{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:HQ24NPDSEBBJP5A6AM3I7PF4VA","short_pith_number":"pith:HQ24NPDS","canonical_record":{"source":{"id":"2502.15836","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2025-02-20T13:22:33Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1c33d92d3436ec04084741eb216784ac18ebc0e7d5b71832773a5d653eafa0ce","abstract_canon_sha256":"cd8a00c34f12357002a5ba1da3095e9e601f472573c26514b0962ecdeea9abb7"},"schema_version":"1.0"},"canonical_sha256":"3c35c6bc72204297f41e03368fbcbca8241970de1ceffcaadab70198f28d481b","source":{"kind":"arxiv","id":"2502.15836","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.15836","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"arxiv_version","alias_value":"2502.15836v2","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.15836","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_12","alias_value":"HQ24NPDSEBBJ","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_16","alias_value":"HQ24NPDSEBBJP5A6","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_8","alias_value":"HQ24NPDS","created_at":"2026-07-05T12:06:07Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:HQ24NPDSEBBJP5A6AM3I7PF4VA","target":"record","payload":{"canonical_record":{"source":{"id":"2502.15836","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2025-02-20T13:22:33Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"1c33d92d3436ec04084741eb216784ac18ebc0e7d5b71832773a5d653eafa0ce","abstract_canon_sha256":"cd8a00c34f12357002a5ba1da3095e9e601f472573c26514b0962ecdeea9abb7"},"schema_version":"1.0"},"canonical_sha256":"3c35c6bc72204297f41e03368fbcbca8241970de1ceffcaadab70198f28d481b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:06:07.112691Z","signature_b64":"CLUA9QamO8jCoD19U1kav+fcSkBfRMgo+elX05NZBvW6Tr1s6ZLDPv30aqq9n6Ayh1OqMtrguDE90RB0kFvaCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3c35c6bc72204297f41e03368fbcbca8241970de1ceffcaadab70198f28d481b","last_reissued_at":"2026-07-05T12:06:07.112169Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:06:07.112169Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.15836","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:06:07Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+cgVmiSWWQxklmGC6SC3Fo1OkTlvkKSRVIJam0MJsUtAmTvGdawMylKEkKEw3IMaBzOIneG/1nUkiGtNYMaDDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T15:50:46.529732Z"},"content_sha256":"3019b15fb2b0c448bcf86fa2784f56e4776f40f48c4f364eccd69913cce604e8","schema_version":"1.0","event_id":"sha256:3019b15fb2b0c448bcf86fa2784f56e4776f40f48c4f364eccd69913cce604e8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:HQ24NPDSEBBJP5A6AM3I7PF4VA","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Soft Token Attacks Cannot Reliably Audit Unlearning in Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CL","authors_text":"Haokun Chen, Nageen Himayat, Sebastian Szyller, Weilin Xu","submitted_at":"2025-02-20T13:22:33Z","abstract_excerpt":"Large language models (LLMs) are trained using massive datasets, which often contain undesirable content such as harmful texts, personal information, and copyrighted material. To address this, machine unlearning aims to remove information from trained models. Recent work has shown that soft token attacks (STA) can successfully extract unlearned information from LLMs, but in this work we show that STAs can be an inadequate tool for auditing unlearning. Using common benchmarks such as Who Is Harry Potter? and TOFU, we demonstrate that in a strong auditor setting such attacks can elicit any