{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:JHB6F4RMZF5OMACFDHXC4XFJGT","short_pith_number":"pith:JHB6F4RM","canonical_record":{"source":{"id":"2608.02820","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-03T19:32:13Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"bbe78481addac57322dadb52de8fe6f22638f2502a7176cc79fa34d2d36d2e59","abstract_canon_sha256":"92a4ed8b3e983eff022bfdf497a4e9e84ce091196293bc63faeb53a435bbc862"},"schema_version":"1.0"},"canonical_sha256":"49c3e2f22cc97ae6004519ee2e5ca934e25b5959adda89e56a144bddb3e140bf","source":{"kind":"arxiv","id":"2608.02820","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.02820","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"arxiv_version","alias_value":"2608.02820v1","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.02820","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_12","alias_value":"JHB6F4RMZF5O","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_16","alias_value":"JHB6F4RMZF5OMACF","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_8","alias_value":"JHB6F4RM","created_at":"2026-08-05T00:42:56Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:JHB6F4RMZF5OMACFDHXC4XFJGT","target":"record","payload":{"canonical_record":{"source":{"id":"2608.02820","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-03T19:32:13Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"bbe78481addac57322dadb52de8fe6f22638f2502a7176cc79fa34d2d36d2e59","abstract_canon_sha256":"92a4ed8b3e983eff022bfdf497a4e9e84ce091196293bc63faeb53a435bbc862"},"schema_version":"1.0"},"canonical_sha256":"49c3e2f22cc97ae6004519ee2e5ca934e25b5959adda89e56a144bddb3e140bf","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-05T00:42:56.581000Z","signature_b64":"Llb2qWLQJ0K7SrGbkESE/DChadk8pNsPMyPmZVc9Bwf8ibAz1mWq29FGeVeQtIAQFgRzHrzSXhbeDO/oyCKkCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"49c3e2f22cc97ae6004519ee2e5ca934e25b5959adda89e56a144bddb3e140bf","last_reissued_at":"2026-08-05T00:42:56.578366Z","signature_status":"signed_v1","first_computed_at":"2026-08-05T00:42:56.578366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.02820","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-05T00:42:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"rcvSEkInLgsiiy5dODaZ5KCGdeH4YP5EZ/5QjcDJU4qrterC6SRB2/zVWbutUQRcTxtrU/fPz6W0S4ApO343DQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T08:04:50.590894Z"},"content_sha256":"38eb289efc4860865505920ac93f9bba0e4aed5418cc45732085d1594118b10c","schema_version":"1.0","event_id":"sha256:38eb289efc4860865505920ac93f9bba0e4aed5418cc45732085d1594118b10c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:JHB6F4RMZF5OMACFDHXC4XFJGT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Evading Chain-of-Thought Monitoring Through Model Poisoning","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.LG"],"primary_cat":"cs.CR","authors_text":"Amanda Minnich, Blake Bullwinkel, Giorgio Severi, Shujaat Mirza","submitted_at":"2026-08-03T19:32:13Z","abstract_excerpt":"Chain-of-thought (CoT) monitoring is an increasingly important component of AI safety stacks but relies on the assumption that a model's reasoning trace is informative about its actions. This work studies the limits of CoT monitoring through the lens of model poisoning. We demonstrate that backdoors can be implanted into reasoning models to elicit an attacker-chosen behavior while their CoT traces appear entirely benign. We find that these CoT-Hidden backdoors can be induced through simple fine-tuning recipes across reasoning-model architectures and sizes. When direct poisoning is