{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:FI6PG7JIL6K277HEU73G7K2IQV","short_pith_number":"pith:FI6PG7JI","canonical_record":{"source":{"id":"2402.16382","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2024-02-26T08:08:03Z","cross_cats_sorted":[],"title_canon_sha256":"33a1bf0af7aba58eabc1fd4a0d50d56af274be9f0f3258680858ddb6e01e12f9","abstract_canon_sha256":"61138d8c3cba1f1a7b60dcb34ae326abbc8396b42d209f362bac68cd95698556"},"schema_version":"1.0"},"canonical_sha256":"2a3cf37d285f95affce4a7f66fab488570c01aed502a57edbd8f9a93f93991f9","source":{"kind":"arxiv","id":"2402.16382","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.16382","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"arxiv_version","alias_value":"2402.16382v2","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.16382","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_12","alias_value":"FI6PG7JIL6K2","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_16","alias_value":"FI6PG7JIL6K277HE","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_8","alias_value":"FI6PG7JI","created_at":"2026-07-05T09:15:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:FI6PG7JIL6K277HEU73G7K2IQV","target":"record","payload":{"canonical_record":{"source":{"id":"2402.16382","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2024-02-26T08:08:03Z","cross_cats_sorted":[],"title_canon_sha256":"33a1bf0af7aba58eabc1fd4a0d50d56af274be9f0f3258680858ddb6e01e12f9","abstract_canon_sha256":"61138d8c3cba1f1a7b60dcb34ae326abbc8396b42d209f362bac68cd95698556"},"schema_version":"1.0"},"canonical_sha256":"2a3cf37d285f95affce4a7f66fab488570c01aed502a57edbd8f9a93f93991f9","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:15:08.805847Z","signature_b64":"Z15p6pMWFW2dJ/v4pZFgfGttHo05YpSn0lhD1yf2ju6lu7J8YgkUtHH/R/YyZDk00I4bwZuCMq8QXEJMzDIJAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2a3cf37d285f95affce4a7f66fab488570c01aed502a57edbd8f9a93f93991f9","last_reissued_at":"2026-07-05T09:15:08.805410Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:15:08.805410Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2402.16382","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:15:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"clOfiPyJz9lUvyICDXpHSs87QoTN8w9zisCWbbAfRzVYdzp/EXEV4Tk4Y3mkBfam2CHfgKRVdw86PAFfrU6fCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T01:11:23.928302Z"},"content_sha256":"3cb4889ba367134408872f66c5698a62e9aa9b95359454acf3a906d1f307e53a","schema_version":"1.0","event_id":"sha256:3cb4889ba367134408872f66c5698a62e9aa9b95359454acf3a906d1f307e53a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:FI6PG7JIL6K277HEU73G7K2IQV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Immunization against harmful fine-tuning attacks","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CL","authors_text":"Domenic Rosati, Frank Rudzicz, Hassan Sajjad, Jan Batzner, Jan Wehner, Kai Williams, {\\L}ukasz Bartoszcze","submitted_at":"2024-02-26T08:08:03Z","abstract_excerpt":"Large Language Models (LLMs) are often trained with safety guards intended to prevent harmful text generation. However, such safety training can be removed by fine-tuning the LLM on harmful datasets. While this emerging threat (harmful fine-tuning attacks) has been characterized by previous work, there is little understanding of how we should proceed in constructing and validating defenses against these attacks especially in the case where defenders would not have control of the fine-tuning process. We introduce a formal framework based on the training budget of an attacker which we call \"Immu"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.16382","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2402.16382/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:15:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tmudtUYXI1rZwYCXZSmRw6W+aFw2CYPRLyL2PK51qs92qaOi+Xe6rt15+oiU84+Phey8MAhWTH/vOxEdzw5zBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T01:11:23.928878Z"},"content_sha256":"f1ff4b6059a859084659e919f599021a814cad5924afd02af1733bb5170f74d2","schema_version":"1.0","event_id":"sha256:f1ff4b6059a859084659e919f599021a814cad5924afd02af1733bb5170f74d2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FI6PG7JIL6K277HEU73G7K2IQV/bundle.json","state_url":"https