{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:FQHN2T7K43GNX72GZ6XZJT4IYF","short_pith_number":"pith:FQHN2T7K","canonical_record":{"source":{"id":"2312.14197","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-12-21T01:08:39Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"792f3c75154a13698a61479941ecdcdc61df06431f81e0060938368e5e7a0199","abstract_canon_sha256":"67d9daac8f77bec732994a1a2db40e6cf121fd856a54b9d2552c988789ad46e7"},"schema_version":"1.0"},"canonical_sha256":"2c0edd4feae6ccdbff46cfaf94cf88c154095834bd0289e78273757501661f7b","source":{"kind":"arxiv","id":"2312.14197","version":4},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2312.14197","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"arxiv_version","alias_value":"2312.14197v4","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2312.14197","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_12","alias_value":"FQHN2T7K43GN","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_16","alias_value":"FQHN2T7K43GNX72G","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_8","alias_value":"FQHN2T7K","created_at":"2026-07-05T10:05:40Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:FQHN2T7K43GNX72GZ6XZJT4IYF","target":"record","payload":{"canonical_record":{"source":{"id":"2312.14197","kind":"arxiv","version":4},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-12-21T01:08:39Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"792f3c75154a13698a61479941ecdcdc61df06431f81e0060938368e5e7a0199","abstract_canon_sha256":"67d9daac8f77bec732994a1a2db40e6cf121fd856a54b9d2552c988789ad46e7"},"schema_version":"1.0"},"canonical_sha256":"2c0edd4feae6ccdbff46cfaf94cf88c154095834bd0289e78273757501661f7b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:05:40.980746Z","signature_b64":"9OUuBR4suUEjd7O+AdkT9OxKdLKvbu/C1bEPEWvv2KMOO+f03dC5SIA7zW8JbBkL7D1w7+C+vNTaAM2WH57zDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2c0edd4feae6ccdbff46cfaf94cf88c154095834bd0289e78273757501661f7b","last_reissued_at":"2026-07-05T10:05:40.980255Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:05:40.980255Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2312.14197","source_version":4,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:05:40Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RBR6Ttkue+IGpc7Hr7NOd02ufewJjyVcjy03ZbwVK8E8+iFOkGMI0n8VuZZLyZwIR98zviJBIYd5aZXoh0gYCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T00:41:43.122094Z"},"content_sha256":"5c6036d124a8b48c6fac3dc45097bf7f948371b72aead19d93fec1407e4a6761","schema_version":"1.0","event_id":"sha256:5c6036d124a8b48c6fac3dc45097bf7f948371b72aead19d93fec1407e4a6761"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:FQHN2T7K43GNX72GZ6XZJT4IYF","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CL","authors_text":"Bin Zhu, Emre Kiciman, Fangzhao Wu, Guangzhong Sun, Jingwei Yi, Xing Xie, Yueqi Xie","submitted_at":"2023-12-21T01:08:39Z","abstract_excerpt":"The integration of large language models with external content has enabled applications such as Microsoft Copilot but also introduced vulnerabilities to indirect prompt injection attacks. In these attacks, malicious instructions embedded within external content can manipulate LLM outputs, causing deviations from user expectations. To address this critical yet under-explored issue, we introduce the first benchmark for indirect prompt injection attacks, named BIPIA, to assess the risk of such vulnerabilities. Using BIPIA, we evaluate existing LLMs and find them universally vulnerable. Our analys"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2312.14197","kind":"arxiv","version":4},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2312.14197/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:05:40Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"T5/7ERA45TdhDL47GHlwES7tDKQ3K88Rw2eYIQrBu06ZN69mmb+Ly4Ip23kEzi2KvL+TtGuDdtUH800O+Dq6DQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-16T00:41:43.122609Z"},"content_sha256":"a2ca2495063cd94cfa9526d2ac6bbb6ce34f92f75b8639abd9feb7bfe4d8767f","schema_version":"1.0","event_id":"sha256:a2ca2495063cd94cfa9526d2ac6bbb6ce34f92f75b8639abd9feb7bfe4d8767f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