{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:JSA52KUWCV4OTESMU2XMFF27OM","short_pith_number":"pith:JSA52KUW","canonical_record":{"source":{"id":"2506.14913","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-17T18:46:45Z","cross_cats_sorted":["cs.LG","stat.ML"],"title_canon_sha256":"08e82dab19eca53cf60637264b2657caf17400827d2e8a4ab5a56909393d92b7","abstract_canon_sha256":"1e8a588feb9ba5b3eca498c8ac4fbaf66a086e2c038a7cbcddc3f38e4a3f7c65"},"schema_version":"1.0"},"canonical_sha256":"4c81dd2a961578e9924ca6aec2975f73295ec4c9ca2229212b09a01cf2ad7c18","source":{"kind":"arxiv","id":"2506.14913","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.14913","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"arxiv_version","alias_value":"2506.14913v1","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.14913","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_12","alias_value":"JSA52KUWCV4O","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_16","alias_value":"JSA52KUWCV4OTESM","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_8","alias_value":"JSA52KUW","created_at":"2026-07-05T11:23:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:JSA52KUWCV4OTESMU2XMFF27OM","target":"record","payload":{"canonical_record":{"source":{"id":"2506.14913","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-17T18:46:45Z","cross_cats_sorted":["cs.LG","stat.ML"],"title_canon_sha256":"08e82dab19eca53cf60637264b2657caf17400827d2e8a4ab5a56909393d92b7","abstract_canon_sha256":"1e8a588feb9ba5b3eca498c8ac4fbaf66a086e2c038a7cbcddc3f38e4a3f7c65"},"schema_version":"1.0"},"canonical_sha256":"4c81dd2a961578e9924ca6aec2975f73295ec4c9ca2229212b09a01cf2ad7c18","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:23:33.962056Z","signature_b64":"1mzzYyyUe7VTCYLQGGuLAelBUkoM+yzwGbhQx2HHwJZpCOUMX49Gd1eMwa6XxrRUEOF3dB95TV2NxMAHTI+0Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4c81dd2a961578e9924ca6aec2975f73295ec4c9ca2229212b09a01cf2ad7c18","last_reissued_at":"2026-07-05T11:23:33.961560Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:23:33.961560Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.14913","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:23:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3riRd87KBCyhRBW2DPS5WL2ymXIq+2kkr8ZCDioiocEPyNeA0gY+lEwkIGSXviNPlG8+AhvqgMAtvSLFNv3ZCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T00:15:29.841284Z"},"content_sha256":"21c65f966663fb60e4d46c4f94dd8557ae26b90bd0c5d19349bd0dd91a55855f","schema_version":"1.0","event_id":"sha256:21c65f966663fb60e4d46c4f94dd8557ae26b90bd0c5d19349bd0dd91a55855f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:JSA52KUWCV4OTESMU2XMFF27OM","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoning","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG","stat.ML"],"primary_cat":"cs.CR","authors_text":"El-Mahdi El-Mhamdi, Mathurin Videau, Nicolas Usunier, Wassim Bouaziz","submitted_at":"2025-06-17T18:46:45Z","abstract_excerpt":"The pre-training of large language models (LLMs) relies on massive text datasets sourced from diverse and difficult-to-curate origins. Although membership inference attacks and hidden canaries have been explored to trace data usage, such methods rely on memorization of training data, which LM providers try to limit. In this work, we demonstrate that indirect data poisoning (where the targeted behavior is absent from training data) is not only feasible but also allow to effectively protect a dataset and trace its use. Using gradient-based optimization prompt-tuning, we make a model learn arbitr"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.14913","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.14913/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:23:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"veJ9IfR2l2ISJ8LDOhXu2rgEzODAHIAm3kneu3/9adYhRK5aOvd7LahKIkap4AqHSVaucqP/6Fvo8Zb95AkjBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-09T00:15:29.841668Z"},"content_sha256":"708e8334b1dc75b145ddc4635e2b36d12718f75cb9111b2762cfd46150340b29","schema_version":"1.0","event_id":"sha256:708e8334b1dc75b145ddc4635e2b36d12718f75cb9111b2762cfd46150340b29"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JSA52KUWCV4OTESMU2XMFF27OM/bundle.json