{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:C7HBOUC5JJKCSNTECVL2PU5OQ7","short_pith_number":"pith:C7HBOUC5","canonical_record":{"source":{"id":"2509.09112","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T02:50:07Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"e12466ea74fedfa8426b633d3b9aeb74d4eb0a24d3fc5b1eab6b5fa1e6c28cd2","abstract_canon_sha256":"a7d0eb7332ddea310663fb559f9483201671128e7f0078b865eb97c32f10f063"},"schema_version":"1.0"},"canonical_sha256":"17ce17505d4a542936641557a7d3ae87ebdb99c73a7ff5cd65dca46fff51a16c","source":{"kind":"arxiv","id":"2509.09112","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.09112","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"arxiv_version","alias_value":"2509.09112v2","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.09112","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_12","alias_value":"C7HBOUC5JJKC","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_16","alias_value":"C7HBOUC5JJKCSNTE","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_8","alias_value":"C7HBOUC5","created_at":"2026-07-05T12:11:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:C7HBOUC5JJKCSNTECVL2PU5OQ7","target":"record","payload":{"canonical_record":{"source":{"id":"2509.09112","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T02:50:07Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"e12466ea74fedfa8426b633d3b9aeb74d4eb0a24d3fc5b1eab6b5fa1e6c28cd2","abstract_canon_sha256":"a7d0eb7332ddea310663fb559f9483201671128e7f0078b865eb97c32f10f063"},"schema_version":"1.0"},"canonical_sha256":"17ce17505d4a542936641557a7d3ae87ebdb99c73a7ff5cd65dca46fff51a16c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:11:20.851256Z","signature_b64":"5zhJMv8L8iYutOcanQ3r4j5uNw6slfr7VWgTUvld3MqpfNqNyO0Pd4VdzIxr41kjJ/Vdhcjv1KPbKh/U9zd7Ag==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"17ce17505d4a542936641557a7d3ae87ebdb99c73a7ff5cd65dca46fff51a16c","last_reissued_at":"2026-07-05T12:11:20.850734Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:11:20.850734Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2509.09112","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:11:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iXfdkIP3KnYRGr1CsTAZe8V8bCV/rXQp+Vd0/YH6luat1tUhPCkiQoRfXLZ+zS1RTm9YEIQzauwh+5MnXFj1Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T17:13:37.874381Z"},"content_sha256":"3ebf99e40c50208c5e30b4ffc6d2677a2a07802098cf2d6cba64d966022a0d62","schema_version":"1.0","event_id":"sha256:3ebf99e40c50208c5e30b4ffc6d2677a2a07802098cf2d6cba64d966022a0d62"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:C7HBOUC5JJKCSNTECVL2PU5OQ7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Character-Level Perturbations Disrupt LLM Watermarks","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Asif Qumer Gill, Bo Liu, He Zhang, Leo Yu Zhang, Shirui Pan, Xiaomei Zhang, Yanjun Zhang, Zhaoxi Zhang","submitted_at":"2025-09-11T02:50:07Z","abstract_excerpt":"Large Language Model (LLM) watermarking embeds detectable signals into generated text for copyright protection, misuse prevention, and content detection. While prior studies evaluate robustness using watermark removal attacks, these methods are often suboptimal, creating the misconception that effective removal requires large perturbations or powerful adversaries.\n  To bridge the gap, we first formalize the system model for LLM watermark, and characterize two realistic threat models constrained on limited access to the watermark detector. We then analyze how different types of perturbation var"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.09112","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.09112/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:11:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UUTGTXXX44CL0gKOTYBW95+0dSrBSQ7VXazLPu7rhVW6aj14BUTuBWNHjdfHQz8GZLGPS0czLsxyvyK+1ghKBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T17:13:37.874724Z"},"content_sha256":"b974ecb4d6e16844d53ae52e6204e30269f197a0ab315260082354813f78cbf5","schema_version":"1.0","event_id":"sha256:b974ecb4d6e16844d53ae52e6204e30269f197a0ab315260082354813f78cbf5"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