{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:475ACCDMC2SD76KAJQNMO7DBKU","short_pith_number":"pith:475ACCDM","canonical_record":{"source":{"id":"2501.17433","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-01-29T06:24:58Z","cross_cats_sorted":["cs.AI","cs.CL","cs.LG"],"title_canon_sha256":"0f2af4e1672007d68b329da0e766f349e4b9cbf12dfdebf385456420fad376f8","abstract_canon_sha256":"50f1d710ebd8613ba50a47340f50d52520b03ed18cb230b3dfe2b1bd474cc824"},"schema_version":"1.0"},"canonical_sha256":"e7fa01086c16a43ff9404c1ac77c61552dd0f64d6f92af015815e58c28fb5faf","source":{"kind":"arxiv","id":"2501.17433","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2501.17433","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"arxiv_version","alias_value":"2501.17433v1","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2501.17433","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_12","alias_value":"475ACCDMC2SD","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_16","alias_value":"475ACCDMC2SD76KA","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_8","alias_value":"475ACCDM","created_at":"2026-07-05T10:06:52Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:475ACCDMC2SD76KAJQNMO7DBKU","target":"record","payload":{"canonical_record":{"source":{"id":"2501.17433","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-01-29T06:24:58Z","cross_cats_sorted":["cs.AI","cs.CL","cs.LG"],"title_canon_sha256":"0f2af4e1672007d68b329da0e766f349e4b9cbf12dfdebf385456420fad376f8","abstract_canon_sha256":"50f1d710ebd8613ba50a47340f50d52520b03ed18cb230b3dfe2b1bd474cc824"},"schema_version":"1.0"},"canonical_sha256":"e7fa01086c16a43ff9404c1ac77c61552dd0f64d6f92af015815e58c28fb5faf","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:06:52.779991Z","signature_b64":"TtPH2wUyXCgcxpS99ZAxIBBuypN8PyOi/xCUgNLC0yS2owVViFs27T6ngSTYugzYSo01lPzR5hRfFMSB6t5YBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e7fa01086c16a43ff9404c1ac77c61552dd0f64d6f92af015815e58c28fb5faf","last_reissued_at":"2026-07-05T10:06:52.779625Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:06:52.779625Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2501.17433","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:06:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"HRa8fWpyrjoogAIbjoWVmnmHvUxW/k/CoR+uUDVfhv7NdXCUiv3yuH9djM/3kUWDqoNSSrru+DIKg0h4aC9RBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T15:46:25.847044Z"},"content_sha256":"6c8f776147d5b4d4a944b291b44a1381928a9d5ed9b590cca563b094e449515d","schema_version":"1.0","event_id":"sha256:6c8f776147d5b4d4a944b291b44a1381928a9d5ed9b590cca563b094e449515d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:475ACCDMC2SD76KAJQNMO7DBKU","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Fatih Ilhan, Ling Liu, Selim Furkan Tekin, Sihao Hu, Tiansheng Huang","submitted_at":"2025-01-29T06:24:58Z","abstract_excerpt":"Recent research shows that Large Language Models (LLMs) are vulnerable to harmful fine-tuning attacks -- models lose their safety alignment ability after fine-tuning on a few harmful samples. For risk mitigation, a guardrail is typically used to filter out harmful samples before fine-tuning. By designing a new red-teaming method, we in this paper show that purely relying on the moderation guardrail for data filtration is not reliable. Our proposed attack method, dubbed Virus, easily bypasses the guardrail moderation by slightly modifying the harmful data. Experimental results show that the har"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2501.17433","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2501.17433/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:06:52Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NTN/7ZoYvzNNWmv52AS0ENVYQrrADso8I/g38d2pqux0Jb8uDP5KepkN0W8aLt1EDV1efSC4B88VMJMHpCqIBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T15:46:25.847578Z"},"content_sha256":"cbdceff6fc63ee20367df57a6add637e66c65cc26013ccf3c9b6bb09ec9a3e1f","schema_version":"1.0","event_id":"sha256:cbdceff6fc63ee20367df57a6add637e66c65cc26013ccf3c9b6bb09ec9a3e1f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/475ACCDMC2SD76KAJQNMO7DBKU/bundle.json","state_url":"https://pith.science/pith/475ACCDMC2SD76KAJQNMO7DBKU/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