{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:2YXMNZNPT5HIBFWUITXVBBOZ4F","short_pith_number":"pith:2YXMNZNP","canonical_record":{"source":{"id":"2506.14539","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-06-17T14:01:39Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"398f3feb877b3038faa7d7601f93851377b084f6e4c4f55925898bc3e4952abb","abstract_canon_sha256":"3e8d2196202773a373bff13e9b7e3b16a37e5d8c4bcec422d610864515b8e894"},"schema_version":"1.0"},"canonical_sha256":"d62ec6e5af9f4e8096d444ef5085d9e14cd4683bf011364713c25bd8a5d91a58","source":{"kind":"arxiv","id":"2506.14539","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.14539","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"arxiv_version","alias_value":"2506.14539v2","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.14539","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_12","alias_value":"2YXMNZNPT5HI","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_16","alias_value":"2YXMNZNPT5HIBFWU","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_8","alias_value":"2YXMNZNP","created_at":"2026-07-05T11:27:31Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:2YXMNZNPT5HIBFWUITXVBBOZ4F","target":"record","payload":{"canonical_record":{"source":{"id":"2506.14539","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-06-17T14:01:39Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"398f3feb877b3038faa7d7601f93851377b084f6e4c4f55925898bc3e4952abb","abstract_canon_sha256":"3e8d2196202773a373bff13e9b7e3b16a37e5d8c4bcec422d610864515b8e894"},"schema_version":"1.0"},"canonical_sha256":"d62ec6e5af9f4e8096d444ef5085d9e14cd4683bf011364713c25bd8a5d91a58","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:27:31.063537Z","signature_b64":"CG+tb49PDPNKz1Ikz0LmZ3Pafr3XG6EsTAbIKKTMe7Mge9/DefRlseVadORetn3o5WRGv+Phd99zCioKkkVsDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d62ec6e5af9f4e8096d444ef5085d9e14cd4683bf011364713c25bd8a5d91a58","last_reissued_at":"2026-07-05T11:27:31.063128Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:27:31.063128Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.14539","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:27:31Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"7iN0+UCFA8uVIsyd+61R+Niq4z3txxSrtwI+toJmdl/AInx/v7Ily/j2Snye5kk+rxphA4LOiUbv3jpDx3teBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T21:25:13.816566Z"},"content_sha256":"b91c83dcede8eef644f7224a1b15790571a6120543720491b26458929dde54fa","schema_version":"1.0","event_id":"sha256:b91c83dcede8eef644f7224a1b15790571a6120543720491b26458929dde54fa"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:2YXMNZNPT5HIBFWUITXVBBOZ4F","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Doppelganger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.AI","authors_text":"Daewon Kang, Doyeon Kim, Kyu-Hwan Jung, Meong Hi Son, YeongHwan Shin","submitted_at":"2025-06-17T14:01:39Z","abstract_excerpt":"Since the advent of large language models, prompt engineering now enables the rapid, low-effort creation of diverse autonomous agents that are already in widespread use. Yet this convenience raises urgent concerns about the safety, robustness, and behavioral consistency of the underlying prompts, along with the pressing challenge of preventing those prompts from being exposed to user's attempts. In this paper, we propose the ''Doppelganger method'' to demonstrate the risk of an agent being hijacked, thereby exposing system instructions and internal information. Next, we define the ''Prompt Ali"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.14539","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.14539/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:27:31Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"mzAOr/eH4W3f/68gpYIw4floJ2w31VulcFBuz9aT3YSfMhkC0MizCmA0C5YH3NQ//AY2a8AIjOaYzO6ZeiL+CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T21:25:13.817261Z"},"content_sha256":"42f5861a7cde23584b26e1add5f0a8208f410ff2d7480e7e9c08d7c5935c0b56","schema_version":"1.0","event_id":"sha256:42f5861a7cde23584b26e1add5f0a8208f410ff2d7480e7e9c08d7c5935c0b56"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/bundle.json","state_url":"https://pith