{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:CITOJAC4EP6DS2LBR3ZW4GCSPR","short_pith_number":"pith:CITOJAC4","canonical_record":{"source":{"id":"2506.13205","kind":"arxiv","version":6},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T08:09:32Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9d74fb201aa9cc905518b584038f2a94c10c338981616aa78c85e3254d67f51c","abstract_canon_sha256":"7ea02e94ab35c33e7ca056da1d2d2d8d21e8cddd4c0e806528d997bffa9fcaae"},"schema_version":"1.0"},"canonical_sha256":"1226e4805c23fc3969618ef36e18527c559116c1c3bb4cf6693295dad9abc84d","source":{"kind":"arxiv","id":"2506.13205","version":6},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.13205","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"arxiv_version","alias_value":"2506.13205v6","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.13205","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_12","alias_value":"CITOJAC4EP6D","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_16","alias_value":"CITOJAC4EP6DS2LB","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_8","alias_value":"CITOJAC4","created_at":"2026-07-05T12:05:17Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:CITOJAC4EP6DS2LBR3ZW4GCSPR","target":"record","payload":{"canonical_record":{"source":{"id":"2506.13205","kind":"arxiv","version":6},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T08:09:32Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9d74fb201aa9cc905518b584038f2a94c10c338981616aa78c85e3254d67f51c","abstract_canon_sha256":"7ea02e94ab35c33e7ca056da1d2d2d8d21e8cddd4c0e806528d997bffa9fcaae"},"schema_version":"1.0"},"canonical_sha256":"1226e4805c23fc3969618ef36e18527c559116c1c3bb4cf6693295dad9abc84d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:05:17.693911Z","signature_b64":"PlpV4wlGvhJCdipIVDdCCPp3jksAhG/rJOX2KdFMkpnco0sJQrkRdv540lgNSmB1CC0FogtFEWrd9mGDzvusCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1226e4805c23fc3969618ef36e18527c559116c1c3bb4cf6693295dad9abc84d","last_reissued_at":"2026-07-05T12:05:17.693459Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:05:17.693459Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.13205","source_version":6,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:05:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xuEXn01+gCUpcdsTh3UcPqMORlHZpftFyaDs9JSUxIz/Gsm9DFHppxBbvgvpyYW/ecBJmz9dlPvbE+EPrKrjAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:18:35.912189Z"},"content_sha256":"107ec39b2e97a45c7ca51943e641cbc63f907bafb0668b069abe800178284a80","schema_version":"1.0","event_id":"sha256:107ec39b2e97a45c7ca51943e641cbc63f907bafb0668b069abe800178284a80"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:CITOJAC4EP6DS2LBR3ZW4GCSPR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Poison Once, Control Anywhere: Clean-Text Visual Backdoors in VLM-based Mobile Agents","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Aishan Liu, Ee-Chien Chang, Siyuan Liang, Xitong Gao, Xuan Wang, Yi Yu, Yuliang Lu, Zhe Liu","submitted_at":"2025-06-16T08:09:32Z","abstract_excerpt":"Mobile agents powered by vision-language models (VLMs) are increasingly adopted for tasks such as UI automation and camera-based assistance. These agents are typically fine-tuned using small-scale, user-collected data, making them susceptible to stealthy training-time threats. This work introduces VIBMA, the first clean-text backdoor attack targeting VLM-based mobile agents. The attack injects malicious behaviors into the model by modifying only the visual input while preserving textual prompts and instructions, achieving stealth through the complete absence of textual anomalies. Once the agen"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.13205","kind":"arxiv","version":6},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.13205/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:05:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JK18hoBiVOeftEl3u3JJjirBGeVXEB8cU5YObOmyvKg9f3BpKbveB4yXmB9DV+QitjK84FDQkReQ8PnOtVUnCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:18:35.913016Z"},"content_sha256":"1a0a1304bbd336cbc732ac7ea544b41649c1bb21f0865ccbd02654a7af4daaf9","schema_version":"1.0","event_id":"sha256:1a0a1304bbd336cbc732ac7ea544b41649c1bb21f0865ccbd02654a7af4daaf9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