{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:3TDZOES26W2NUASFGEU323UARE","short_pith_number":"pith:3TDZOES2","canonical_record":{"source":{"id":"2509.06338","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-08T05:00:58Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"2804e5f36d00d03d52fbf132a6c92f110579e82de356d2c53534ab04f3dcdabe","abstract_canon_sha256":"b2d06aa265d57f39dd988b694f45f69f585a24df79fecea80d0a592574ec7909"},"schema_version":"1.0"},"canonical_sha256":"dcc797125af5b4da02453129bd6e80891d7b90d1d2a3d80fe859eaad4f857d9a","source":{"kind":"arxiv","id":"2509.06338","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.06338","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"arxiv_version","alias_value":"2509.06338v1","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.06338","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_12","alias_value":"3TDZOES26W2N","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_16","alias_value":"3TDZOES26W2NUASF","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_8","alias_value":"3TDZOES2","created_at":"2026-07-05T12:06:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:3TDZOES26W2NUASFGEU323UARE","target":"record","payload":{"canonical_record":{"source":{"id":"2509.06338","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-08T05:00:58Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"2804e5f36d00d03d52fbf132a6c92f110579e82de356d2c53534ab04f3dcdabe","abstract_canon_sha256":"b2d06aa265d57f39dd988b694f45f69f585a24df79fecea80d0a592574ec7909"},"schema_version":"1.0"},"canonical_sha256":"dcc797125af5b4da02453129bd6e80891d7b90d1d2a3d80fe859eaad4f857d9a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:06:33.980517Z","signature_b64":"SORLq32wzkXsVUJWxcIXyid3rQcQDTXPwdkBQ4ybhq2QOz2wWabKtfvs6miyaTg7OQsuNtqpjJETh5tqSTHtCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"dcc797125af5b4da02453129bd6e80891d7b90d1d2a3d80fe859eaad4f857d9a","last_reissued_at":"2026-07-05T12:06:33.980069Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:06:33.980069Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.06338","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:06:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"TnxMfQz2s+hniCFadkNuOH+Ge5RoPlrKkPBMSmKxhD/nxf83ivKsuX0rOjYRxQICIaf0u9eiQOq75FuaAvr0DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T01:01:55.136851Z"},"content_sha256":"9f26c215b77368e804ee9db81431f6b2cf65604cddb40a872e792e2e08890eba","schema_version":"1.0","event_id":"sha256:9f26c215b77368e804ee9db81431f6b2cf65604cddb40a872e792e2e08890eba"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:3TDZOES26W2NUASFGEU323UARE","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Embedding Poisoning: Bypassing Safety Alignment via Embedding Semantic Shift","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Guangdong Bai, Shuai Yuan, Wang Kailong, Yuxi Li, Zhibo Zhang","submitted_at":"2025-09-08T05:00:58Z","abstract_excerpt":"The widespread distribution of Large Language Models (LLMs) through public platforms like Hugging Face introduces significant security challenges. While these platforms perform basic security scans, they often fail to detect subtle manipulations within the embedding layer. This work identifies a novel class of deployment phase attacks that exploit this vulnerability by injecting imperceptible perturbations directly into the embedding layer outputs without modifying model weights or input text. These perturbations, though statistically benign, systematically bypass safety alignment mechanisms a"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.06338","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.06338/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:06:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8dZPjyLQfZ15Dvbgu92wHW5TXYlhe22q+w0jF2MDb/jwOnBbOTGYnpbmV1vKjgbJSuIsj//x1fko8HFEoQSICQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T01:01:55.137361Z"},"content_sha256":"0da844cbf3ca7bb21643fa361415fcb3b977193780b13f30ddc9d75a7f03c2fa","schema_version":"1.0","event_id":"sha256:0da844cbf3ca7bb21643fa361415fcb3b977193780b13f30ddc9d75a7f03c2fa"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3TDZOES26W2NUASFGEU323UARE/bundle.json","state_url":"https://pith.science