infor"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.15836","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.15836/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T12:06:07Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6PZZ19KJFIhWD2vu5xWqqDL8m7FPD11GvbQIEJtM7TzifAFzr/Z6GU96jutedpXQpBe3kpsexpJRsrc0zltODw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T15:50:46.530232Z"},"content_sha256":"5d643f9104c7d46ce9f0e515dbc41f5049aa9f93ac63a0e93aef72641fb28bdf","schema_version":"1.0","event_id":"sha256:5d643f9104c7d46ce9f0e515dbc41f5049aa9f93ac63a0e93aef72641fb28bdf"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/bundle.json","state_url":"https://pith.science/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T15:50:46Z","links":{"resolver":"https://pith.science/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA","bundle":"https://pith.science/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/bundle.json","state":"https://pith.science/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HQ24NPDSEBBJP5A6AM3I7PF4VA/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:HQ24NPDSEBBJP5A6AM3I7PF4VA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cd8a00c34f12357002a5ba1da3095e9e601f472573c26514b0962ecdeea9abb7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2025-02-20T13:22:33Z","title_canon_sha256":"1c33d92d3436ec04084741eb216784ac18ebc0e7d5b71832773a5d653eafa0ce"},"schema_version":"1.0","source":{"id":"2502.15836","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.15836","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"arxiv_version","alias_value":"2502.15836v2","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.15836","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_12","alias_value":"HQ24NPDSEBBJ","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_16","alias_value":"HQ24NPDSEBBJP5A6","created_at":"2026-07-05T12:06:07Z"},{"alias_kind":"pith_short_8","alias_value":"HQ24NPDS","created_at":"2026-07-05T12:06:07Z"}],"graph_snapshots":[{"event_id":"sha256:5d643f9104c7d46ce9f0e515dbc41f5049aa9f93ac63a0e93aef72641fb28bdf","target":"graph","created_at":"2026-07-05T12:06:07Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.15836/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) are trained using massive datasets, which often contain undesirable content such as harmful texts, personal information, and copyrighted material. To address this, machine unlearning aims to remove information from trained models. Recent work has shown that soft token attacks (STA) can successfully extract unlearned information from LLMs, but in this work we show that STAs can be an inadequate tool for auditing unlearning. Using common benchmarks such as Who Is Harry Potter? and TOFU, we demonstrate that in a strong auditor setting such attacks can elicit any infor","authors_text":"Haokun Chen, Nageen Himayat, Sebastian Szyller, Weilin Xu","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2025-02-20T13:22:33Z","title":"Soft Token Attacks Cannot Reliably Audit Unlearning in Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.15836","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3019b15fb2b0c448bcf86fa2784f56e4776f40f48c4f364eccd69913cce604e8","target":"record","created_at":"2026-07-05T12:06:07Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cd8a00c34f12357002a5ba1da3095e9e601f472573c26514b0962ecdeea9abb7","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2025-02-20T13:22:33Z","title_canon_sha256":"1c33d92d3436ec04084741eb216784ac18ebc0e7d5b71832773a5d653eafa0ce"},"schema_version":"1.0","source":{"id":"2502.15836","kind":"arxiv","version":2}},"canonical_sha256":"3c35c6bc72204297f41e03368fbcbca8241970de1ceffcaadab70198f28d481b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3c35c6bc72204297f41e03368fbcbca8241970de1ceffcaadab70198f28d481b","first_computed_at":"2026-07-05T12:06:07.112169Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T12:06:07.112169Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"CLUA9QamO8jCoD19U1kav+fcSkBfRMgo+elX05NZBvW6Tr1s6ZLDPv30aqq9n6Ayh1OqMtrguDE90RB0kFvaCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T12:06:07.112691Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.15836","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3019b15fb2b0c448bcf86fa2784f56e4776f40f48c4f364eccd69913cce604e8","sha256:5d643f9104c7d46ce9f0e515dbc41f5049aa9f93ac63a0e93aef72641fb28bdf"],"state_sha256":"c758f0374bdddf182182eddef34b974093b71602e793225ea6d4dff28bf137c5"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pigmT7snRccI+LMZSURYMxpZbvBODju1Hqwyv+2VK5YKreqHbthBWUtWmdBtFm2DfEhEp1XJniylueWexGK2AA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T15:50:46.536004Z","bundle_sha256":"3818728584ce1156643b291cdc32c60c065351c374dfeed54de8fe2eb84a3405"}}