{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:DLE263XNMMXKDYVGBXZPDLDLNA","short_pith_number":"pith:DLE263XN","canonical_record":{"source":{"id":"2608.01043","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"aa9135a64dc164b9f8ddc5f8f692c518527188861ff013843b3093ef3a60596b","abstract_canon_sha256":"fc6044c3c428a2d041a8336b7208c0a7540436bd332dc5dd41140f10125b2bca"},"schema_version":"1.0"},"canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","source":{"kind":"arxiv","id":"2608.01043","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.01043","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"arxiv_version","alias_value":"2608.01043v1","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.01043","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_12","alias_value":"DLE263XNMMXK","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_16","alias_value":"DLE263XNMMXKDYVG","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_8","alias_value":"DLE263XN","created_at":"2026-08-04T01:56:17Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:DLE263XNMMXKDYVGBXZPDLDLNA","target":"record","payload":{"canonical_record":{"source":{"id":"2608.01043","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"aa9135a64dc164b9f8ddc5f8f692c518527188861ff013843b3093ef3a60596b","abstract_canon_sha256":"fc6044c3c428a2d041a8336b7208c0a7540436bd332dc5dd41140f10125b2bca"},"schema_version":"1.0"},"canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-04T01:56:17.107843Z","signature_b64":"CZF9KYPmoqiBiZo3ZraNsaPN/DdWsVC2cUoYyFpfw548JTGHTjSDrK46u6bVTLsUGc9OruxwU6STW7S8UpMnAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","last_reissued_at":"2026-08-04T01:56:17.105706Z","signature_status":"signed_v1","first_computed_at":"2026-08-04T01:56:17.105706Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.01043","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-04T01:56:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vBvxi9dJKEZhzwik66yBKexVkakHSCG0BKbeCSgZmLQ20G00eQ33WXYbPqaom1Wt+TJibOMjo9ci3eZT0zhqCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:24:49.849734Z"},"content_sha256":"b8e011456ecdb034d18c34b9b5e37b8e5798f60260f5bb5593ccf0cfa1e5430a","schema_version":"1.0","event_id":"sha256:b8e011456ecdb034d18c34b9b5e37b8e5798f60260f5bb5593ccf0cfa1e5430a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:DLE263XNMMXKDYVGBXZPDLDLNA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita, Shibo Zheng, Xiangchen Guan","submitted_at":"2026-08-02T07:00:49Z","abstract_excerpt":"We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.01043","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.01043/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-04T01:56:17Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3Tr3ULP5fm7Qhgc099ptPY6HTpsvEjY+zVEKmgom8j8qM3wmIWjH7uESqWm557BK8le/7D1YirwSCBaja3Z/BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T22:24:49.850248Z"},"content_sha256":"04bf802af7927911291144b4efe134cf48cdffc9c572ea7549da84b08854da7c","schema_version":"1.0","event_id":"sha256:04bf802af7927911291144b4efe134cf48cdffc9c572ea7549da84b08854da7c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/bundle.json","state_url":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/DLE263XNMMXKDYVGBXZPDLDLNA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T22:24:49Z","links":{"resolver":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA","bundle":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/bundle.json","state":"https://pith.science/pith/DLE263XNMMXKDYVGBXZPDLDLNA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/DLE263XNMMXKDYVGBXZPDLDLNA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:DLE263XNMMXKDYVGBXZPDLDLNA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"fc6044c3c428a2d041a8336b7208c0a7540436bd332dc5dd41140f10125b2bca","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","title_canon_sha256":"aa9135a64dc164b9f8ddc5f8f692c518527188861ff013843b3093ef3a60596b"},"schema_version":"1.0","source":{"id":"2608.01043","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.01043","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"arxiv_version","alias_value":"2608.01043v1","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.01043","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_12","alias_value":"DLE263XNMMXK","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_16","alias_value":"DLE263XNMMXKDYVG","created_at":"2026-08-04T01:56:17Z"},{"alias_kind":"pith_short_8","alias_value":"DLE263XN","created_at":"2026-08-04T01:56:17Z"}],"graph_snapshots":[{"event_id":"sha256:04bf802af7927911291144b4efe134cf48cdffc9c572ea7549da84b08854da7c","target":"graph","created_at":"2026-08-04T01:56:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.01043/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant","authors_text":"Haoyu Zhang, Mohammad Zandsalimy, Shanu Sushmita, Shibo Zheng, Xiangchen Guan","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","title":"Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.01043","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b8e011456ecdb034d18c34b9b5e37b8e5798f60260f5bb5593ccf0cfa1e5430a","target":"record","created_at":"2026-08-04T01:56:17Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"fc6044c3c428a2d041a8336b7208c0a7540436bd332dc5dd41140f10125b2bca","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-02T07:00:49Z","title_canon_sha256":"aa9135a64dc164b9f8ddc5f8f692c518527188861ff013843b3093ef3a60596b"},"schema_version":"1.0","source":{"id":"2608.01043","kind":"arxiv","version":1}},"canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1ac9af6eed632ea1e2a60df2f1ac6b68058a6c40a52b13fd7f6518fbe68ef50e","first_computed_at":"2026-08-04T01:56:17.105706Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-04T01:56:17.105706Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"CZF9KYPmoqiBiZo3ZraNsaPN/DdWsVC2cUoYyFpfw548JTGHTjSDrK46u6bVTLsUGc9OruxwU6STW7S8UpMnAQ==","signature_status":"signed_v1","signed_at":"2026-08-04T01:56:17.107843Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.01043","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b8e011456ecdb034d18c34b9b5e37b8e5798f60260f5bb5593ccf0cfa1e5430a","sha256:04bf802af7927911291144b4efe134cf48cdffc9c572ea7549da84b08854da7c"],"state_sha256":"3630f229701ba856ba8e7336f8cfb326695279d136c0e83528e7c86e0041914b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hyLNPXApsCR4XAufjNOOu840+zMH5T8jr69atu6dg+sULcZgHGdsTZ3VhVOrlMwlvsj57KhWhNIOSJvO3312DA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T22:24:49.855529Z","bundle_sha256":"365e87623fdb6bf85fe4aa6eac2c6c37a12bae76028164330e7750d8ece2f37e"}}