/pith/3TDZOES26W2NUASFGEU323UARE/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3TDZOES26W2NUASFGEU323UARE/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-19T01:01:55Z","links":{"resolver":"https://pith.science/pith/3TDZOES26W2NUASFGEU323UARE","bundle":"https://pith.science/pith/3TDZOES26W2NUASFGEU323UARE/bundle.json","state":"https://pith.science/pith/3TDZOES26W2NUASFGEU323UARE/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3TDZOES26W2NUASFGEU323UARE/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:3TDZOES26W2NUASFGEU323UARE","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b2d06aa265d57f39dd988b694f45f69f585a24df79fecea80d0a592574ec7909","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-08T05:00:58Z","title_canon_sha256":"2804e5f36d00d03d52fbf132a6c92f110579e82de356d2c53534ab04f3dcdabe"},"schema_version":"1.0","source":{"id":"2509.06338","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.06338","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"arxiv_version","alias_value":"2509.06338v1","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.06338","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_12","alias_value":"3TDZOES26W2N","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_16","alias_value":"3TDZOES26W2NUASF","created_at":"2026-07-05T12:06:33Z"},{"alias_kind":"pith_short_8","alias_value":"3TDZOES2","created_at":"2026-07-05T12:06:33Z"}],"graph_snapshots":[{"event_id":"sha256:0da844cbf3ca7bb21643fa361415fcb3b977193780b13f30ddc9d75a7f03c2fa","target":"graph","created_at":"2026-07-05T12:06:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.06338/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The widespread distribution of Large Language Models (LLMs) through public platforms like Hugging Face introduces significant security challenges. While these platforms perform basic security scans, they often fail to detect subtle manipulations within the embedding layer. This work identifies a novel class of deployment phase attacks that exploit this vulnerability by injecting imperceptible perturbations directly into the embedding layer outputs without modifying model weights or input text. These perturbations, though statistically benign, systematically bypass safety alignment mechanisms a","authors_text":"Guangdong Bai, Shuai Yuan, Wang Kailong, Yuxi Li, Zhibo Zhang","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-08T05:00:58Z","title":"Embedding Poisoning: Bypassing Safety Alignment via Embedding Semantic Shift"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.06338","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9f26c215b77368e804ee9db81431f6b2cf65604cddb40a872e792e2e08890eba","target":"record","created_at":"2026-07-05T12:06:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b2d06aa265d57f39dd988b694f45f69f585a24df79fecea80d0a592574ec7909","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-09-08T05:00:58Z","title_canon_sha256":"2804e5f36d00d03d52fbf132a6c92f110579e82de356d2c53534ab04f3dcdabe"},"schema_version":"1.0","source":{"id":"2509.06338","kind":"arxiv","version":1}},"canonical_sha256":"dcc797125af5b4da02453129bd6e80891d7b90d1d2a3d80fe859eaad4f857d9a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"dcc797125af5b4da02453129bd6e80891d7b90d1d2a3d80fe859eaad4f857d9a","first_computed_at":"2026-07-05T12:06:33.980069Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:06:33.980069Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"SORLq32wzkXsVUJWxcIXyid3rQcQDTXPwdkBQ4ybhq2QOz2wWabKtfvs6miyaTg7OQsuNtqpjJETh5tqSTHtCw==","signature_status":"signed_v1","signed_at":"2026-07-05T12:06:33.980517Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.06338","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9f26c215b77368e804ee9db81431f6b2cf65604cddb40a872e792e2e08890eba","sha256:0da844cbf3ca7bb21643fa361415fcb3b977193780b13f30ddc9d75a7f03c2fa"],"state_sha256":"c696c5ae5c641c5085a23d5a0c1893c3d762c90cd695ae6496a8000a49237dc2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"78DCe6pU6eoa+gK/QMS28AAJ5BrDlT+VOZM9IzdtS/0ZJIPkIg48gr9M2iucebjX8CrukuOH7RRH/Ta4sh9qDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-19T01:01:55.142281Z","bundle_sha256":"a7ba49865461a6753597c428c6035d1ecd3bc00345f9e5699d9a2ec2d554376e"}}