{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:BTZ3M4DCSM4J2R3VYSQ4BRPJ5E","short_pith_number":"pith:BTZ3M4DC","canonical_record":{"source":{"id":"2502.13172","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-17T19:55:53Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0adf05a09046bd43dceb89cdfe86364167249585bc85b5f4ef2e83eeb4e6a029","abstract_canon_sha256":"073c602eed459c057c2791172b447fb4ce4a6554c178cdfbfeec24c984012375"},"schema_version":"1.0"},"canonical_sha256":"0cf3b6706293389d4775c4a1c0c5e9e935df05f19aeaa05415cfd6f647a1001a","source":{"kind":"arxiv","id":"2502.13172","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.13172","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"arxiv_version","alias_value":"2502.13172v2","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.13172","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_12","alias_value":"BTZ3M4DCSM4J","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_16","alias_value":"BTZ3M4DCSM4J2R3V","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_8","alias_value":"BTZ3M4DC","created_at":"2026-07-05T11:14:54Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:BTZ3M4DCSM4J2R3VYSQ4BRPJ5E","target":"record","payload":{"canonical_record":{"source":{"id":"2502.13172","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-17T19:55:53Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0adf05a09046bd43dceb89cdfe86364167249585bc85b5f4ef2e83eeb4e6a029","abstract_canon_sha256":"073c602eed459c057c2791172b447fb4ce4a6554c178cdfbfeec24c984012375"},"schema_version":"1.0"},"canonical_sha256":"0cf3b6706293389d4775c4a1c0c5e9e935df05f19aeaa05415cfd6f647a1001a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:14:54.004602Z","signature_b64":"bl1aV3hklrbh8hVhUYCpVxU2dviTFNRRdVG7pIGaiMhLJ0kXJlp0ZHDAfV4VOrbSXZ3bzXZLViotcgjoxZzYAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0cf3b6706293389d4775c4a1c0c5e9e935df05f19aeaa05415cfd6f647a1001a","last_reissued_at":"2026-07-05T11:14:54.004022Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:14:54.004022Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.13172","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:14:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2AN1DSRylkHJcyWGltMKzt4CqD17GSoGe0A40Sw9x4qrF69BrOrcTm7034C2m2Ynozt2pyOFdGIQV6jCq0IBAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T16:37:37.206898Z"},"content_sha256":"fdbf629bcbe2911e3411b356b6da7e083784385dffcfa65c3a3a2266841c6fcb","schema_version":"1.0","event_id":"sha256:fdbf629bcbe2911e3411b356b6da7e083784385dffcfa65c3a3a2266841c6fcb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:BTZ3M4DCSM4J2R3VYSQ4BRPJ5E","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Unveiling Privacy Risks in LLM Agent Memory","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Bo Wang, Jiliang Tang, Pengfei He, Shenglai Zeng, Weiyi He, Yue Xing, Zhen Xiang","submitted_at":"2025-02-17T19:55:53Z","abstract_excerpt":"Large Language Model (LLM) agents have become increasingly prevalent across various real-world applications. They enhance decision-making by storing private user-agent interactions in the memory module for demonstrations, introducing new privacy risks for LLM agents. In this work, we systematically investigate the vulnerability of LLM agents to our proposed Memory EXTRaction Attack (MEXTRA) under a black-box setting. To extract private information from memory, we propose an effective attacking prompt design and an automated prompt generation method based on different levels of knowledge about "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.13172","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.13172/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:14:54Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UzLbPdkI18iABvH2tMHsZqqyODKyYaiOTs1ZFC+YSbl7J9XPdopFdYULoHNbORwNk68Q3ak0W20UCZAr8z9rBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T16:37:37.207444Z"},"content_sha256":"a16c739b85f42ee5d7c43de3ef3dac0ec668f045fdb3b3be3834a8ad2be175c7","schema_version":"1.0","event_id":"sha256:a16c739b85f42ee5d7c43de3ef3dac0ec668f045fdb3b3be3834a8ad2be175c7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