{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:3XDCKQL6G3IFP4MGM4VHI3FF6T","short_pith_number":"pith:3XDCKQL6","canonical_record":{"source":{"id":"2310.07676","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-11T17:21:03Z","cross_cats_sorted":["cs.CL","cs.LG"],"title_canon_sha256":"b5e7a7cc61965345482980210e72063ec34fcbdc0d8a6d477633b660935db221","abstract_canon_sha256":"c22503195e8ab302e5a9f352d9db510a56b724fe00c2794e7c5824c9acdd92a6"},"schema_version":"1.0"},"canonical_sha256":"ddc625417e36d057f186672a746ca5f4f67c15c7cc3308ced0f3dfd0837bcc08","source":{"kind":"arxiv","id":"2310.07676","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2310.07676","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"arxiv_version","alias_value":"2310.07676v2","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2310.07676","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_12","alias_value":"3XDCKQL6G3IF","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_16","alias_value":"3XDCKQL6G3IFP4MG","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_8","alias_value":"3XDCKQL6","created_at":"2026-07-05T08:02:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:3XDCKQL6G3IFP4MGM4VHI3FF6T","target":"record","payload":{"canonical_record":{"source":{"id":"2310.07676","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-11T17:21:03Z","cross_cats_sorted":["cs.CL","cs.LG"],"title_canon_sha256":"b5e7a7cc61965345482980210e72063ec34fcbdc0d8a6d477633b660935db221","abstract_canon_sha256":"c22503195e8ab302e5a9f352d9db510a56b724fe00c2794e7c5824c9acdd92a6"},"schema_version":"1.0"},"canonical_sha256":"ddc625417e36d057f186672a746ca5f4f67c15c7cc3308ced0f3dfd0837bcc08","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:02:21.976175Z","signature_b64":"EJZDqsm3crjwHma/R+ah4HYaO2wptvCR0cWsug4kBa/FinrsZkCdVIPlmXDlth/+olMvHR2Mr5vE/uj76ObPCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ddc625417e36d057f186672a746ca5f4f67c15c7cc3308ced0f3dfd0837bcc08","last_reissued_at":"2026-07-05T08:02:21.975670Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:02:21.975670Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2310.07676","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:02:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zG21a5kMt0uUfdwR/TupRLkUgFizKqF7yzUtLgQOUVqQvRwHYR+dYX93QOgpozcNI19E/xGhMbFe3dH2N3HQCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T11:11:43.943925Z"},"content_sha256":"b8b1f873fdd23ba9677954d144f6ee0784c4c35cd9a4818fade19b380fcbc87c","schema_version":"1.0","event_id":"sha256:b8b1f873fdd23ba9677954d144f6ee0784c4c35cd9a4818fade19b380fcbc87c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:3XDCKQL6G3IFP4MGM4VHI3FF6T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Composite Backdoor Attacks Against Large Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Hai Huang, Michael Backes, Yang Zhang, Yun Shen, Zhengyu Zhao","submitted_at":"2023-10-11T17:21:03Z","abstract_excerpt":"Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same mu"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2310.07676","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2310.07676/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:02:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hwv9dDzLJ4WJgIcPgl2H5WRWqSU57NHYLrAshEGUZTc6ADnHVTtBrrmcbb1vRVi1fSHBmW9n5TrJPM0j5mtLBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T11:11:43.944693Z"},"content_sha256":"fcfa1f913a4d445d9a97752e10aedcabbb53c4bb0b4e2b5d37d033e54392a323","schema_version":"1.0","event_id":"sha256:fcfa1f913a4d445d9a97752e10aedcabbb53c4bb0b4e2b5d37d033e54392a323"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/bundle.json","state_url":"https://pith.science/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T11:11:43Z","links":{"resolver":"https://pith.science/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T","bundle":"https://pith.science/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/bundle.json","state":"https://pith.science/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3XDCKQL6G3IFP4MGM4VHI3FF6T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:3XDCKQL6G3IFP4MGM4VHI3FF6T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c22503195e8ab302e5a9f352d9db510a56b724fe00c2794e7c5824c9acdd92a6","cross_cats_sorted":["cs.CL","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-11T17:21:03Z","title_canon_sha256":"b5e7a7cc61965345482980210e72063ec34fcbdc0d8a6d477633b660935db221"},"schema_version":"1.0","source":{"id":"2310.07676","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2310.07676","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"arxiv_version","alias_value":"2310.07676v2","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2310.07676","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_12","alias_value":"3XDCKQL6G3IF","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_16","alias_value":"3XDCKQL6G3IFP4MG","created_at":"2026-07-05T08:02:21Z"},{"alias_kind":"pith_short_8","alias_value":"3XDCKQL6","created_at":"2026-07-05T08:02:21Z"}],"graph_snapshots":[{"event_id":"sha256:fcfa1f913a4d445d9a97752e10aedcabbb53c4bb0b4e2b5d37d033e54392a323","target":"graph","created_at":"2026-07-05T08:02:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2310.07676/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same mu","authors_text":"Hai Huang, Michael Backes, Yang Zhang, Yun Shen, Zhengyu Zhao","cross_cats":["cs.CL","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-11T17:21:03Z","title":"Composite Backdoor Attacks Against Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2310.07676","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b8b1f873fdd23ba9677954d144f6ee0784c4c35cd9a4818fade19b380fcbc87c","target":"record","created_at":"2026-07-05T08:02:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c22503195e8ab302e5a9f352d9db510a56b724fe00c2794e7c5824c9acdd92a6","cross_cats_sorted":["cs.CL","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-10-11T17:21:03Z","title_canon_sha256":"b5e7a7cc61965345482980210e72063ec34fcbdc0d8a6d477633b660935db221"},"schema_version":"1.0","source":{"id":"2310.07676","kind":"arxiv","version":2}},"canonical_sha256":"ddc625417e36d057f186672a746ca5f4f67c15c7cc3308ced0f3dfd0837bcc08","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ddc625417e36d057f186672a746ca5f4f67c15c7cc3308ced0f3dfd0837bcc08","first_computed_at":"2026-07-05T08:02:21.975670Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:02:21.975670Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"EJZDqsm3crjwHma/R+ah4HYaO2wptvCR0cWsug4kBa/FinrsZkCdVIPlmXDlth/+olMvHR2Mr5vE/uj76ObPCg==","signature_status":"signed_v1","signed_at":"2026-07-05T08:02:21.976175Z","signed_message":"canonical_sha256_bytes"},"source_id":"2310.07676","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b8b1f873fdd23ba9677954d144f6ee0784c4c35cd9a4818fade19b380fcbc87c","sha256:fcfa1f913a4d445d9a97752e10aedcabbb53c4bb0b4e2b5d37d033e54392a323"],"state_sha256":"e4f0cc55efb13c6e74128ea5bbe1a9543d543f3d2d84abb5f5a6e96df934669e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DM89k1LtCAhi2BTCo61sXeyQZ2Vr4ABYuod2ErPlF+EEzeqUsBcvIvXJW81J7ptoYtkT57z11pHJnNJNgH8yDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T11:11:43.949838Z","bundle_sha256":"4549e269080b3a5723928a74149a13daa621c1c345872c7c891cd63d1d510371"}}