{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:ASTQJPYWRNP2OR2BNKI4UANPDV","short_pith_number":"pith:ASTQJPYW","canonical_record":{"source":{"id":"2409.00137","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T17:30:05Z","cross_cats_sorted":["cs.AI","cs.CL"],"title_canon_sha256":"a9dca89e72c8c5bac018c0d29a042fae790c301d1d83759720c5c14bc3a05822","abstract_canon_sha256":"ebd63ab79cd48927365794ddc44cbdf6c66ac541ff480db96d5a857194b1c38f"},"schema_version":"1.0"},"canonical_sha256":"04a704bf168b5fa747416a91ca01af1d7580822390b255acdc8f710cb35d8125","source":{"kind":"arxiv","id":"2409.00137","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.00137","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"arxiv_version","alias_value":"2409.00137v1","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.00137","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_12","alias_value":"ASTQJPYWRNP2","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_16","alias_value":"ASTQJPYWRNP2OR2B","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_8","alias_value":"ASTQJPYW","created_at":"2026-07-05T09:01:41Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:ASTQJPYWRNP2OR2BNKI4UANPDV","target":"record","payload":{"canonical_record":{"source":{"id":"2409.00137","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T17:30:05Z","cross_cats_sorted":["cs.AI","cs.CL"],"title_canon_sha256":"a9dca89e72c8c5bac018c0d29a042fae790c301d1d83759720c5c14bc3a05822","abstract_canon_sha256":"ebd63ab79cd48927365794ddc44cbdf6c66ac541ff480db96d5a857194b1c38f"},"schema_version":"1.0"},"canonical_sha256":"04a704bf168b5fa747416a91ca01af1d7580822390b255acdc8f710cb35d8125","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:01:41.473024Z","signature_b64":"wvp84u/rR9EXv7MJTFTwTLLhzAlMjzz6Rtj6hnM2aGAobMZWzl7XlZ0wmWyYBRPM9nxZrdM0dI+nUXms/lejCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"04a704bf168b5fa747416a91ca01af1d7580822390b255acdc8f710cb35d8125","last_reissued_at":"2026-07-05T09:01:41.472566Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:01:41.472566Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.00137","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:01:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tw43fW0Gywj/rwYpoaG2NIpX547gW+IlcshB8CwDCvq0kkgyv8bWsht2aZbfCmVYtVgcOZtHIEHyrA4QJFSHBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T23:11:13.299136Z"},"content_sha256":"3b17488ea82a54f2d9e82a030c89d8197b09a1a4befd326f0836de1310d3d93c","schema_version":"1.0","event_id":"sha256:3b17488ea82a54f2d9e82a030c89d8197b09a1a4befd326f0836de1310d3d93c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:ASTQJPYWRNP2OR2BNKI4UANPDV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.CL"],"primary_cat":"cs.CR","authors_text":"Ethan Kosak-Hine, George Ingebretsen, Jason Zhang, Julius Broomfield, Kellin Pelrine, Reihaneh Iranmanesh, Reihaneh Rabbany, Sara Pieri, Tom Gibbs","submitted_at":"2024-08-29T17:30:05Z","abstract_excerpt":"Large language models (LLMs) are improving at an exceptional rate. However, these models are still susceptible to jailbreak attacks, which are becoming increasingly dangerous as models become increasingly powerful. In this work, we introduce a dataset of jailbreaks where each example can be input in both a single or a multi-turn format. We show that while equivalent in content, they are not equivalent in jailbreak success: defending against one structure does not guarantee defense against the other. Similarly, LLM-based filter guardrails also perform differently depending on not just the input"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.00137","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.00137/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:01:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SI0gzzt74d86eMFJ8FI3/SRLMiq5VRmV8I+M2Y2zdwDLlWNshfJ/1rib35Q9n1YMnxewLJ7Mn+PaXEmRFAhbCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T23:11:13.300171Z"},"content_sha256":"c7b3f345d212907b8cb1ca6c32bd2694db308a7705a7c4fef317b4bb135b282d","schema_version":"1.0","event_id":"sha256:c7b3f345d212907b8cb1ca6c32bd2694db308a7705a7c4fef317b4bb135b282d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/bundle.json","state