/475ACCDMC2SD76KAJQNMO7DBKU/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T15:46:25Z","links":{"resolver":"https://pith.science/pith/475ACCDMC2SD76KAJQNMO7DBKU","bundle":"https://pith.science/pith/475ACCDMC2SD76KAJQNMO7DBKU/bundle.json","state":"https://pith.science/pith/475ACCDMC2SD76KAJQNMO7DBKU/state.json","well_known_bundle":"https://pith.science/.well-known/pith/475ACCDMC2SD76KAJQNMO7DBKU/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:475ACCDMC2SD76KAJQNMO7DBKU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"50f1d710ebd8613ba50a47340f50d52520b03ed18cb230b3dfe2b1bd474cc824","cross_cats_sorted":["cs.AI","cs.CL","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-01-29T06:24:58Z","title_canon_sha256":"0f2af4e1672007d68b329da0e766f349e4b9cbf12dfdebf385456420fad376f8"},"schema_version":"1.0","source":{"id":"2501.17433","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2501.17433","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"arxiv_version","alias_value":"2501.17433v1","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2501.17433","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_12","alias_value":"475ACCDMC2SD","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_16","alias_value":"475ACCDMC2SD76KA","created_at":"2026-07-05T10:06:52Z"},{"alias_kind":"pith_short_8","alias_value":"475ACCDM","created_at":"2026-07-05T10:06:52Z"}],"graph_snapshots":[{"event_id":"sha256:cbdceff6fc63ee20367df57a6add637e66c65cc26013ccf3c9b6bb09ec9a3e1f","target":"graph","created_at":"2026-07-05T10:06:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2501.17433/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent research shows that Large Language Models (LLMs) are vulnerable to harmful fine-tuning attacks -- models lose their safety alignment ability after fine-tuning on a few harmful samples. For risk mitigation, a guardrail is typically used to filter out harmful samples before fine-tuning. By designing a new red-teaming method, we in this paper show that purely relying on the moderation guardrail for data filtration is not reliable. Our proposed attack method, dubbed Virus, easily bypasses the guardrail moderation by slightly modifying the harmful data. Experimental results show that the har","authors_text":"Fatih Ilhan, Ling Liu, Selim Furkan Tekin, Sihao Hu, Tiansheng Huang","cross_cats":["cs.AI","cs.CL","cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-01-29T06:24:58Z","title":"Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2501.17433","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6c8f776147d5b4d4a944b291b44a1381928a9d5ed9b590cca563b094e449515d","target":"record","created_at":"2026-07-05T10:06:52Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"50f1d710ebd8613ba50a47340f50d52520b03ed18cb230b3dfe2b1bd474cc824","cross_cats_sorted":["cs.AI","cs.CL","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-01-29T06:24:58Z","title_canon_sha256":"0f2af4e1672007d68b329da0e766f349e4b9cbf12dfdebf385456420fad376f8"},"schema_version":"1.0","source":{"id":"2501.17433","kind":"arxiv","version":1}},"canonical_sha256":"e7fa01086c16a43ff9404c1ac77c61552dd0f64d6f92af015815e58c28fb5faf","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e7fa01086c16a43ff9404c1ac77c61552dd0f64d6f92af015815e58c28fb5faf","first_computed_at":"2026-07-05T10:06:52.779625Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:06:52.779625Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"TtPH2wUyXCgcxpS99ZAxIBBuypN8PyOi/xCUgNLC0yS2owVViFs27T6ngSTYugzYSo01lPzR5hRfFMSB6t5YBA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:06:52.779991Z","signed_message":"canonical_sha256_bytes"},"source_id":"2501.17433","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6c8f776147d5b4d4a944b291b44a1381928a9d5ed9b590cca563b094e449515d","sha256:cbdceff6fc63ee20367df57a6add637e66c65cc26013ccf3c9b6bb09ec9a3e1f"],"state_sha256":"b0e4328c2cf48045560c09b7461dda263ffc5388037567e383d65f2fbd67d3ca"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lQEcdX1rypcYX53WDZm23AmpPHmQRyrujZXQt5vRRd4rpEPbLZw4RzTPmThKGoGpT4dbzJz14lwHhCQjijAcBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T15:46:25.850820Z","bundle_sha256":"b4eb22aa543ba6072a4f926832e3fc1e654cabf9d70a3de1de89a874f27d4dfa"}}