/bundle.json","state_url":"https://pith.science/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-16T00:41:43Z","links":{"resolver":"https://pith.science/pith/FQHN2T7K43GNX72GZ6XZJT4IYF","bundle":"https://pith.science/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/bundle.json","state":"https://pith.science/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FQHN2T7K43GNX72GZ6XZJT4IYF/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:FQHN2T7K43GNX72GZ6XZJT4IYF","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"67d9daac8f77bec732994a1a2db40e6cf121fd856a54b9d2552c988789ad46e7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-12-21T01:08:39Z","title_canon_sha256":"792f3c75154a13698a61479941ecdcdc61df06431f81e0060938368e5e7a0199"},"schema_version":"1.0","source":{"id":"2312.14197","kind":"arxiv","version":4}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2312.14197","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"arxiv_version","alias_value":"2312.14197v4","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2312.14197","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_12","alias_value":"FQHN2T7K43GN","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_16","alias_value":"FQHN2T7K43GNX72G","created_at":"2026-07-05T10:05:40Z"},{"alias_kind":"pith_short_8","alias_value":"FQHN2T7K","created_at":"2026-07-05T10:05:40Z"}],"graph_snapshots":[{"event_id":"sha256:a2ca2495063cd94cfa9526d2ac6bbb6ce34f92f75b8639abd9feb7bfe4d8767f","target":"graph","created_at":"2026-07-05T10:05:40Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2312.14197/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The integration of large language models with external content has enabled applications such as Microsoft Copilot but also introduced vulnerabilities to indirect prompt injection attacks. In these attacks, malicious instructions embedded within external content can manipulate LLM outputs, causing deviations from user expectations. To address this critical yet under-explored issue, we introduce the first benchmark for indirect prompt injection attacks, named BIPIA, to assess the risk of such vulnerabilities. Using BIPIA, we evaluate existing LLMs and find them universally vulnerable. Our analys","authors_text":"Bin Zhu, Emre Kiciman, Fangzhao Wu, Guangzhong Sun, Jingwei Yi, Xing Xie, Yueqi Xie","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2312.14197","kind":"arxiv","version":4},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5c6036d124a8b48c6fac3dc45097bf7f948371b72aead19d93fec1407e4a6761","target":"record","created_at":"2026-07-05T10:05:40Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"67d9daac8f77bec732994a1a2db40e6cf121fd856a54b9d2552c988789ad46e7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2023-12-21T01:08:39Z","title_canon_sha256":"792f3c75154a13698a61479941ecdcdc61df06431f81e0060938368e5e7a0199"},"schema_version":"1.0","source":{"id":"2312.14197","kind":"arxiv","version":4}},"canonical_sha256":"2c0edd4feae6ccdbff46cfaf94cf88c154095834bd0289e78273757501661f7b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2c0edd4feae6ccdbff46cfaf94cf88c154095834bd0289e78273757501661f7b","first_computed_at":"2026-07-05T10:05:40.980255Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:05:40.980255Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9OUuBR4suUEjd7O+AdkT9OxKdLKvbu/C1bEPEWvv2KMOO+f03dC5SIA7zW8JbBkL7D1w7+C+vNTaAM2WH57zDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T10:05:40.980746Z","signed_message":"canonical_sha256_bytes"},"source_id":"2312.14197","source_kind":"arxiv","source_version":4}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5c6036d124a8b48c6fac3dc45097bf7f948371b72aead19d93fec1407e4a6761","sha256:a2ca2495063cd94cfa9526d2ac6bbb6ce34f92f75b8639abd9feb7bfe4d8767f"],"state_sha256":"a379e42248136600e833f5aeaa510842b8482bb2e18c1d604a68cc1068e2b693"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iaoWTQUsNYOMod+TPx0Npw38LqPFDToE1gyVnbb7Y1FLWMEpVV4puefw6zzkUb1Qm4+98GZU9Ag2qtwFfiHCBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-16T00:41:43.126011Z","bundle_sha256":"014ca28a547be4386060a0e8749488b775fca645a12e340017a3389ef1a9e887"}}