV+eyJenng917EYsOJATTdzfRkFHp+lvq4Og5a6Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T20:46:26.108107Z"},"content_sha256":"7216f89d80a2c3dff6b94385af6daf2ccffa21b2dbc300e56c32f39328d0f4e2","schema_version":"1.0","event_id":"sha256:7216f89d80a2c3dff6b94385af6daf2ccffa21b2dbc300e56c32f39328d0f4e2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/bundle.json","state_url":"https://pith.science/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T20:46:26Z","links":{"resolver":"https://pith.science/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5","bundle":"https://pith.science/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/bundle.json","state":"https://pith.science/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2XYCSAYA4CVQOXNJGKZZ6FPOX5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:2XYCSAYA4CVQOXNJGKZZ6FPOX5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6ad8c3b9e54dbaa9779f94d5201bf56a3530a0d86df8d66e1bd0626437c86795","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T07:17:34Z","title_canon_sha256":"89836ac2e4b1b04d2222d3cadf61b02e191037b9042246a54b21ed06640017d2"},"schema_version":"1.0","source":{"id":"2506.13161","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.13161","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"arxiv_version","alias_value":"2506.13161v1","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.13161","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_12","alias_value":"2XYCSAYA4CVQ","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_16","alias_value":"2XYCSAYA4CVQOXNJ","created_at":"2026-07-05T11:22:06Z"},{"alias_kind":"pith_short_8","alias_value":"2XYCSAYA","created_at":"2026-07-05T11:22:06Z"}],"graph_snapshots":[{"event_id":"sha256:7216f89d80a2c3dff6b94385af6daf2ccffa21b2dbc300e56c32f39328d0f4e2","target":"graph","created_at":"2026-07-05T11:22:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.13161/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) are increasingly used in software security, but their trustworthiness in generating accurate vulnerability advisories remains uncertain. This study investigates the ability of ChatGPT to (1) generate plausible security advisories from CVE-IDs, (2) differentiate real from fake CVE-IDs, and (3) extract CVE-IDs from advisory descriptions. Using a curated dataset of 100 real and 100 fake CVE-IDs, we manually analyzed the credibility and consistency of the model's outputs. The results show that ChatGPT generated plausible security advisories for 96% of given input real ","authors_text":"Bayu Fedra Abdullah, Brittany Reid, Kazumasa Shimari, Kenichi Matsumoto, Raula Gaikovina Kula, Yusuf Sulistyo Nugroho","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T07:17:34Z","title":"Using LLMs for Security Advisory Investigations: How Far Are We?"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.13161","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:75f3a7a48a133c67f2a49de9c9c22a6cf34a99147a47da8d8bf3ee7b6efc8972","target":"record","created_at":"2026-07-05T11:22:06Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6ad8c3b9e54dbaa9779f94d5201bf56a3530a0d86df8d66e1bd0626437c86795","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T07:17:34Z","title_canon_sha256":"89836ac2e4b1b04d2222d3cadf61b02e191037b9042246a54b21ed06640017d2"},"schema_version":"1.0","source":{"id":"2506.13161","kind":"arxiv","version":1}},"canonical_sha256":"d5f0290300e0ab075da932b39f15eebf5b24da252eb7fa37e2097b2fa712b508","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d5f0290300e0ab075da932b39f15eebf5b24da252eb7fa37e2097b2fa712b508","first_computed_at":"2026-07-05T11:22:06.046817Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:22:06.046817Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"n1lIkljblB0ys+xPI4Pu6VF3f4WUznVBRl3FTr9cN10usviv0qvZa6LOK7oZyZ9FJO/LkZ6oYIaKahWeWU9xBw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:22:06.047405Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.13161","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:75f3a7a48a133c67f2a49de9c9c22a6cf34a99147a47da8d8bf3ee7b6efc8972","sha256:7216f89d80a2c3dff6b94385af6daf2ccffa21b2dbc300e56c32f39328d0f4e2"],"state_sha256":"53c7abeb779a08f9b2557faefa5141b6c03b172a780d7f36bc1d6318c69f8c85"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jcuBAQD2qTq9G+ZXVTTY1oTQbNt8d5RHBxHEM7lgfPlaiSN/RdOuWhOmq0FxDlqJ0b0JmaUl6moapgGKjvyuCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T20:46:26.110047Z","bundle_sha256":"29f0d0f7d3477695683404ab330ad4246c5817588b9b1fbd9a2f437fa67dba6f"}}