://pith.science/pith/FI6PG7JIL6K277HEU73G7K2IQV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FI6PG7JIL6K277HEU73G7K2IQV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-17T01:11:23Z","links":{"resolver":"https://pith.science/pith/FI6PG7JIL6K277HEU73G7K2IQV","bundle":"https://pith.science/pith/FI6PG7JIL6K277HEU73G7K2IQV/bundle.json","state":"https://pith.science/pith/FI6PG7JIL6K277HEU73G7K2IQV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FI6PG7JIL6K277HEU73G7K2IQV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:FI6PG7JIL6K277HEU73G7K2IQV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"61138d8c3cba1f1a7b60dcb34ae326abbc8396b42d209f362bac68cd95698556","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2024-02-26T08:08:03Z","title_canon_sha256":"33a1bf0af7aba58eabc1fd4a0d50d56af274be9f0f3258680858ddb6e01e12f9"},"schema_version":"1.0","source":{"id":"2402.16382","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.16382","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"arxiv_version","alias_value":"2402.16382v2","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.16382","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_12","alias_value":"FI6PG7JIL6K2","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_16","alias_value":"FI6PG7JIL6K277HE","created_at":"2026-07-05T09:15:08Z"},{"alias_kind":"pith_short_8","alias_value":"FI6PG7JI","created_at":"2026-07-05T09:15:08Z"}],"graph_snapshots":[{"event_id":"sha256:f1ff4b6059a859084659e919f599021a814cad5924afd02af1733bb5170f74d2","target":"graph","created_at":"2026-07-05T09:15:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2402.16382/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) are often trained with safety guards intended to prevent harmful text generation. However, such safety training can be removed by fine-tuning the LLM on harmful datasets. While this emerging threat (harmful fine-tuning attacks) has been characterized by previous work, there is little understanding of how we should proceed in constructing and validating defenses against these attacks especially in the case where defenders would not have control of the fine-tuning process. We introduce a formal framework based on the training budget of an attacker which we call \"Immu","authors_text":"Domenic Rosati, Frank Rudzicz, Hassan Sajjad, Jan Batzner, Jan Wehner, Kai Williams, {\\L}ukasz Bartoszcze","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2024-02-26T08:08:03Z","title":"Immunization against harmful fine-tuning attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.16382","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3cb4889ba367134408872f66c5698a62e9aa9b95359454acf3a906d1f307e53a","target":"record","created_at":"2026-07-05T09:15:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"61138d8c3cba1f1a7b60dcb34ae326abbc8396b42d209f362bac68cd95698556","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2024-02-26T08:08:03Z","title_canon_sha256":"33a1bf0af7aba58eabc1fd4a0d50d56af274be9f0f3258680858ddb6e01e12f9"},"schema_version":"1.0","source":{"id":"2402.16382","kind":"arxiv","version":2}},"canonical_sha256":"2a3cf37d285f95affce4a7f66fab488570c01aed502a57edbd8f9a93f93991f9","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2a3cf37d285f95affce4a7f66fab488570c01aed502a57edbd8f9a93f93991f9","first_computed_at":"2026-07-05T09:15:08.805410Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:15:08.805410Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Z15p6pMWFW2dJ/v4pZFgfGttHo05YpSn0lhD1yf2ju6lu7J8YgkUtHH/R/YyZDk00I4bwZuCMq8QXEJMzDIJAA==","signature_status":"signed_v1","signed_at":"2026-07-05T09:15:08.805847Z","signed_message":"canonical_sha256_bytes"},"source_id":"2402.16382","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3cb4889ba367134408872f66c5698a62e9aa9b95359454acf3a906d1f307e53a","sha256:f1ff4b6059a859084659e919f599021a814cad5924afd02af1733bb5170f74d2"],"state_sha256":"fefbaf6f98795ab5ac2fe8c12bef8036cfa2665727ad258a9a05970f7db2a125"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xN2A+vYN4CKrMBr3biTUrUUu3K0SZgYl1Yu8yhxCJB7Jf3dXIlkK/kDU6axd/k0Iderp5/dHVFh8rSq7GkIMAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-17T01:11:23.933844Z","bundle_sha256":"05b9451ca0cf67d45775b9fa371395bcea529e89ba662ae98a0b6476d4dcee94"}}