{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:ISCAMB7UZE4NEBEZN56ABTOJCW","short_pith_number":"pith:ISCAMB7U","canonical_record":{"source":{"id":"2409.18025","kind":"arxiv","version":6},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-26T16:32:19Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"title_canon_sha256":"a5fb18fa35092972a793b1b46dedc157836feecbc68ffe086cac3030b00d4bc3","abstract_canon_sha256":"c530488dc7035df7f3b3ec70ecf5d52f3b93b4f22dff00b359b9778447423289"},"schema_version":"1.0"},"canonical_sha256":"44840607f4c938d204996f7c00cdc915afdcb45df30c333859e9e12ebf0b33a7","source":{"kind":"arxiv","id":"2409.18025","version":6},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.18025","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"arxiv_version","alias_value":"2409.18025v6","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.18025","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_12","alias_value":"ISCAMB7UZE4N","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_16","alias_value":"ISCAMB7UZE4NEBEZ","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_8","alias_value":"ISCAMB7U","created_at":"2026-07-05T11:13:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:ISCAMB7UZE4NEBEZN56ABTOJCW","target":"record","payload":{"canonical_record":{"source":{"id":"2409.18025","kind":"arxiv","version":6},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-26T16:32:19Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"title_canon_sha256":"a5fb18fa35092972a793b1b46dedc157836feecbc68ffe086cac3030b00d4bc3","abstract_canon_sha256":"c530488dc7035df7f3b3ec70ecf5d52f3b93b4f22dff00b359b9778447423289"},"schema_version":"1.0"},"canonical_sha256":"44840607f4c938d204996f7c00cdc915afdcb45df30c333859e9e12ebf0b33a7","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:13:13.014016Z","signature_b64":"2OfuXLfCN0786D6iLgiYZFNsik9sY1AkyQOpKZnX21hGUnPLulK+AmspQvVAUG2P3t4it3wUHnBRitL0zGoxCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"44840607f4c938d204996f7c00cdc915afdcb45df30c333859e9e12ebf0b33a7","last_reissued_at":"2026-07-05T11:13:13.013479Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:13:13.013479Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.18025","source_version":6,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:13:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"p/4MgeqkvxEySGqnfbBnLLlTohjq2TdLdzZyF9dz8Pwc+O5FVFtK2XKyaSmGLWkvR5iAZBuR2DVWLrFuaVBYAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T15:12:22.462896Z"},"content_sha256":"c034b4ec97e57bb73935af150a5271bebf768461e38dddf0b4b98669784f7245","schema_version":"1.0","event_id":"sha256:c034b4ec97e57bb73935af150a5271bebf768461e38dddf0b4b98669784f7245"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:ISCAMB7UZE4NEBEZN56ABTOJCW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An Adversarial Perspective on Machine Unlearning for AI Safety","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.CL","cs.CR"],"primary_cat":"cs.LG","authors_text":"Boyi Wei, Florian Tram\\`er, Jakub {\\L}ucki, Javier Rando, Peter Henderson, Yangsibo Huang","submitted_at":"2024-09-26T16:32:19Z","abstract_excerpt":"Large language models are finetuned to refuse questions about hazardous knowledge, but these protections can often be bypassed. Unlearning methods aim at completely removing hazardous capabilities from models and make them inaccessible to adversaries. This work challenges the fundamental differences between unlearning and traditional safety post-training from an adversarial perspective. We demonstrate that existing jailbreak methods, previously reported as ineffective against unlearning, can be successful when applied carefully. Furthermore, we develop a variety of adaptive methods that