_url":"https://pith.science/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-15T23:11:13Z","links":{"resolver":"https://pith.science/pith/ASTQJPYWRNP2OR2BNKI4UANPDV","bundle":"https://pith.science/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/bundle.json","state":"https://pith.science/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ASTQJPYWRNP2OR2BNKI4UANPDV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:ASTQJPYWRNP2OR2BNKI4UANPDV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ebd63ab79cd48927365794ddc44cbdf6c66ac541ff480db96d5a857194b1c38f","cross_cats_sorted":["cs.AI","cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T17:30:05Z","title_canon_sha256":"a9dca89e72c8c5bac018c0d29a042fae790c301d1d83759720c5c14bc3a05822"},"schema_version":"1.0","source":{"id":"2409.00137","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.00137","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"arxiv_version","alias_value":"2409.00137v1","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.00137","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_12","alias_value":"ASTQJPYWRNP2","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_16","alias_value":"ASTQJPYWRNP2OR2B","created_at":"2026-07-05T09:01:41Z"},{"alias_kind":"pith_short_8","alias_value":"ASTQJPYW","created_at":"2026-07-05T09:01:41Z"}],"graph_snapshots":[{"event_id":"sha256:c7b3f345d212907b8cb1ca6c32bd2694db308a7705a7c4fef317b4bb135b282d","target":"graph","created_at":"2026-07-05T09:01:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.00137/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) are improving at an exceptional rate. However, these models are still susceptible to jailbreak attacks, which are becoming increasingly dangerous as models become increasingly powerful. In this work, we introduce a dataset of jailbreaks where each example can be input in both a single or a multi-turn format. We show that while equivalent in content, they are not equivalent in jailbreak success: defending against one structure does not guarantee defense against the other. Similarly, LLM-based filter guardrails also perform differently depending on not just the input","authors_text":"Ethan Kosak-Hine, George Ingebretsen, Jason Zhang, Julius Broomfield, Kellin Pelrine, Reihaneh Iranmanesh, Reihaneh Rabbany, Sara Pieri, Tom Gibbs","cross_cats":["cs.AI","cs.CL"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T17:30:05Z","title":"Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.00137","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3b17488ea82a54f2d9e82a030c89d8197b09a1a4befd326f0836de1310d3d93c","target":"record","created_at":"2026-07-05T09:01:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ebd63ab79cd48927365794ddc44cbdf6c66ac541ff480db96d5a857194b1c38f","cross_cats_sorted":["cs.AI","cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-08-29T17:30:05Z","title_canon_sha256":"a9dca89e72c8c5bac018c0d29a042fae790c301d1d83759720c5c14bc3a05822"},"schema_version":"1.0","source":{"id":"2409.00137","kind":"arxiv","version":1}},"canonical_sha256":"04a704bf168b5fa747416a91ca01af1d7580822390b255acdc8f710cb35d8125","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"04a704bf168b5fa747416a91ca01af1d7580822390b255acdc8f710cb35d8125","first_computed_at":"2026-07-05T09:01:41.472566Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:01:41.472566Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"wvp84u/rR9EXv7MJTFTwTLLhzAlMjzz6Rtj6hnM2aGAobMZWzl7XlZ0wmWyYBRPM9nxZrdM0dI+nUXms/lejCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T09:01:41.473024Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.00137","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3b17488ea82a54f2d9e82a030c89d8197b09a1a4befd326f0836de1310d3d93c","sha256:c7b3f345d212907b8cb1ca6c32bd2694db308a7705a7c4fef317b4bb135b282d"],"state_sha256":"11270b93616e50bbc62aae8a0d2ee24b4c46d20227f59766250f791aa6790e9a"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0gUZrRNa6flVZQ73exezFvy9CI3C3WeOGFYnK3OqnSTCQkQ45Ohht8qeSiR7Ryqul8cgtlCd4AJPk7MPqFquAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-15T23:11:13.305954Z","bundle_sha256":"4fec5a33c853744454525f94349a3ae746793a87bdfbc09f746f82adfa32b9b2"}}