.science/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T21:25:13Z","links":{"resolver":"https://pith.science/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F","bundle":"https://pith.science/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/bundle.json","state":"https://pith.science/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2YXMNZNPT5HIBFWUITXVBBOZ4F/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:2YXMNZNPT5HIBFWUITXVBBOZ4F","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3e8d2196202773a373bff13e9b7e3b16a37e5d8c4bcec422d610864515b8e894","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-06-17T14:01:39Z","title_canon_sha256":"398f3feb877b3038faa7d7601f93851377b084f6e4c4f55925898bc3e4952abb"},"schema_version":"1.0","source":{"id":"2506.14539","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.14539","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"arxiv_version","alias_value":"2506.14539v2","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.14539","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_12","alias_value":"2YXMNZNPT5HI","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_16","alias_value":"2YXMNZNPT5HIBFWU","created_at":"2026-07-05T11:27:31Z"},{"alias_kind":"pith_short_8","alias_value":"2YXMNZNP","created_at":"2026-07-05T11:27:31Z"}],"graph_snapshots":[{"event_id":"sha256:42f5861a7cde23584b26e1add5f0a8208f410ff2d7480e7e9c08d7c5935c0b56","target":"graph","created_at":"2026-07-05T11:27:31Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.14539/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Since the advent of large language models, prompt engineering now enables the rapid, low-effort creation of diverse autonomous agents that are already in widespread use. Yet this convenience raises urgent concerns about the safety, robustness, and behavioral consistency of the underlying prompts, along with the pressing challenge of preventing those prompts from being exposed to user's attempts. In this paper, we propose the ''Doppelganger method'' to demonstrate the risk of an agent being hijacked, thereby exposing system instructions and internal information. Next, we define the ''Prompt Ali","authors_text":"Daewon Kang, Doyeon Kim, Kyu-Hwan Jung, Meong Hi Son, YeongHwan Shin","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-06-17T14:01:39Z","title":"Doppelganger Method: Breaking Role Consistency in LLM Agent via Prompt-based Transferable Adversarial Attack"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.14539","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b91c83dcede8eef644f7224a1b15790571a6120543720491b26458929dde54fa","target":"record","created_at":"2026-07-05T11:27:31Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3e8d2196202773a373bff13e9b7e3b16a37e5d8c4bcec422d610864515b8e894","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-06-17T14:01:39Z","title_canon_sha256":"398f3feb877b3038faa7d7601f93851377b084f6e4c4f55925898bc3e4952abb"},"schema_version":"1.0","source":{"id":"2506.14539","kind":"arxiv","version":2}},"canonical_sha256":"d62ec6e5af9f4e8096d444ef5085d9e14cd4683bf011364713c25bd8a5d91a58","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d62ec6e5af9f4e8096d444ef5085d9e14cd4683bf011364713c25bd8a5d91a58","first_computed_at":"2026-07-05T11:27:31.063128Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:27:31.063128Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"CG+tb49PDPNKz1Ikz0LmZ3Pafr3XG6EsTAbIKKTMe7Mge9/DefRlseVadORetn3o5WRGv+Phd99zCioKkkVsDg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:27:31.063537Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.14539","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b91c83dcede8eef644f7224a1b15790571a6120543720491b26458929dde54fa","sha256:42f5861a7cde23584b26e1add5f0a8208f410ff2d7480e7e9c08d7c5935c0b56"],"state_sha256":"21f96c51e1890702574b247b006c87c5a55bd4659a6184c1891d57ce6bf382c5"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"nu1fSZgVstqJqpheKm+P+Z1t6/mxkco1cfMZlXlMiGWvYEFb6t2dkm167RFhV7AzYc1kl2G8KOad+9ugtbxMCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T21:25:13.821601Z","bundle_sha256":"aecd01a1e61523e6d70c7a2d5a39b082f3741760a5384686faa63baf4349c270"}}