{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:BOCFNYWMH35GWYP2R5FJO2QZ6T","short_pith_number":"pith:BOCFNYWM","canonical_record":{"source":{"id":"2507.22304","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T00:34:20Z","cross_cats_sorted":[],"title_canon_sha256":"8296d4e99fa52c92508b9f20540bf5a20362d4b07bb0a9cfd2394365e68fed67","abstract_canon_sha256":"d5a2832e8f326e671906db1b10f20c7a0542bfa54fb1846cd68acf80f9b612fb"},"schema_version":"1.0"},"canonical_sha256":"0b8456e2cc3efa6b61fa8f4a976a19f4d4cdad20b3df882c04445e4c7c50c0c4","source":{"kind":"arxiv","id":"2507.22304","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.22304","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"arxiv_version","alias_value":"2507.22304v1","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.22304","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_12","alias_value":"BOCFNYWMH35G","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_16","alias_value":"BOCFNYWMH35GWYP2","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_8","alias_value":"BOCFNYWM","created_at":"2026-07-05T11:45:19Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:BOCFNYWMH35GWYP2R5FJO2QZ6T","target":"record","payload":{"canonical_record":{"source":{"id":"2507.22304","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T00:34:20Z","cross_cats_sorted":[],"title_canon_sha256":"8296d4e99fa52c92508b9f20540bf5a20362d4b07bb0a9cfd2394365e68fed67","abstract_canon_sha256":"d5a2832e8f326e671906db1b10f20c7a0542bfa54fb1846cd68acf80f9b612fb"},"schema_version":"1.0"},"canonical_sha256":"0b8456e2cc3efa6b61fa8f4a976a19f4d4cdad20b3df882c04445e4c7c50c0c4","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:45:19.957057Z","signature_b64":"s82tcPs+T+s7Rih+FbwBRdEK/Sa+OT5vOLEIm3LGhLEipofvZ/VuAAotc2j3hw8mcw9RRnU9PoNMQPARyUT6Dw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0b8456e2cc3efa6b61fa8f4a976a19f4d4cdad20b3df882c04445e4c7c50c0c4","last_reissued_at":"2026-07-05T11:45:19.956666Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:45:19.956666Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.22304","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:45:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+PvZtxEiqlv2aXWiP6iAWh/KHgS2bGzFUgwkSNyJ/gctnNVUmUlJWfSz0PWogsqJ/btCgjBL1s6jnRpiUbUHBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T03:33:22.651346Z"},"content_sha256":"c79d36bc559b46184fb627f91f8fc393c3a1325205585ed07f31de4b0cf65266","schema_version":"1.0","event_id":"sha256:c79d36bc559b46184fb627f91f8fc393c3a1325205585ed07f31de4b0cf65266"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:BOCFNYWMH35GWYP2R5FJO2QZ6T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chetan Pathade","submitted_at":"2025-07-30T00:34:20Z","abstract_excerpt":"Vision-language models (VLMs) have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly embedded within images using advanced steganographic techniques. Our approach demonstrates that current VLM architectures can inadvertently extract and execute hidden prompts during normal image processing, leading to covert behavioral manipulation. We develop a multi-domain embedding framework combining"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.22304","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.22304/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:45:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/+YeWCWahneje6NGD7WmeYg+hCv97kWl1cW2vAZpaiSL8Ykr4ViYlmE1kF3pppZI0i+lI3WWsKRQkrcDZ5ADCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T03:33:22.651959Z"},"content_sha256":"2466953b5a5c52f330ceaf760e7e82b351ef3db69f8fd736e7e030ac96dac477","schema_version":"1.0","event_id":"sha256:2466953b5a5c52f330ceaf760e7e82b351ef3db69f8fd736e7e030ac96dac477"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/bundle.json","state_url":"https://pith.science/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-17T03:33:22Z","links":{"resolver":"https://pith.science/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T","bundle":"https://pith.science/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/bundle.json","state":"https://pith.science/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BOCFNYWMH35GWYP2R5FJO2QZ6T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:BOCFNYWMH35GWYP2R5FJO2QZ6T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d5a2832e8f326e671906db1b10f20c7a0542bfa54fb1846cd68acf80f9b612fb","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T00:34:20Z","title_canon_sha256":"8296d4e99fa52c92508b9f20540bf5a20362d4b07bb0a9cfd2394365e68fed67"},"schema_version":"1.0","source":{"id":"2507.22304","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.22304","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"arxiv_version","alias_value":"2507.22304v1","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.22304","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_12","alias_value":"BOCFNYWMH35G","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_16","alias_value":"BOCFNYWMH35GWYP2","created_at":"2026-07-05T11:45:19Z"},{"alias_kind":"pith_short_8","alias_value":"BOCFNYWM","created_at":"2026-07-05T11:45:19Z"}],"graph_snapshots":[{"event_id":"sha256:2466953b5a5c52f330ceaf760e7e82b351ef3db69f8fd736e7e030ac96dac477","target":"graph","created_at":"2026-07-05T11:45:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.22304/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Vision-language models (VLMs) have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly embedded within images using advanced steganographic techniques. Our approach demonstrates that current VLM architectures can inadvertently extract and execute hidden prompts during normal image processing, leading to covert behavioral manipulation. We develop a multi-domain embedding framework combining","authors_text":"Chetan Pathade","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T00:34:20Z","title":"Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.22304","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c79d36bc559b46184fb627f91f8fc393c3a1325205585ed07f31de4b0cf65266","target":"record","created_at":"2026-07-05T11:45:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d5a2832e8f326e671906db1b10f20c7a0542bfa54fb1846cd68acf80f9b612fb","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-30T00:34:20Z","title_canon_sha256":"8296d4e99fa52c92508b9f20540bf5a20362d4b07bb0a9cfd2394365e68fed67"},"schema_version":"1.0","source":{"id":"2507.22304","kind":"arxiv","version":1}},"canonical_sha256":"0b8456e2cc3efa6b61fa8f4a976a19f4d4cdad20b3df882c04445e4c7c50c0c4","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0b8456e2cc3efa6b61fa8f4a976a19f4d4cdad20b3df882c04445e4c7c50c0c4","first_computed_at":"2026-07-05T11:45:19.956666Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:45:19.956666Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"s82tcPs+T+s7Rih+FbwBRdEK/Sa+OT5vOLEIm3LGhLEipofvZ/VuAAotc2j3hw8mcw9RRnU9PoNMQPARyUT6Dw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:45:19.957057Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.22304","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c79d36bc559b46184fb627f91f8fc393c3a1325205585ed07f31de4b0cf65266","sha256:2466953b5a5c52f330ceaf760e7e82b351ef3db69f8fd736e7e030ac96dac477"],"state_sha256":"ca77113008de2af0530f6a851b2a0827f5d2d252c1fa9b1396e7be14606750ba"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+xUos44nQmn8i99fFbaUKNBAG29X1RuVInVPn+m1FfRKPbAQPZcku3lS/y+7nRvaLHP4Mv6s1sweZGjIxa6TAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-17T03:33:22.656776Z","bundle_sha256":"db546b0f4c6543c39b0b15bc697df81cf433b0ad870623a2f94a36a4c44e6321"}}