{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:AAB7O53BDHFBQXS4UHPIXYH2VC","short_pith_number":"pith:AAB7O53B","canonical_record":{"source":{"id":"2606.12747","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-06-10T23:26:39Z","cross_cats_sorted":[],"title_canon_sha256":"36f5d61551fa800b4771fe6406dbb0d877c3acb2f4c6677213f180795b058a95","abstract_canon_sha256":"f563493a875ea54477d501796615eb19d303f27d7c8b15c9e9e77afe90d708fd"},"schema_version":"1.0"},"canonical_sha256":"0003f7776119ca185e5ca1de8be0faa8a6a793d236bd26cc9cf46acbd2bc0d77","source":{"kind":"arxiv","id":"2606.12747","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.12747","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"arxiv_version","alias_value":"2606.12747v1","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.12747","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_12","alias_value":"AAB7O53BDHFB","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_16","alias_value":"AAB7O53BDHFBQXS4","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_8","alias_value":"AAB7O53B","created_at":"2026-06-12T01:08:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:AAB7O53BDHFBQXS4UHPIXYH2VC","target":"record","payload":{"canonical_record":{"source":{"id":"2606.12747","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-06-10T23:26:39Z","cross_cats_sorted":[],"title_canon_sha256":"36f5d61551fa800b4771fe6406dbb0d877c3acb2f4c6677213f180795b058a95","abstract_canon_sha256":"f563493a875ea54477d501796615eb19d303f27d7c8b15c9e9e77afe90d708fd"},"schema_version":"1.0"},"canonical_sha256":"0003f7776119ca185e5ca1de8be0faa8a6a793d236bd26cc9cf46acbd2bc0d77","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-12T01:08:49.080624Z","signature_b64":"wsO7qg06kgosC8xzeJUE621DQFlLwAGzR9ejMlz4p1jn+p620s3aZfvPXmafr14Vg5SUyFAZf4FIHQVFMREPDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0003f7776119ca185e5ca1de8be0faa8a6a793d236bd26cc9cf46acbd2bc0d77","last_reissued_at":"2026-06-12T01:08:49.079724Z","signature_status":"signed_v1","first_computed_at":"2026-06-12T01:08:49.079724Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.12747","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-12T01:08:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KkMafIWeZTMeRbZDbcVtxySzyM8Jp97IiLQfdFeFt09kXoGWoX+Xm+x3KdwSJLd/1wHIWQn0VRE+bJ8b1b87Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T02:44:50.789210Z"},"content_sha256":"fc3d510805a43298dfbaf7ef3ac6cdceb3d28165eb52a1440deaaa99500ebd67","schema_version":"1.0","event_id":"sha256:fc3d510805a43298dfbaf7ef3ac6cdceb3d28165eb52a1440deaaa99500ebd67"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:AAB7O53BDHFBQXS4UHPIXYH2VC","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Prefill Awareness in Large Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.AI","authors_text":"Alexandra Souly, Andy Wang, David Demitri Africa, Jordan Taylor, Parv Mahajan, Robert Kirk","submitted_at":"2026-06-10T23:26:39Z","abstract_excerpt":"Safety-relevant studies of language models, including alignment and jailbreaking evaluations and AI control protocols, often rely on prefilling model outputs. If AI models can recognize and act on the fact their prior assistant messages have been inserted or edited, the effectiveness and validity of these methods could be compromised. We investigate whether frontier language models can distinguish between tampered and untampered assistant-side context, a capability we call prefill awareness. To do so, we construct a binary preference benchmark across three prefill mechanisms, filtering for cas"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.12747","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.12747/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-12T01:08:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tdQ1N+f3Q9rSaHA64UFm+LjKQs6FchtS+R95wmDy5Gnc9OIPmd2nc3//N0/K1Ync9fJxjF3qlhC8uONwNKenCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-28T02:44:50.789594Z"},"content_sha256":"c479e2a5f942a24ccc04e8fedc3acbb7dea776f415fd1782116eb5655452634a","schema_version":"1.0","event_id":"sha256:c479e2a5f942a24ccc04e8fedc3acbb7dea776f415fd1782116eb5655452634a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/bundle.json","state_url