{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:3CIDEMCT4R5VV63LUBBZNANF4T","short_pith_number":"pith:3CIDEMCT","canonical_record":{"source":{"id":"2507.04673","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-07T05:35:21Z","cross_cats_sorted":[],"title_canon_sha256":"eb533bc45f152f8cb57172ab64c2f848de84b4d2ad6931c757a17d8382a8b876","abstract_canon_sha256":"81f846f8999f7c7d862a0b90c9253572f5d8eb630470f5785a62870bb60f8264"},"schema_version":"1.0"},"canonical_sha256":"d890323053e47b5afb6ba0439681a5e4fea27f6c91e1ab1051d3390278f3bd04","source":{"kind":"arxiv","id":"2507.04673","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.04673","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"arxiv_version","alias_value":"2507.04673v1","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.04673","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_12","alias_value":"3CIDEMCT4R5V","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_16","alias_value":"3CIDEMCT4R5VV63L","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_8","alias_value":"3CIDEMCT","created_at":"2026-07-05T11:32:51Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:3CIDEMCT4R5VV63LUBBZNANF4T","target":"record","payload":{"canonical_record":{"source":{"id":"2507.04673","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-07T05:35:21Z","cross_cats_sorted":[],"title_canon_sha256":"eb533bc45f152f8cb57172ab64c2f848de84b4d2ad6931c757a17d8382a8b876","abstract_canon_sha256":"81f846f8999f7c7d862a0b90c9253572f5d8eb630470f5785a62870bb60f8264"},"schema_version":"1.0"},"canonical_sha256":"d890323053e47b5afb6ba0439681a5e4fea27f6c91e1ab1051d3390278f3bd04","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:32:51.828685Z","signature_b64":"2lEHWOo5vOYlBzcFBVklHsBCGR1c8dFdCV0xT9tW4WLLFlrbA+4PhFwB4VSBjORIQsQWuiEajRQQzePDuTxmBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d890323053e47b5afb6ba0439681a5e4fea27f6c91e1ab1051d3390278f3bd04","last_reissued_at":"2026-07-05T11:32:51.828220Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:32:51.828220Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.04673","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:32:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"85TK+aT9xdFRVmsjtHijX5+d+vToYZP3ekxJfR4RclAXm8YJf7P6ct2mJAGtqsPRH0G6Sg3m6mOiVDgW5oggCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:16:07.233301Z"},"content_sha256":"d395ed56ca2a3f1c4233b05e82fb37ba6430dc762068c88bf44a48dcbc820b02","schema_version":"1.0","event_id":"sha256:d395ed56ca2a3f1c4233b05e82fb37ba6430dc762068c88bf44a48dcbc820b02"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:3CIDEMCT4R5VV63LUBBZNANF4T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.AI","authors_text":"Li Qian, Wei Duan","submitted_at":"2025-07-07T05:35:21Z","abstract_excerpt":"The rise of conversational interfaces has greatly enhanced LLM usability by leveraging dialogue history for sophisticated reasoning. However, this reliance introduces an unexplored attack surface. This paper introduces Trojan Horse Prompting, a novel jailbreak technique. Adversaries bypass safety mechanisms by forging the model's own past utterances within the conversational history provided to its API. A malicious payload is injected into a model-attributed message, followed by a benign user prompt to trigger harmful content generation. This vulnerability stems from Asymmetric Safety Alignmen"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.04673","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.04673/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:32:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"81geQFAfhs4P8Jt/CPrT9S8kJbLc13AkgXm29iTotCVCuZJ5CdCkHKX+GD3VQjulY3urXLbRqepBivGgxm8vCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:16:07.234122Z"},"content_sha256":"774e119670e72c61ea9c2f703b4d47aae472fd79d4c69e5efe53659504686423","schema_version":"1.0","event_id":"sha256:774e119670e72c61ea9c2f703b4d47aae472fd79d4c69e5efe53659504686423"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3CIDEMCT4R5VV63LUBBZNANF4T/bundle.json","state