{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:54VLLDE6PRT6UCVFWYPUDRIZID","short_pith_number":"pith:54VLLDE6","canonical_record":{"source":{"id":"2307.16888","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-07-31T17:56:00Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"e9c6d62c5bd2488b0cec5ca2b1f6f08e4403b5353a707f370d2271d274b63d7f","abstract_canon_sha256":"ffbe5baeabedb58650518d01726ee50a8b6c803dab403093e864812970d343db"},"schema_version":"1.0"},"canonical_sha256":"ef2ab58c9e7c67ea0aa5b61f41c51940e5d64ab5315268a3e2044726a031ddb8","source":{"kind":"arxiv","id":"2307.16888","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.16888","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"arxiv_version","alias_value":"2307.16888v3","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.16888","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_12","alias_value":"54VLLDE6PRT6","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_16","alias_value":"54VLLDE6PRT6UCVF","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_8","alias_value":"54VLLDE6","created_at":"2026-07-05T08:03:43Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:54VLLDE6PRT6UCVFWYPUDRIZID","target":"record","payload":{"canonical_record":{"source":{"id":"2307.16888","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-07-31T17:56:00Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"e9c6d62c5bd2488b0cec5ca2b1f6f08e4403b5353a707f370d2271d274b63d7f","abstract_canon_sha256":"ffbe5baeabedb58650518d01726ee50a8b6c803dab403093e864812970d343db"},"schema_version":"1.0"},"canonical_sha256":"ef2ab58c9e7c67ea0aa5b61f41c51940e5d64ab5315268a3e2044726a031ddb8","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:03:43.075421Z","signature_b64":"rMsoSPf9xB0Z41ZtR2N8Tm9eAR3NxTBEuo8465UTkUaFsElCEvMYoNtQPHjsRrDqWECSyyTj/pWo70CFDP6aBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ef2ab58c9e7c67ea0aa5b61f41c51940e5d64ab5315268a3e2044726a031ddb8","last_reissued_at":"2026-07-05T08:03:43.074913Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:03:43.074913Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2307.16888","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:03:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"W4v62BWIYV4l5Kx19HEAVt/MC/6vOnjzqIqpJn1r2r9umpxfo6Uu65/o0BfFkZ0JY4Ns/ioyD3ktzzcmQf3jBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T06:30:47.216817Z"},"content_sha256":"0bf8813e970188ae9d7e0ddc104e4f181d6de4eaaeaeae278c85084073ea3930","schema_version":"1.0","event_id":"sha256:0bf8813e970188ae9d7e0ddc104e4f181d6de4eaaeaeae278c85084073ea3930"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:54VLLDE6PRT6UCVFWYPUDRIZID","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"cs.CL","authors_text":"Hai Wang, Hongxia Jin, Jun Yan, Lichang Chen, Shiyang Li, Vijay Srinivasan, Vikas Yadav, Xiang Ren, Zheng Tang","submitted_at":"2023-07-31T17:56:00Z","abstract_excerpt":"Instruction-tuned Large Language Models (LLMs) have become a ubiquitous platform for open-ended applications due to their ability to modulate responses based on human instructions. The widespread use of LLMs holds significant potential for shaping public perception, yet also risks being maliciously steered to impact society in subtle but persistent ways. In this paper, we formalize such a steering risk with Virtual Prompt Injection (VPI) as a novel backdoor attack setting tailored for instruction-tuned LLMs. In a VPI attack, the backdoored model is expected to respond as if an attacker-specifi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.16888","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2307.16888/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:03:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"dEkkr8gMOmqSIIobO8Ylw9ZSO4rcM0wmEZBLw06JXS69VgkfiAOZL/SpKjGRjddNC6WRGOl6YCoTSpYkJz6+CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T06:30:47.217488Z"},"content_sha256":"ed1ee6b39be5b3a0e7914b12a0c8fd834a0ed8dad75753e9ef5ae12010731cfb","schema_version":"1.0","event_id":"sha256:ed1ee6b39be5b3a0e7914b12a0c8fd834a0ed8dad75753e9ef5ae12010731cfb"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/54VLLDE6PRT6UCVFWYPUDRIZID/bundle.json","state_url":"https://pith.science/pith/54VLLDE6PRT6UCVFWYPUDRIZID/