{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:3WZLXKDWBU4ORQLJGZYRWJPS66","short_pith_number":"pith:3WZLXKDW","canonical_record":{"source":{"id":"2503.16023","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-03-20T10:39:51Z","cross_cats_sorted":[],"title_canon_sha256":"e2ce7c6fa148d33ef13b29aef33c18134f93f77cce83c9d0d76c0051924518ce","abstract_canon_sha256":"4d488e61e137998b99a2cec254f63167b1cf65f8f70b01f87a00f126648cb18a"},"schema_version":"1.0"},"canonical_sha256":"ddb2bba8760d38e8c16936711b25f2f7bd37daa2589436390931d33071a25ea0","source":{"kind":"arxiv","id":"2503.16023","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.16023","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"arxiv_version","alias_value":"2503.16023v1","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.16023","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_12","alias_value":"3WZLXKDWBU4O","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_16","alias_value":"3WZLXKDWBU4ORQLJ","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_8","alias_value":"3WZLXKDW","created_at":"2026-07-05T10:36:04Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:3WZLXKDWBU4ORQLJGZYRWJPS66","target":"record","payload":{"canonical_record":{"source":{"id":"2503.16023","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-03-20T10:39:51Z","cross_cats_sorted":[],"title_canon_sha256":"e2ce7c6fa148d33ef13b29aef33c18134f93f77cce83c9d0d76c0051924518ce","abstract_canon_sha256":"4d488e61e137998b99a2cec254f63167b1cf65f8f70b01f87a00f126648cb18a"},"schema_version":"1.0"},"canonical_sha256":"ddb2bba8760d38e8c16936711b25f2f7bd37daa2589436390931d33071a25ea0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:36:04.399302Z","signature_b64":"h9PzYnI9ZYrbNNQBJ940xVhNGGie8Dkjl4k2Ahm7kARodAiKF2d2xzkah5PmHBEm6dLeHJ3N6PxgsrMzG1bCAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ddb2bba8760d38e8c16936711b25f2f7bd37daa2589436390931d33071a25ea0","last_reissued_at":"2026-07-05T10:36:04.398813Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:36:04.398813Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.16023","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:36:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GDIz2Ez1ebp6aZx13WaS+/hAKfN80JWl03Yfx5c1VbD1miJi/oE6B8SxG7O/rkuJQcoXRQEtAVpnm7owiassDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T20:49:37.741846Z"},"content_sha256":"fab18c7c46bcfce586dc9aa72a7b3e5612e3ba53c1b80ed97fbef427661e035d","schema_version":"1.0","event_id":"sha256:fab18c7c46bcfce586dc9aa72a7b3e5612e3ba53c1b80ed97fbef427661e035d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:3WZLXKDWBU4ORQLJGZYRWJPS66","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Jiawen Shi, Lichao Sun, Neil Zhenqiang Gong, Pan Zhou, Zenghui Yuan","submitted_at":"2025-03-20T10:39:51Z","abstract_excerpt":"Multi-modal large language models (MLLMs) extend large language models (LLMs) to process multi-modal information, enabling them to generate responses to image-text inputs. MLLMs have been incorporated into diverse multi-modal applications, such as autonomous driving and medical diagnosis, via plug-and-play without fine-tuning. This deployment paradigm increases the vulnerability of MLLMs to backdoor attacks. However, existing backdoor attacks against MLLMs achieve limited effectiveness and stealthiness. In this work, we propose BadToken, the first token-level backdoor attack to MLLMs. BadToken"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.16023","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.16023/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:36:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SaAi0aX6CytP6eK37FRqrXs0U8opY7VaOIkYpivE8dfyTeaZG3kBzv9r4O9lmwSJdcF7NgD15qrheskPO2diBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T20:49:37.742769Z"},"content_sha256":"f86c9ca9bec3f8090072f4e87e3171d7beef44f958387a83f32ec6454da9e7f3","schema_version":"1.0","event_id":"sha256:f86c9ca9bec3f8090072f4e87e3171d7beef44f958387a83f32ec6454da9e7f3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/bundle.json","state_url":