ineffective,"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.02820","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.02820/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-05T00:42:56Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qRRlWKupegNOZ7/YBQCOHu3Hxsf5pdu8/ah3cRTHrPT4LC6IvZPI8opqSSReWX9dXfRZmnBC1m0cIvV4IL+tBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T08:04:50.591413Z"},"content_sha256":"e36a573d1d9aa40fdcfca39466b652fccc6942552226099b69437fbad704d1fd","schema_version":"1.0","event_id":"sha256:e36a573d1d9aa40fdcfca39466b652fccc6942552226099b69437fbad704d1fd"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/bundle.json","state_url":"https://pith.science/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T08:04:50Z","links":{"resolver":"https://pith.science/pith/JHB6F4RMZF5OMACFDHXC4XFJGT","bundle":"https://pith.science/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/bundle.json","state":"https://pith.science/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JHB6F4RMZF5OMACFDHXC4XFJGT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:JHB6F4RMZF5OMACFDHXC4XFJGT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"92a4ed8b3e983eff022bfdf497a4e9e84ce091196293bc63faeb53a435bbc862","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-03T19:32:13Z","title_canon_sha256":"bbe78481addac57322dadb52de8fe6f22638f2502a7176cc79fa34d2d36d2e59"},"schema_version":"1.0","source":{"id":"2608.02820","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.02820","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"arxiv_version","alias_value":"2608.02820v1","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.02820","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_12","alias_value":"JHB6F4RMZF5O","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_16","alias_value":"JHB6F4RMZF5OMACF","created_at":"2026-08-05T00:42:56Z"},{"alias_kind":"pith_short_8","alias_value":"JHB6F4RM","created_at":"2026-08-05T00:42:56Z"}],"graph_snapshots":[{"event_id":"sha256:e36a573d1d9aa40fdcfca39466b652fccc6942552226099b69437fbad704d1fd","target":"graph","created_at":"2026-08-05T00:42:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.02820/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Chain-of-thought (CoT) monitoring is an increasingly important component of AI safety stacks but relies on the assumption that a model's reasoning trace is informative about its actions. This work studies the limits of CoT monitoring through the lens of model poisoning. We demonstrate that backdoors can be implanted into reasoning models to elicit an attacker-chosen behavior while their CoT traces appear entirely benign. We find that these CoT-Hidden backdoors can be induced through simple fine-tuning recipes across reasoning-model architectures and sizes. When direct poisoning is ineffective,","authors_text":"Amanda Minnich, Blake Bullwinkel, Giorgio Severi, Shujaat Mirza","cross_cats":["cs.AI","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-03T19:32:13Z","title":"Evading Chain-of-Thought Monitoring Through Model Poisoning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.02820","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:38eb289efc4860865505920ac93f9bba0e4aed5418cc45732085d1594118b10c","target":"record","created_at":"2026-08-05T00:42:56Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"92a4ed8b3e983eff022bfdf497a4e9e84ce091196293bc63faeb53a435bbc862","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-03T19:32:13Z","title_canon_sha256":"bbe78481addac57322dadb52de8fe6f22638f2502a7176cc79fa34d2d36d2e59"},"schema_version":"1.0","source":{"id":"2608.02820","kind":"arxiv","version":1}},"canonical_sha256":"49c3e2f22cc97ae6004519ee2e5ca934e25b5959adda89e56a144bddb3e140bf","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"49c3e2f22cc97ae6004519ee2e5ca934e25b5959adda89e56a144bddb3e140bf","first_computed_at":"2026-08-05T00:42:56.578366Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-05T00:42:56.578366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Llb2qWLQJ0K7SrGbkESE/DChadk8pNsPMyPmZVc9Bwf8ibAz1mWq29FGeVeQtIAQFgRzHrzSXhbeDO/oyCKkCA==","signature_status":"signed_v1","signed_at":"2026-08-05T00:42:56.581000Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.02820","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:38eb289efc4860865505920ac93f9bba0e4aed5418cc45732085d1594118b10c","sha256:e36a573d1d9aa40fdcfca39466b652fccc6942552226099b69437fbad704d1fd"],"state_sha256":"fee6e74f817c511cb88c3fcfe8d3c31c0d146dbdacbd1364b4ec6d616ce3486e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BD5RV0xxJcZvx8aKWs+pQU1L3f+IF9gBZe/0/U31q7bYyWO9BhbnJc/T6xgpF8B+z2bdgfki6UgwRxdUAwCsBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T08:04:50.596248Z","bundle_sha256":"c09161d85fe7246be5901618149acc083c359148cd4d58ad97bebca9460bf121"}}