/bundle.json","state_url":"https://pith.science/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T16:18:35Z","links":{"resolver":"https://pith.science/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR","bundle":"https://pith.science/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/bundle.json","state":"https://pith.science/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CITOJAC4EP6DS2LBR3ZW4GCSPR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:CITOJAC4EP6DS2LBR3ZW4GCSPR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7ea02e94ab35c33e7ca056da1d2d2d8d21e8cddd4c0e806528d997bffa9fcaae","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T08:09:32Z","title_canon_sha256":"9d74fb201aa9cc905518b584038f2a94c10c338981616aa78c85e3254d67f51c"},"schema_version":"1.0","source":{"id":"2506.13205","kind":"arxiv","version":6}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.13205","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"arxiv_version","alias_value":"2506.13205v6","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.13205","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_12","alias_value":"CITOJAC4EP6D","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_16","alias_value":"CITOJAC4EP6DS2LB","created_at":"2026-07-05T12:05:17Z"},{"alias_kind":"pith_short_8","alias_value":"CITOJAC4","created_at":"2026-07-05T12:05:17Z"}],"graph_snapshots":[{"event_id":"sha256:1a0a1304bbd336cbc732ac7ea544b41649c1bb21f0865ccbd02654a7af4daaf9","target":"graph","created_at":"2026-07-05T12:05:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.13205/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Mobile agents powered by vision-language models (VLMs) are increasingly adopted for tasks such as UI automation and camera-based assistance. These agents are typically fine-tuned using small-scale, user-collected data, making them susceptible to stealthy training-time threats. This work introduces VIBMA, the first clean-text backdoor attack targeting VLM-based mobile agents. The attack injects malicious behaviors into the model by modifying only the visual input while preserving textual prompts and instructions, achieving stealth through the complete absence of textual anomalies. Once the agen","authors_text":"Aishan Liu, Ee-Chien Chang, Siyuan Liang, Xitong Gao, Xuan Wang, Yi Yu, Yuliang Lu, Zhe Liu","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T08:09:32Z","title":"Poison Once, Control Anywhere: Clean-Text Visual Backdoors in VLM-based Mobile Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.13205","kind":"arxiv","version":6},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:107ec39b2e97a45c7ca51943e641cbc63f907bafb0668b069abe800178284a80","target":"record","created_at":"2026-07-05T12:05:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7ea02e94ab35c33e7ca056da1d2d2d8d21e8cddd4c0e806528d997bffa9fcaae","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-16T08:09:32Z","title_canon_sha256":"9d74fb201aa9cc905518b584038f2a94c10c338981616aa78c85e3254d67f51c"},"schema_version":"1.0","source":{"id":"2506.13205","kind":"arxiv","version":6}},"canonical_sha256":"1226e4805c23fc3969618ef36e18527c559116c1c3bb4cf6693295dad9abc84d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1226e4805c23fc3969618ef36e18527c559116c1c3bb4cf6693295dad9abc84d","first_computed_at":"2026-07-05T12:05:17.693459Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:05:17.693459Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"PlpV4wlGvhJCdipIVDdCCPp3jksAhG/rJOX2KdFMkpnco0sJQrkRdv540lgNSmB1CC0FogtFEWrd9mGDzvusCw==","signature_status":"signed_v1","signed_at":"2026-07-05T12:05:17.693911Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.13205","source_kind":"arxiv","source_version":6}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:107ec39b2e97a45c7ca51943e641cbc63f907bafb0668b069abe800178284a80","sha256:1a0a1304bbd336cbc732ac7ea544b41649c1bb21f0865ccbd02654a7af4daaf9"],"state_sha256":"c02b46538ac8476559f21e6250bc515b8e3ccf3f5a1daa1c71201a1c74707e89"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Tz3n0ool6Jp81ZKhoFccKvDPbGA3uYSJqAb4pcEBEkGJHvb6hgiqCBO0gihSeT4RvZLhaEnzd4Kbu2NbQitICQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T16:18:35.918025Z","bundle_sha256":"00846fa1b8a6862a8f7bbb7772e733256824deddc9d03df5a8a6a73b20583787"}}