{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:AUJZNJW24QZYIX4QEG5JM6CPDQ","short_pith_number":"pith:AUJZNJW2","canonical_record":{"source":{"id":"2402.15911","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-24T21:27:13Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"3e37467e030ca7cc80f12318505742a015fe0edc40d9cb38317a0e11c415e8db","abstract_canon_sha256":"45a6e78470f785079f83d288eb7f743dbdff40bb7e8473bab2ab2d475a06caa8"},"schema_version":"1.0"},"canonical_sha256":"051396a6dae433845f9021ba96784f1c2ed4dbaec9f979f81b79e835e57b6137","source":{"kind":"arxiv","id":"2402.15911","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.15911","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"arxiv_version","alias_value":"2402.15911v1","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.15911","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_12","alias_value":"AUJZNJW24QZY","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_16","alias_value":"AUJZNJW24QZYIX4Q","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_8","alias_value":"AUJZNJW2","created_at":"2026-07-05T07:48:59Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:AUJZNJW24QZYIX4QEG5JM6CPDQ","target":"record","payload":{"canonical_record":{"source":{"id":"2402.15911","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-24T21:27:13Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"3e37467e030ca7cc80f12318505742a015fe0edc40d9cb38317a0e11c415e8db","abstract_canon_sha256":"45a6e78470f785079f83d288eb7f743dbdff40bb7e8473bab2ab2d475a06caa8"},"schema_version":"1.0"},"canonical_sha256":"051396a6dae433845f9021ba96784f1c2ed4dbaec9f979f81b79e835e57b6137","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:48:59.666919Z","signature_b64":"NR42pzk8XgLgRzym3q/mo0WyPUgFKuj5Jv6gIv8piAmdD81MdRpphhsPe7U+wJvMEmLpsax5D6STOTusu8C+DA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"051396a6dae433845f9021ba96784f1c2ed4dbaec9f979f81b79e835e57b6137","last_reissued_at":"2026-07-05T07:48:59.666494Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:48:59.666494Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2402.15911","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:48:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"E6c2rUrZqJG0vSVsHcJBpEXJFC5shaTaTzL1S09iGEadsDODnGTxhs/4De4KhBCSuO/W2mA/VDhZUP8XcEt4Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T09:44:37.756586Z"},"content_sha256":"cde9b60a8c9b00b9c1943aa4b4abeb1a426e3257ccd1614359e7b8eded10b0b7","schema_version":"1.0","event_id":"sha256:cde9b60a8c9b00b9c1943aa4b4abeb1a426e3257ccd1614359e7b8eded10b0b7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:AUJZNJW24QZYIX4QEG5JM6CPDQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CL"],"primary_cat":"cs.CR","authors_text":"Ashish Hooda, Atul Prakash, Jihye Choi, Kassem Fawaz, Neal Mangaokar, Shreyas Chandrashekaran, Somesh Jha","submitted_at":"2024-02-24T21:27:13Z","abstract_excerpt":"Large language models (LLMs) are typically aligned to be harmless to humans. Unfortunately, recent work has shown that such models are susceptible to automated jailbreak attacks that induce them to generate harmful content. More recent LLMs often incorporate an additional layer of defense, a Guard Model, which is a second LLM that is designed to check and moderate the output response of the primary LLM. Our key contribution is to show a novel attack strategy, PRP, that is successful against several open-source (e.g., Llama 2) and closed-source (e.g., GPT 3.5) implementations of Guard Models. P"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.15911","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2402.15911/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:48:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"TX3VW9Q86bL4kBRc5VDMpXpuJxVjvzORyclV/9iMzrdvkMnQ1v6aXXulA+l6nlrHsdSejlyaoBdoogR8/zGnCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T09:44:37.756958Z"},"content_sha256":"9e30a177a26e6943145cb2a2f09d69b4559572658720ee9ecd36f7f3307367a5","schema_version":"1.0","event_id":"sha256:9e30a177a26e6943145cb2a2f09d69b4559572658720ee9ecd36f7f3307367a5"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/bundle