/bundle.json","state_url":"https://pith.science/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T16:37:37Z","links":{"resolver":"https://pith.science/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E","bundle":"https://pith.science/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/bundle.json","state":"https://pith.science/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BTZ3M4DCSM4J2R3VYSQ4BRPJ5E/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:BTZ3M4DCSM4J2R3VYSQ4BRPJ5E","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"073c602eed459c057c2791172b447fb4ce4a6554c178cdfbfeec24c984012375","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-17T19:55:53Z","title_canon_sha256":"0adf05a09046bd43dceb89cdfe86364167249585bc85b5f4ef2e83eeb4e6a029"},"schema_version":"1.0","source":{"id":"2502.13172","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.13172","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"arxiv_version","alias_value":"2502.13172v2","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.13172","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_12","alias_value":"BTZ3M4DCSM4J","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_16","alias_value":"BTZ3M4DCSM4J2R3V","created_at":"2026-07-05T11:14:54Z"},{"alias_kind":"pith_short_8","alias_value":"BTZ3M4DC","created_at":"2026-07-05T11:14:54Z"}],"graph_snapshots":[{"event_id":"sha256:a16c739b85f42ee5d7c43de3ef3dac0ec668f045fdb3b3be3834a8ad2be175c7","target":"graph","created_at":"2026-07-05T11:14:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.13172/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Model (LLM) agents have become increasingly prevalent across various real-world applications. They enhance decision-making by storing private user-agent interactions in the memory module for demonstrations, introducing new privacy risks for LLM agents. In this work, we systematically investigate the vulnerability of LLM agents to our proposed Memory EXTRaction Attack (MEXTRA) under a black-box setting. To extract private information from memory, we propose an effective attacking prompt design and an automated prompt generation method based on different levels of knowledge about ","authors_text":"Bo Wang, Jiliang Tang, Pengfei He, Shenglai Zeng, Weiyi He, Yue Xing, Zhen Xiang","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-17T19:55:53Z","title":"Unveiling Privacy Risks in LLM Agent Memory"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.13172","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fdbf629bcbe2911e3411b356b6da7e083784385dffcfa65c3a3a2266841c6fcb","target":"record","created_at":"2026-07-05T11:14:54Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"073c602eed459c057c2791172b447fb4ce4a6554c178cdfbfeec24c984012375","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-02-17T19:55:53Z","title_canon_sha256":"0adf05a09046bd43dceb89cdfe86364167249585bc85b5f4ef2e83eeb4e6a029"},"schema_version":"1.0","source":{"id":"2502.13172","kind":"arxiv","version":2}},"canonical_sha256":"0cf3b6706293389d4775c4a1c0c5e9e935df05f19aeaa05415cfd6f647a1001a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0cf3b6706293389d4775c4a1c0c5e9e935df05f19aeaa05415cfd6f647a1001a","first_computed_at":"2026-07-05T11:14:54.004022Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:14:54.004022Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"bl1aV3hklrbh8hVhUYCpVxU2dviTFNRRdVG7pIGaiMhLJ0kXJlp0ZHDAfV4VOrbSXZ3bzXZLViotcgjoxZzYAg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:14:54.004602Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.13172","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fdbf629bcbe2911e3411b356b6da7e083784385dffcfa65c3a3a2266841c6fcb","sha256:a16c739b85f42ee5d7c43de3ef3dac0ec668f045fdb3b3be3834a8ad2be175c7"],"state_sha256":"47a4347c96a3254501bb9edc4aa46967246cb7239ed83372bcaa914509528866"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"d6YD/PfX1dgNMK52evZ5z1c53xWqjeH+PCa3WLoCJvqvjxTBP/SB+y+rNNRDm6404NBwFEjwFnGJzCoWVs2ODg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T16:37:37.210997Z","bundle_sha256":"35040125863b53041c76f9afd8bcb44999b5c0bb0a7e15c1aa16a72803b723f4"}}