recove"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.18025","kind":"arxiv","version":6},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.18025/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:13:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jzH7j9YreQZRGIfM8x0xgykc1WBxnPCVC7CPhDt3qYm9OiqB5PJQJDeXSKGUM0GlKIAcH+AJOnVk5LbY2xtIAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T15:12:22.463542Z"},"content_sha256":"af7cfd549ec95fd5f280fd009a2d8548c80dda3a74a6004ccbe1fc1c9dbe1c3f","schema_version":"1.0","event_id":"sha256:af7cfd549ec95fd5f280fd009a2d8548c80dda3a74a6004ccbe1fc1c9dbe1c3f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/bundle.json","state_url":"https://pith.science/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T15:12:22Z","links":{"resolver":"https://pith.science/pith/ISCAMB7UZE4NEBEZN56ABTOJCW","bundle":"https://pith.science/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/bundle.json","state":"https://pith.science/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ISCAMB7UZE4NEBEZN56ABTOJCW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:ISCAMB7UZE4NEBEZN56ABTOJCW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c530488dc7035df7f3b3ec70ecf5d52f3b93b4f22dff00b359b9778447423289","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-26T16:32:19Z","title_canon_sha256":"a5fb18fa35092972a793b1b46dedc157836feecbc68ffe086cac3030b00d4bc3"},"schema_version":"1.0","source":{"id":"2409.18025","kind":"arxiv","version":6}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.18025","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"arxiv_version","alias_value":"2409.18025v6","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.18025","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_12","alias_value":"ISCAMB7UZE4N","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_16","alias_value":"ISCAMB7UZE4NEBEZ","created_at":"2026-07-05T11:13:13Z"},{"alias_kind":"pith_short_8","alias_value":"ISCAMB7U","created_at":"2026-07-05T11:13:13Z"}],"graph_snapshots":[{"event_id":"sha256:af7cfd549ec95fd5f280fd009a2d8548c80dda3a74a6004ccbe1fc1c9dbe1c3f","target":"graph","created_at":"2026-07-05T11:13:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.18025/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models are finetuned to refuse questions about hazardous knowledge, but these protections can often be bypassed. Unlearning methods aim at completely removing hazardous capabilities from models and make them inaccessible to adversaries. This work challenges the fundamental differences between unlearning and traditional safety post-training from an adversarial perspective. We demonstrate that existing jailbreak methods, previously reported as ineffective against unlearning, can be successful when applied carefully. Furthermore, we develop a variety of adaptive methods that recove","authors_text":"Boyi Wei, Florian Tram\\`er, Jakub {\\L}ucki, Javier Rando, Peter Henderson, Yangsibo Huang","cross_cats":["cs.AI","cs.CL","cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-26T16:32:19Z","title":"An Adversarial Perspective on Machine Unlearning for AI Safety"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.18025","kind":"arxiv","version":6},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c034b4ec97e57bb73935af150a5271bebf768461e38dddf0b4b98669784f7245","target":"record","created_at":"2026-07-05T11:13:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c530488dc7035df7f3b3ec70ecf5d52f3b93b4f22dff00b359b9778447423289","cross_cats_sorted":["cs.AI","cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-26T16:32:19Z","title_canon_sha256":"a5fb18fa35092972a793b1b46dedc157836feecbc68ffe086cac3030b00d4bc3"},"schema_version":"1.0","source":{"id":"2409.18025","kind":"arxiv","version":6}},"canonical_sha256":"44840607f4c938d204996f7c00cdc915afdcb45df30c333859e9e12ebf0b33a7","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"44840607f4c938d204996f7c00cdc915afdcb45df30c333859e9e12ebf0b33a7","first_computed_at":"2026-07-05T11:13:13.013479Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:13:13.013479Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"2OfuXLfCN0786D6iLgiYZFNsik9sY1AkyQOpKZnX21hGUnPLulK+AmspQvVAUG2P3t4it3wUHnBRitL0zGoxCg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:13:13.014016Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.18025","source_kind":"arxiv","source_version":6}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c034b4ec97e57bb73935af150a5271bebf768461e38dddf0b4b98669784f7245","sha256:af7cfd549ec95fd5f280fd009a2d8548c80dda3a74a6004ccbe1fc1c9dbe1c3f"],"state_sha256":"3f61b38ff0e1ccf75a8743225561bb1213a90c6353fe0fd7bcd6430a60f2b485"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DfEXkSinXNBVZlXroWWHqklVjVvZBthKwwJ0hVmJyLFue3ZgMDIiedUe5Fsh0g0QaJrP/mxPVAa5KTohOkROAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T15:12:22.469441Z","bundle_sha256":"c6eae4af34780e58c32a01b2e702129549d83bbfbc4b65b452d11a2c1ea9f138"}}