_url":"https://pith.science/pith/3CIDEMCT4R5VV63LUBBZNANF4T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3CIDEMCT4R5VV63LUBBZNANF4T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T10:16:07Z","links":{"resolver":"https://pith.science/pith/3CIDEMCT4R5VV63LUBBZNANF4T","bundle":"https://pith.science/pith/3CIDEMCT4R5VV63LUBBZNANF4T/bundle.json","state":"https://pith.science/pith/3CIDEMCT4R5VV63LUBBZNANF4T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3CIDEMCT4R5VV63LUBBZNANF4T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:3CIDEMCT4R5VV63LUBBZNANF4T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"81f846f8999f7c7d862a0b90c9253572f5d8eb630470f5785a62870bb60f8264","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-07T05:35:21Z","title_canon_sha256":"eb533bc45f152f8cb57172ab64c2f848de84b4d2ad6931c757a17d8382a8b876"},"schema_version":"1.0","source":{"id":"2507.04673","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.04673","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"arxiv_version","alias_value":"2507.04673v1","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.04673","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_12","alias_value":"3CIDEMCT4R5V","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_16","alias_value":"3CIDEMCT4R5VV63L","created_at":"2026-07-05T11:32:51Z"},{"alias_kind":"pith_short_8","alias_value":"3CIDEMCT","created_at":"2026-07-05T11:32:51Z"}],"graph_snapshots":[{"event_id":"sha256:774e119670e72c61ea9c2f703b4d47aae472fd79d4c69e5efe53659504686423","target":"graph","created_at":"2026-07-05T11:32:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.04673/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The rise of conversational interfaces has greatly enhanced LLM usability by leveraging dialogue history for sophisticated reasoning. However, this reliance introduces an unexplored attack surface. This paper introduces Trojan Horse Prompting, a novel jailbreak technique. Adversaries bypass safety mechanisms by forging the model's own past utterances within the conversational history provided to its API. A malicious payload is injected into a model-attributed message, followed by a benign user prompt to trigger harmful content generation. This vulnerability stems from Asymmetric Safety Alignmen","authors_text":"Li Qian, Wei Duan","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.04673","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d395ed56ca2a3f1c4233b05e82fb37ba6430dc762068c88bf44a48dcbc820b02","target":"record","created_at":"2026-07-05T11:32:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"81f846f8999f7c7d862a0b90c9253572f5d8eb630470f5785a62870bb60f8264","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-07T05:35:21Z","title_canon_sha256":"eb533bc45f152f8cb57172ab64c2f848de84b4d2ad6931c757a17d8382a8b876"},"schema_version":"1.0","source":{"id":"2507.04673","kind":"arxiv","version":1}},"canonical_sha256":"d890323053e47b5afb6ba0439681a5e4fea27f6c91e1ab1051d3390278f3bd04","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d890323053e47b5afb6ba0439681a5e4fea27f6c91e1ab1051d3390278f3bd04","first_computed_at":"2026-07-05T11:32:51.828220Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:32:51.828220Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"2lEHWOo5vOYlBzcFBVklHsBCGR1c8dFdCV0xT9tW4WLLFlrbA+4PhFwB4VSBjORIQsQWuiEajRQQzePDuTxmBA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:32:51.828685Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.04673","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d395ed56ca2a3f1c4233b05e82fb37ba6430dc762068c88bf44a48dcbc820b02","sha256:774e119670e72c61ea9c2f703b4d47aae472fd79d4c69e5efe53659504686423"],"state_sha256":"b9781f51c9b4c5ca78e31efd891f4669c0d6ca6774e373d42d757540ba15022a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DgDy2g7Is7Y3/z9lZ1nufrbGWO46Hd78WKaRS/q8KWHOvxOj9YV6bkYYAseNmBN3aTi8jGPMvM7HEiP8rNWhAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T10:16:07.244468Z","bundle_sha256":"c10324dada15e88c2ed4ca27b8fa0caf02d3c4d4adf07534be1665b424a05fe3"}}