.json","state_url":"https://pith.science/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T09:44:37Z","links":{"resolver":"https://pith.science/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ","bundle":"https://pith.science/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/bundle.json","state":"https://pith.science/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/AUJZNJW24QZYIX4QEG5JM6CPDQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:AUJZNJW24QZYIX4QEG5JM6CPDQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"45a6e78470f785079f83d288eb7f743dbdff40bb7e8473bab2ab2d475a06caa8","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-24T21:27:13Z","title_canon_sha256":"3e37467e030ca7cc80f12318505742a015fe0edc40d9cb38317a0e11c415e8db"},"schema_version":"1.0","source":{"id":"2402.15911","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.15911","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"arxiv_version","alias_value":"2402.15911v1","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.15911","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_12","alias_value":"AUJZNJW24QZY","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_16","alias_value":"AUJZNJW24QZYIX4Q","created_at":"2026-07-05T07:48:59Z"},{"alias_kind":"pith_short_8","alias_value":"AUJZNJW2","created_at":"2026-07-05T07:48:59Z"}],"graph_snapshots":[{"event_id":"sha256:9e30a177a26e6943145cb2a2f09d69b4559572658720ee9ecd36f7f3307367a5","target":"graph","created_at":"2026-07-05T07:48:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2402.15911/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) are typically aligned to be harmless to humans. Unfortunately, recent work has shown that such models are susceptible to automated jailbreak attacks that induce them to generate harmful content. More recent LLMs often incorporate an additional layer of defense, a Guard Model, which is a second LLM that is designed to check and moderate the output response of the primary LLM. Our key contribution is to show a novel attack strategy, PRP, that is successful against several open-source (e.g., Llama 2) and closed-source (e.g., GPT 3.5) implementations of Guard Models. P","authors_text":"Ashish Hooda, Atul Prakash, Jihye Choi, Kassem Fawaz, Neal Mangaokar, Shreyas Chandrashekaran, Somesh Jha","cross_cats":["cs.CL"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-24T21:27:13Z","title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.15911","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cde9b60a8c9b00b9c1943aa4b4abeb1a426e3257ccd1614359e7b8eded10b0b7","target":"record","created_at":"2026-07-05T07:48:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"45a6e78470f785079f83d288eb7f743dbdff40bb7e8473bab2ab2d475a06caa8","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-24T21:27:13Z","title_canon_sha256":"3e37467e030ca7cc80f12318505742a015fe0edc40d9cb38317a0e11c415e8db"},"schema_version":"1.0","source":{"id":"2402.15911","kind":"arxiv","version":1}},"canonical_sha256":"051396a6dae433845f9021ba96784f1c2ed4dbaec9f979f81b79e835e57b6137","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"051396a6dae433845f9021ba96784f1c2ed4dbaec9f979f81b79e835e57b6137","first_computed_at":"2026-07-05T07:48:59.666494Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:48:59.666494Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"NR42pzk8XgLgRzym3q/mo0WyPUgFKuj5Jv6gIv8piAmdD81MdRpphhsPe7U+wJvMEmLpsax5D6STOTusu8C+DA==","signature_status":"signed_v1","signed_at":"2026-07-05T07:48:59.666919Z","signed_message":"canonical_sha256_bytes"},"source_id":"2402.15911","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cde9b60a8c9b00b9c1943aa4b4abeb1a426e3257ccd1614359e7b8eded10b0b7","sha256:9e30a177a26e6943145cb2a2f09d69b4559572658720ee9ecd36f7f3307367a5"],"state_sha256":"ad86ca7f5e508437264aefa823d5381153238f4c31e126bf3c494636c5e5a88f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"g0/jjdsdi+OAuD2st2DDljcCcczsxF101wD0vDWWKaWnIGeUuEyiomBW5FWIbUQgiZDRVL4vXOWdnt0eARHWAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T09:44:37.758947Z","bundle_sha256":"89154f6c43ffda524419bc201348d3c29338c84808339b5bc2818049469bec60"}}