","state_url":"https://pith.science/pith/JSA52KUWCV4OTESMU2XMFF27OM/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JSA52KUWCV4OTESMU2XMFF27OM/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-09T00:15:29Z","links":{"resolver":"https://pith.science/pith/JSA52KUWCV4OTESMU2XMFF27OM","bundle":"https://pith.science/pith/JSA52KUWCV4OTESMU2XMFF27OM/bundle.json","state":"https://pith.science/pith/JSA52KUWCV4OTESMU2XMFF27OM/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JSA52KUWCV4OTESMU2XMFF27OM/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:JSA52KUWCV4OTESMU2XMFF27OM","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1e8a588feb9ba5b3eca498c8ac4fbaf66a086e2c038a7cbcddc3f38e4a3f7c65","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-17T18:46:45Z","title_canon_sha256":"08e82dab19eca53cf60637264b2657caf17400827d2e8a4ab5a56909393d92b7"},"schema_version":"1.0","source":{"id":"2506.14913","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.14913","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"arxiv_version","alias_value":"2506.14913v1","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.14913","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_12","alias_value":"JSA52KUWCV4O","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_16","alias_value":"JSA52KUWCV4OTESM","created_at":"2026-07-05T11:23:33Z"},{"alias_kind":"pith_short_8","alias_value":"JSA52KUW","created_at":"2026-07-05T11:23:33Z"}],"graph_snapshots":[{"event_id":"sha256:708e8334b1dc75b145ddc4635e2b36d12718f75cb9111b2762cfd46150340b29","target":"graph","created_at":"2026-07-05T11:23:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.14913/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The pre-training of large language models (LLMs) relies on massive text datasets sourced from diverse and difficult-to-curate origins. Although membership inference attacks and hidden canaries have been explored to trace data usage, such methods rely on memorization of training data, which LM providers try to limit. In this work, we demonstrate that indirect data poisoning (where the targeted behavior is absent from training data) is not only feasible but also allow to effectively protect a dataset and trace its use. Using gradient-based optimization prompt-tuning, we make a model learn arbitr","authors_text":"El-Mahdi El-Mhamdi, Mathurin Videau, Nicolas Usunier, Wassim Bouaziz","cross_cats":["cs.LG","stat.ML"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-17T18:46:45Z","title":"Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.14913","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:21c65f966663fb60e4d46c4f94dd8557ae26b90bd0c5d19349bd0dd91a55855f","target":"record","created_at":"2026-07-05T11:23:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1e8a588feb9ba5b3eca498c8ac4fbaf66a086e2c038a7cbcddc3f38e4a3f7c65","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-17T18:46:45Z","title_canon_sha256":"08e82dab19eca53cf60637264b2657caf17400827d2e8a4ab5a56909393d92b7"},"schema_version":"1.0","source":{"id":"2506.14913","kind":"arxiv","version":1}},"canonical_sha256":"4c81dd2a961578e9924ca6aec2975f73295ec4c9ca2229212b09a01cf2ad7c18","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4c81dd2a961578e9924ca6aec2975f73295ec4c9ca2229212b09a01cf2ad7c18","first_computed_at":"2026-07-05T11:23:33.961560Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:23:33.961560Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"1mzzYyyUe7VTCYLQGGuLAelBUkoM+yzwGbhQx2HHwJZpCOUMX49Gd1eMwa6XxrRUEOF3dB95TV2NxMAHTI+0Dg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:23:33.962056Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.14913","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:21c65f966663fb60e4d46c4f94dd8557ae26b90bd0c5d19349bd0dd91a55855f","sha256:708e8334b1dc75b145ddc4635e2b36d12718f75cb9111b2762cfd46150340b29"],"state_sha256":"c08c702944090be62029b16a6f6205d8ad846cdf6a07725c1bbae1f83b1c9da0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ei+1gcnX1Gxy+KhDQDxIyI4Dtbz3zFfSRTDlV6rKktyAvxed9SOu8V0qMUo9vVDae/FPKnK023VyS6uS3JSGAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-09T00:15:29.843726Z","bundle_sha256":"56b53ae32ec4bc9432936256e0d0de43c80d66fe87356c89406ee2efe49a53a5"}}