"https://pith.science/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T20:49:37Z","links":{"resolver":"https://pith.science/pith/3WZLXKDWBU4ORQLJGZYRWJPS66","bundle":"https://pith.science/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/bundle.json","state":"https://pith.science/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3WZLXKDWBU4ORQLJGZYRWJPS66/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:3WZLXKDWBU4ORQLJGZYRWJPS66","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4d488e61e137998b99a2cec254f63167b1cf65f8f70b01f87a00f126648cb18a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-03-20T10:39:51Z","title_canon_sha256":"e2ce7c6fa148d33ef13b29aef33c18134f93f77cce83c9d0d76c0051924518ce"},"schema_version":"1.0","source":{"id":"2503.16023","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.16023","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"arxiv_version","alias_value":"2503.16023v1","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.16023","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_12","alias_value":"3WZLXKDWBU4O","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_16","alias_value":"3WZLXKDWBU4ORQLJ","created_at":"2026-07-05T10:36:04Z"},{"alias_kind":"pith_short_8","alias_value":"3WZLXKDW","created_at":"2026-07-05T10:36:04Z"}],"graph_snapshots":[{"event_id":"sha256:f86c9ca9bec3f8090072f4e87e3171d7beef44f958387a83f32ec6454da9e7f3","target":"graph","created_at":"2026-07-05T10:36:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.16023/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Multi-modal large language models (MLLMs) extend large language models (LLMs) to process multi-modal information, enabling them to generate responses to image-text inputs. MLLMs have been incorporated into diverse multi-modal applications, such as autonomous driving and medical diagnosis, via plug-and-play without fine-tuning. This deployment paradigm increases the vulnerability of MLLMs to backdoor attacks. However, existing backdoor attacks against MLLMs achieve limited effectiveness and stealthiness. In this work, we propose BadToken, the first token-level backdoor attack to MLLMs. BadToken","authors_text":"Jiawen Shi, Lichao Sun, Neil Zhenqiang Gong, Pan Zhou, Zenghui Yuan","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-03-20T10:39:51Z","title":"BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.16023","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fab18c7c46bcfce586dc9aa72a7b3e5612e3ba53c1b80ed97fbef427661e035d","target":"record","created_at":"2026-07-05T10:36:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4d488e61e137998b99a2cec254f63167b1cf65f8f70b01f87a00f126648cb18a","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-03-20T10:39:51Z","title_canon_sha256":"e2ce7c6fa148d33ef13b29aef33c18134f93f77cce83c9d0d76c0051924518ce"},"schema_version":"1.0","source":{"id":"2503.16023","kind":"arxiv","version":1}},"canonical_sha256":"ddb2bba8760d38e8c16936711b25f2f7bd37daa2589436390931d33071a25ea0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ddb2bba8760d38e8c16936711b25f2f7bd37daa2589436390931d33071a25ea0","first_computed_at":"2026-07-05T10:36:04.398813Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:36:04.398813Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"h9PzYnI9ZYrbNNQBJ940xVhNGGie8Dkjl4k2Ahm7kARodAiKF2d2xzkah5PmHBEm6dLeHJ3N6PxgsrMzG1bCAw==","signature_status":"signed_v1","signed_at":"2026-07-05T10:36:04.399302Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.16023","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fab18c7c46bcfce586dc9aa72a7b3e5612e3ba53c1b80ed97fbef427661e035d","sha256:f86c9ca9bec3f8090072f4e87e3171d7beef44f958387a83f32ec6454da9e7f3"],"state_sha256":"658f7bf7629c790a72cd2a7b8635a5b62debae0e8a36a9beb7243004433f0ed9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pLn3rN3vY1nUVlN0v3B4darE7pcsofz0/xRBQdsFWss5VWsl9cPlt5CdvyJLJP3cZSk+w8yc9hlpQixQzxzeBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T20:49:37.755989Z","bundle_sha256":"fbd9ace1d14086eb8ab3502341ee37014c5e9158d266ee62376e2507e9f5e4e1"}}