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/54VLLDE6PRT6UCVFWYPUDRIZID/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T06:30:47Z","links":{"resolver":"https://pith.science/pith/54VLLDE6PRT6UCVFWYPUDRIZID","bundle":"https://pith.science/pith/54VLLDE6PRT6UCVFWYPUDRIZID/bundle.json","state":"https://pith.science/pith/54VLLDE6PRT6UCVFWYPUDRIZID/state.json","well_known_bundle":"https://pith.science/.well-known/pith/54VLLDE6PRT6UCVFWYPUDRIZID/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:54VLLDE6PRT6UCVFWYPUDRIZID","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ffbe5baeabedb58650518d01726ee50a8b6c803dab403093e864812970d343db","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-07-31T17:56:00Z","title_canon_sha256":"e9c6d62c5bd2488b0cec5ca2b1f6f08e4403b5353a707f370d2271d274b63d7f"},"schema_version":"1.0","source":{"id":"2307.16888","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2307.16888","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"arxiv_version","alias_value":"2307.16888v3","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2307.16888","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_12","alias_value":"54VLLDE6PRT6","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_16","alias_value":"54VLLDE6PRT6UCVF","created_at":"2026-07-05T08:03:43Z"},{"alias_kind":"pith_short_8","alias_value":"54VLLDE6","created_at":"2026-07-05T08:03:43Z"}],"graph_snapshots":[{"event_id":"sha256:ed1ee6b39be5b3a0e7914b12a0c8fd834a0ed8dad75753e9ef5ae12010731cfb","target":"graph","created_at":"2026-07-05T08:03:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2307.16888/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Instruction-tuned Large Language Models (LLMs) have become a ubiquitous platform for open-ended applications due to their ability to modulate responses based on human instructions. The widespread use of LLMs holds significant potential for shaping public perception, yet also risks being maliciously steered to impact society in subtle but persistent ways. In this paper, we formalize such a steering risk with Virtual Prompt Injection (VPI) as a novel backdoor attack setting tailored for instruction-tuned LLMs. In a VPI attack, the backdoored model is expected to respond as if an attacker-specifi","authors_text":"Hai Wang, Hongxia Jin, Jun Yan, Lichang Chen, Shiyang Li, Vijay Srinivasan, Vikas Yadav, Xiang Ren, Zheng Tang","cross_cats":["cs.CR","cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-07-31T17:56:00Z","title":"Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2307.16888","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0bf8813e970188ae9d7e0ddc104e4f181d6de4eaaeaeae278c85084073ea3930","target":"record","created_at":"2026-07-05T08:03:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ffbe5baeabedb58650518d01726ee50a8b6c803dab403093e864812970d343db","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-07-31T17:56:00Z","title_canon_sha256":"e9c6d62c5bd2488b0cec5ca2b1f6f08e4403b5353a707f370d2271d274b63d7f"},"schema_version":"1.0","source":{"id":"2307.16888","kind":"arxiv","version":3}},"canonical_sha256":"ef2ab58c9e7c67ea0aa5b61f41c51940e5d64ab5315268a3e2044726a031ddb8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ef2ab58c9e7c67ea0aa5b61f41c51940e5d64ab5315268a3e2044726a031ddb8","first_computed_at":"2026-07-05T08:03:43.074913Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:03:43.074913Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"rMsoSPf9xB0Z41ZtR2N8Tm9eAR3NxTBEuo8465UTkUaFsElCEvMYoNtQPHjsRrDqWECSyyTj/pWo70CFDP6aBA==","signature_status":"signed_v1","signed_at":"2026-07-05T08:03:43.075421Z","signed_message":"canonical_sha256_bytes"},"source_id":"2307.16888","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0bf8813e970188ae9d7e0ddc104e4f181d6de4eaaeaeae278c85084073ea3930","sha256:ed1ee6b39be5b3a0e7914b12a0c8fd834a0ed8dad75753e9ef5ae12010731cfb"],"state_sha256":"f70b6d20cc1b9a15d53b5671472ea28214f05c7652f8c9a90f952c6c6a68f44f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6B5xa5xNG3GV8CCOP4akeQo/k2lLQ5aY2PSWfHDGC3AM6bAdPrmY396pQvqXAppZrOldk3BQWDYE/IwNbW8pAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T06:30:47.221662Z","bundle_sha256":"493ea5bfb4aa3ed6b03860d66742840b72d6bb34cc26455c5b79eb8080436094"}}