":"https://pith.science/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-28T02:44:50Z","links":{"resolver":"https://pith.science/pith/AAB7O53BDHFBQXS4UHPIXYH2VC","bundle":"https://pith.science/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/bundle.json","state":"https://pith.science/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/state.json","well_known_bundle":"https://pith.science/.well-known/pith/AAB7O53BDHFBQXS4UHPIXYH2VC/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:AAB7O53BDHFBQXS4UHPIXYH2VC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f563493a875ea54477d501796615eb19d303f27d7c8b15c9e9e77afe90d708fd","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-06-10T23:26:39Z","title_canon_sha256":"36f5d61551fa800b4771fe6406dbb0d877c3acb2f4c6677213f180795b058a95"},"schema_version":"1.0","source":{"id":"2606.12747","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.12747","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"arxiv_version","alias_value":"2606.12747v1","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.12747","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_12","alias_value":"AAB7O53BDHFB","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_16","alias_value":"AAB7O53BDHFBQXS4","created_at":"2026-06-12T01:08:49Z"},{"alias_kind":"pith_short_8","alias_value":"AAB7O53B","created_at":"2026-06-12T01:08:49Z"}],"graph_snapshots":[{"event_id":"sha256:c479e2a5f942a24ccc04e8fedc3acbb7dea776f415fd1782116eb5655452634a","target":"graph","created_at":"2026-06-12T01:08:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.12747/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Safety-relevant studies of language models, including alignment and jailbreaking evaluations and AI control protocols, often rely on prefilling model outputs. If AI models can recognize and act on the fact their prior assistant messages have been inserted or edited, the effectiveness and validity of these methods could be compromised. We investigate whether frontier language models can distinguish between tampered and untampered assistant-side context, a capability we call prefill awareness. To do so, we construct a binary preference benchmark across three prefill mechanisms, filtering for cas","authors_text":"Alexandra Souly, Andy Wang, David Demitri Africa, Jordan Taylor, Parv Mahajan, Robert Kirk","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-06-10T23:26:39Z","title":"Prefill Awareness in Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.12747","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fc3d510805a43298dfbaf7ef3ac6cdceb3d28165eb52a1440deaaa99500ebd67","target":"record","created_at":"2026-06-12T01:08:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f563493a875ea54477d501796615eb19d303f27d7c8b15c9e9e77afe90d708fd","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.AI","submitted_at":"2026-06-10T23:26:39Z","title_canon_sha256":"36f5d61551fa800b4771fe6406dbb0d877c3acb2f4c6677213f180795b058a95"},"schema_version":"1.0","source":{"id":"2606.12747","kind":"arxiv","version":1}},"canonical_sha256":"0003f7776119ca185e5ca1de8be0faa8a6a793d236bd26cc9cf46acbd2bc0d77","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0003f7776119ca185e5ca1de8be0faa8a6a793d236bd26cc9cf46acbd2bc0d77","first_computed_at":"2026-06-12T01:08:49.079724Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-12T01:08:49.079724Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"wsO7qg06kgosC8xzeJUE621DQFlLwAGzR9ejMlz4p1jn+p620s3aZfvPXmafr14Vg5SUyFAZf4FIHQVFMREPDw==","signature_status":"signed_v1","signed_at":"2026-06-12T01:08:49.080624Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.12747","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fc3d510805a43298dfbaf7ef3ac6cdceb3d28165eb52a1440deaaa99500ebd67","sha256:c479e2a5f942a24ccc04e8fedc3acbb7dea776f415fd1782116eb5655452634a"],"state_sha256":"39e05e05198c1e5a1981b354a5e0a6aa7c6987e2bda80fbbc7cca5c7e2384a17"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YRPBfCe353hdrMQ8jqWRf/2WBique9q7PpRmhGShwVzdlhhqraacf6ZQN9xapIC6dePbvCCxOUMz7Vrd0Na1CA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-28T02:44:50.791515Z","bundle_sha256":"2fa507b5b04e6b371fbb2584c70caf371e3ddf2a83fa9cb6a72920798ba74804"}}