{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:DLE263XNMMXKDYVGBXZPDLDLNA","short_pith_number":"pith:DLE263XN","schema_version":"1.0","canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","source":{"kind":"arxiv","id":"2608.01043","version":1},"attestation_state":"computed","paper":{"title":"Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita, Shibo Zheng, Xiangchen Guan","submitted_at":"2026-08-02T07:00:49Z","abstract_excerpt":"We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2608.01043","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"aa9135a64dc164b9f8ddc5f8f692c518527188861ff013843b3093ef3a60596b","abstract_canon_sha256":"fc6044c3c428a2d041a8336b7208c0a7540436bd332dc5dd41140f10125b2bca"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-04T01:56:17.107843Z","signature_b64":"CZF9KYPmoqiBiZo3ZraNsaPN/DdWsVC2cUoYyFpfw548JTGHTjSDrK46u6bVTLsUGc9OruxwU6STW7S8UpMnAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","last_reissued_at":"2026-08-04T01:56:17.105706Z","signature_status":"signed_v1","first_computed_at":"2026-08-04T01:56:17.105706Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita, Shibo Zheng, Xiangchen Guan","submitted_at":"2026-08-02T07:00:49Z","abstract_excerpt":"We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.01043","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.01043/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2608.01043","created_at":"2026-08-04T01:56:17.107468+00:00"},{"alias_kind":"arxiv_version","alias_value":"2608.01043v1","created_at":"2026-08-04T01:56:17.107468+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.01043","created_at":"2026-08-04T01:56:17.107468+00:00"},{"alias_kind":"pith_short_12","alias_value":"DLE263XNMMXK","created_at":"2026-08-04T01:56:17.107468+00:00"},{"alias_kind":"pith_short_16","alias_value":"DLE263XNMMXKDYVG","created_at":"2026-08-04T01:56:17.107468+00:00"},{"alias_kind":"pith_short_8","alias_value":"DLE263XN","created_at":"2026-08-04T01:56:17.107468+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA","json":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA.json","graph_json":"https://pith.science/api/pith-number/DLE263XNMMXKDYVGBXZPDLDLNA/graph.json","events_json":"https://pith.science/api/pith-number/DLE263XNMMXKDYVGBXZPDLDLNA/events.json","paper":"https://pith.science/paper/DLE263XN"},"agent_actions":{"view_html":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA","download_json":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA.json","view_paper":"https://pith.science/paper/DLE263XN","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2608.01043&json=true","fetch_graph":"https://pith.science/api/pith-number/DLE263XNMMXKDYVGBXZPDLDLNA/graph.json","fetch_events":"https://pith.science/api/pith-number/DLE263XNMMXKDYVGBXZPDLDLNA/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/action/timestamp_anchor","attest_storage":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/action/storage_attestation","attest_author":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/action/author_attestation","sign_citation":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/action/citation_signature","submit_replication":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/action/replication_record"}},"created_at":"2026-08-04T01:56:17.107468+00:00","updated_at":"2026-08-04T01:56:17.107468+00:00"}