/bundle.json","state_url":"https://pith.science/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T17:13:37Z","links":{"resolver":"https://pith.science/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7","bundle":"https://pith.science/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/bundle.json","state":"https://pith.science/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/C7HBOUC5JJKCSNTECVL2PU5OQ7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:C7HBOUC5JJKCSNTECVL2PU5OQ7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a7d0eb7332ddea310663fb559f9483201671128e7f0078b865eb97c32f10f063","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T02:50:07Z","title_canon_sha256":"e12466ea74fedfa8426b633d3b9aeb74d4eb0a24d3fc5b1eab6b5fa1e6c28cd2"},"schema_version":"1.0","source":{"id":"2509.09112","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2509.09112","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"arxiv_version","alias_value":"2509.09112v2","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.09112","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_12","alias_value":"C7HBOUC5JJKC","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_16","alias_value":"C7HBOUC5JJKCSNTE","created_at":"2026-07-05T12:11:20Z"},{"alias_kind":"pith_short_8","alias_value":"C7HBOUC5","created_at":"2026-07-05T12:11:20Z"}],"graph_snapshots":[{"event_id":"sha256:b974ecb4d6e16844d53ae52e6204e30269f197a0ab315260082354813f78cbf5","target":"graph","created_at":"2026-07-05T12:11:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2509.09112/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Model (LLM) watermarking embeds detectable signals into generated text for copyright protection, misuse prevention, and content detection. While prior studies evaluate robustness using watermark removal attacks, these methods are often suboptimal, creating the misconception that effective removal requires large perturbations or powerful adversaries.\n  To bridge the gap, we first formalize the system model for LLM watermark, and characterize two realistic threat models constrained on limited access to the watermark detector. We then analyze how different types of perturbation var","authors_text":"Asif Qumer Gill, Bo Liu, He Zhang, Leo Yu Zhang, Shirui Pan, Xiaomei Zhang, Yanjun Zhang, Zhaoxi Zhang","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T02:50:07Z","title":"Character-Level Perturbations Disrupt LLM Watermarks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.09112","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3ebf99e40c50208c5e30b4ffc6d2677a2a07802098cf2d6cba64d966022a0d62","target":"record","created_at":"2026-07-05T12:11:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a7d0eb7332ddea310663fb559f9483201671128e7f0078b865eb97c32f10f063","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T02:50:07Z","title_canon_sha256":"e12466ea74fedfa8426b633d3b9aeb74d4eb0a24d3fc5b1eab6b5fa1e6c28cd2"},"schema_version":"1.0","source":{"id":"2509.09112","kind":"arxiv","version":2}},"canonical_sha256":"17ce17505d4a542936641557a7d3ae87ebdb99c73a7ff5cd65dca46fff51a16c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"17ce17505d4a542936641557a7d3ae87ebdb99c73a7ff5cd65dca46fff51a16c","first_computed_at":"2026-07-05T12:11:20.850734Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:11:20.850734Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5zhJMv8L8iYutOcanQ3r4j5uNw6slfr7VWgTUvld3MqpfNqNyO0Pd4VdzIxr41kjJ/Vdhcjv1KPbKh/U9zd7Ag==","signature_status":"signed_v1","signed_at":"2026-07-05T12:11:20.851256Z","signed_message":"canonical_sha256_bytes"},"source_id":"2509.09112","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3ebf99e40c50208c5e30b4ffc6d2677a2a07802098cf2d6cba64d966022a0d62","sha256:b974ecb4d6e16844d53ae52e6204e30269f197a0ab315260082354813f78cbf5"],"state_sha256":"ff4f0eb5cd4b84ff045eec63dcec040a58a9923dc94ad1383ed03c148ae3d5a9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fZVBnXsrREXAMQ/73A6TS3XbsUatcGEJkwSeienbU6E+dYGLZzEwxf1bec4UJxSilhpfKLjs2Q+TnOR5IYbIBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T17:13:37.878872Z","bundle_sha256":"cbb9edac051c9e7b44c0ef4577d3143c9a89875b8f34af2b19da7cb904c8a820"}}