{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:DKUZYMNUNQ3L6SB3E64TTSFQZV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"04589d91679c5194bdb8698adc063faa6cb1a3430f135a55be248787538f3346","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SD"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-06T09:52:29Z","title_canon_sha256":"2ae5629d795c34f2a7469e3c5393edff3a54762a43e6555d7774a3cd407189fe"},"schema_version":"1.0","source":{"id":"2605.04700","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.04700","created_at":"2026-05-26T02:04:12Z"},{"alias_kind":"arxiv_version","alias_value":"2605.04700v2","created_at":"2026-05-26T02:04:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.04700","created_at":"2026-05-26T02:04:12Z"},{"alias_kind":"pith_short_12","alias_value":"DKUZYMNUNQ3L","created_at":"2026-05-26T02:04:12Z"},{"alias_kind":"pith_short_16","alias_value":"DKUZYMNUNQ3L6SB3","created_at":"2026-05-26T02:04:12Z"},{"alias_kind":"pith_short_8","alias_value":"DKUZYMNU","created_at":"2026-05-26T02:04:12Z"}],"graph_snapshots":[{"event_id":"sha256:976cbc6238fd7d38a13affb7c715fb87509706c4d177db3acf450aac65f64805","target":"graph","created_at":"2026-05-26T02:04:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"substantial sparsification preserves strong attack success rates (e.g. on Qwen3-Omni, ASR_l remains at 86% with a token retention ratio of 0.25, compared to 87% with full token retention)"},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"The non-uniform distribution of token-aligned gradient energy remains stable and informative across different prompts, models, and optimization steps, so that masking low-energy gradients does not degrade convergence or attack effectiveness."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Sparse selection of high-gradient-energy audio tokens suffices for effective jailbreaking of audio language models with minimal drop in attack success rate."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"Only high-energy audio tokens need updating to jailbreak audio language models at near-full strength."}],"snapshot_sha256":"de015212940affa33e77bbaffaf2b4c53b3adde12b26f694ec2e39d8f468cbbc"},"formal_canon":{"evidence_count":2,"snapshot_sha256":"75cce5b8b81ef4b1e398a22f7c5584e7efd11724ae70db5a58b63f51ef581b3d"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-20T11:35:35.357831Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_title_agreement","ran_at":"2026-05-19T22:31:19.759446Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T14:13:06.977863Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.04700/integrity.json","findings":[],"snapshot_sha256":"a16e043c1bb765ebd6e904dfe979996d41fc12ff4a5c45bc4ad4b77b860c7c37","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Jailbreak attacks on audio language models (ALMs) optimize audio perturbations to elicit unsafe generations, and they typically update the entire waveform densely throughout optimization. In this work, we investigate the necessity of such dense optimization by analyzing the structure of token-aligned gradients in ALMs. We find that gradient energy is highly non-uniform across audio tokens, indicating that only a small subset of token-aligned audio regions dominates the optimization signal. Motivated by this observation, we propose Token-Aware Gradient Optimization (TAGO), which enables sparse ","authors_text":"Shaokang Wang, Shenyi Zhang, Xiaosen Wang, Zheng Fang, Zhijin Ge","cross_cats":["cs.AI","cs.CL","cs.LG","cs.SD"],"headline":"Only high-energy audio tokens need updating to jailbreak audio language models at near-full strength.","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-06T09:52:29Z","title":"Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimization"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.04700","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-08T18:04:13.716703Z","id":"d82b53fd-443e-4595-b998-b919a4e46c15","model_set":{"reader":"grok-4.3"},"one_line_summary":"Sparse selection of high-gradient-energy audio tokens suffices for effective jailbreaking of audio language models with minimal drop in attack success rate.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"Only high-energy audio tokens need updating to jailbreak audio language models at near-full strength.","strongest_claim":"substantial sparsification preserves strong attack success rates (e.g. on Qwen3-Omni, ASR_l remains at 86% with a token retention ratio of 0.25, compared to 87% with full token retention)","weakest_assumption":"The non-uniform distribution of token-aligned gradient energy remains stable and informative across different prompts, models, and optimization steps, so that masking low-energy gradients does not degrade convergence or attack effectiveness."}},"verdict_id":"d82b53fd-443e-4595-b998-b919a4e46c15"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:aeb159a4863fb932d5243d12b6a9880631415e09f924c003c9c236fca2ca4b83","target":"record","created_at":"2026-05-26T02:04:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"04589d91679c5194bdb8698adc063faa6cb1a3430f135a55be248787538f3346","cross_cats_sorted":["cs.AI","cs.CL","cs.LG","cs.SD"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-05-06T09:52:29Z","title_canon_sha256":"2ae5629d795c34f2a7469e3c5393edff3a54762a43e6555d7774a3cd407189fe"},"schema_version":"1.0","source":{"id":"2605.04700","kind":"arxiv","version":2}},"canonical_sha256":"1aa99c31b46c36bf483b27b939c8b0cd591760bb7cc5c4087a54976dc9697ca6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1aa99c31b46c36bf483b27b939c8b0cd591760bb7cc5c4087a54976dc9697ca6","first_computed_at":"2026-05-26T02:04:12.045564Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-26T02:04:12.045564Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"wmN1qZDSgAhZR2oGrf+RwvlggeSdyhhnGP5ElVNrBLblTzQ6NL55ZtqTguqBDcBefVoAVe72i22wOJq6ysy1Bw==","signature_status":"signed_v1","signed_at":"2026-05-26T02:04:12.046182Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.04700","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:aeb159a4863fb932d5243d12b6a9880631415e09f924c003c9c236fca2ca4b83","sha256:976cbc6238fd7d38a13affb7c715fb87509706c4d177db3acf450aac65f64805"],"state_sha256":"cbba34c884862cc3fcf35378d956057b10786ac61f331ca726b5f29d4ad42190"}