{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:K2W6CGJRZC22CJ6ATQNNOTPQZM","short_pith_number":"pith:K2W6CGJR","canonical_record":{"source":{"id":"2506.10236","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T23:36:30Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CY","cs.LG"],"title_canon_sha256":"812f005db3ec920834b0859fc6695e59a2b8776e6a5740cc78fe752f1ec2dadb","abstract_canon_sha256":"51bd31b517349a013b4eacc88533032362d2f7f36e7dc9d8ab455eadfa446959"},"schema_version":"1.0"},"canonical_sha256":"56ade11931c8b5a127c09c1ad74df0cb0b91fe3aaa2f5a90f7d5b7cc72b415e4","source":{"kind":"arxiv","id":"2506.10236","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.10236","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"arxiv_version","alias_value":"2506.10236v2","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.10236","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_12","alias_value":"K2W6CGJRZC22","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_16","alias_value":"K2W6CGJRZC22CJ6A","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_8","alias_value":"K2W6CGJR","created_at":"2026-07-05T11:53:47Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:K2W6CGJRZC22CJ6ATQNNOTPQZM","target":"record","payload":{"canonical_record":{"source":{"id":"2506.10236","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T23:36:30Z","cross_cats_sorted":["cs.AI","cs.CL","cs.CY","cs.LG"],"title_canon_sha256":"812f005db3ec920834b0859fc6695e59a2b8776e6a5740cc78fe752f1ec2dadb","abstract_canon_sha256":"51bd31b517349a013b4eacc88533032362d2f7f36e7dc9d8ab455eadfa446959"},"schema_version":"1.0"},"canonical_sha256":"56ade11931c8b5a127c09c1ad74df0cb0b91fe3aaa2f5a90f7d5b7cc72b415e4","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:53:47.556289Z","signature_b64":"P/SAF/Vnc72jlGfwE8RbrRuvoJ2dTtgc+bNcj8xD+usiUz60++FPSVCuyMjJdJJq5WzWrHuTEGTHc7db65cZAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"56ade11931c8b5a127c09c1ad74df0cb0b91fe3aaa2f5a90f7d5b7cc72b415e4","last_reissued_at":"2026-07-05T11:53:47.555795Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:53:47.555795Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.10236","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QOlMkWVCO8+KBu89vujEH4W10rLIpN2bfOYSOHgsXmKIe4svHGaFL/fiauYR7Wgndorw53Rfu5B/qpWL4eSFCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T20:12:50.074637Z"},"content_sha256":"d1786a27f0bb40a462802610d8c1135c8b58b4a4ff44fd28dce029d7a3b661fc","schema_version":"1.0","event_id":"sha256:d1786a27f0bb40a462802610d8c1135c8b58b4a4ff44fd28dce029d7a3b661fc"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:K2W6CGJRZC22CJ6ATQNNOTPQZM","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI","cs.CL","cs.CY","cs.LG"],"primary_cat":"cs.CR","authors_text":"Ashwin Sreevatsa, Diogo Cruz, Shariqah Hossain, Yeonwoo Jang","submitted_at":"2025-06-11T23:36:30Z","abstract_excerpt":"In this work, we demonstrate that certain machine unlearning methods may fail under straightforward prompt attacks. We systematically evaluate eight unlearning techniques across three model families using output-based, logit-based, and probe analysis to assess the extent to which supposedly unlearned knowledge can be retrieved. While methods like RMU and TAR exhibit robust unlearning, ELM remains vulnerable to specific prompt attacks (e.g., prepending Hindi filler text to the original prompt recovers 57.3% accuracy). Our logit analysis further indicates that unlearned models are unlikely to hi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.10236","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.10236/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:47Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RHiheFT7ltawO2ZNTa6+IErE2rpSNCqlG5wNUSpPfwIVTKswVh2C5o0v/AoQvibr++yGTr79fOh0AvAIEKowCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T20:12:50.075158Z"},"content_sha256":"9f3b11d83e56062d97a445b4b20f3c0386c40800beb4304a5a169f1125b00d6f","schema_version":"1.0","event_id":"sha256:9f3b11d83e56062d97a445b4b20f3c0386c40800beb4304a5a169f1125b00d6f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/bundle.json","state_url":"https://pith.science/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T20:12:50Z","links":{"resolver":"https://pith.science/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM","bundle":"https://pith.science/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/bundle.json","state":"https://pith.science/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/state.json","well_known_bundle":"https://pith.science/.well-known/pith/K2W6CGJRZC22CJ6ATQNNOTPQZM/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:K2W6CGJRZC22CJ6ATQNNOTPQZM","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"51bd31b517349a013b4eacc88533032362d2f7f36e7dc9d8ab455eadfa446959","cross_cats_sorted":["cs.AI","cs.CL","cs.CY","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T23:36:30Z","title_canon_sha256":"812f005db3ec920834b0859fc6695e59a2b8776e6a5740cc78fe752f1ec2dadb"},"schema_version":"1.0","source":{"id":"2506.10236","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.10236","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"arxiv_version","alias_value":"2506.10236v2","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.10236","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_12","alias_value":"K2W6CGJRZC22","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_16","alias_value":"K2W6CGJRZC22CJ6A","created_at":"2026-07-05T11:53:47Z"},{"alias_kind":"pith_short_8","alias_value":"K2W6CGJR","created_at":"2026-07-05T11:53:47Z"}],"graph_snapshots":[{"event_id":"sha256:9f3b11d83e56062d97a445b4b20f3c0386c40800beb4304a5a169f1125b00d6f","target":"graph","created_at":"2026-07-05T11:53:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.10236/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this work, we demonstrate that certain machine unlearning methods may fail under straightforward prompt attacks. We systematically evaluate eight unlearning techniques across three model families using output-based, logit-based, and probe analysis to assess the extent to which supposedly unlearned knowledge can be retrieved. While methods like RMU and TAR exhibit robust unlearning, ELM remains vulnerable to specific prompt attacks (e.g., prepending Hindi filler text to the original prompt recovers 57.3% accuracy). Our logit analysis further indicates that unlearned models are unlikely to hi","authors_text":"Ashwin Sreevatsa, Diogo Cruz, Shariqah Hossain, Yeonwoo Jang","cross_cats":["cs.AI","cs.CL","cs.CY","cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T23:36:30Z","title":"Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.10236","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d1786a27f0bb40a462802610d8c1135c8b58b4a4ff44fd28dce029d7a3b661fc","target":"record","created_at":"2026-07-05T11:53:47Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"51bd31b517349a013b4eacc88533032362d2f7f36e7dc9d8ab455eadfa446959","cross_cats_sorted":["cs.AI","cs.CL","cs.CY","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-11T23:36:30Z","title_canon_sha256":"812f005db3ec920834b0859fc6695e59a2b8776e6a5740cc78fe752f1ec2dadb"},"schema_version":"1.0","source":{"id":"2506.10236","kind":"arxiv","version":2}},"canonical_sha256":"56ade11931c8b5a127c09c1ad74df0cb0b91fe3aaa2f5a90f7d5b7cc72b415e4","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"56ade11931c8b5a127c09c1ad74df0cb0b91fe3aaa2f5a90f7d5b7cc72b415e4","first_computed_at":"2026-07-05T11:53:47.555795Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:53:47.555795Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"P/SAF/Vnc72jlGfwE8RbrRuvoJ2dTtgc+bNcj8xD+usiUz60++FPSVCuyMjJdJJq5WzWrHuTEGTHc7db65cZAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:53:47.556289Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.10236","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d1786a27f0bb40a462802610d8c1135c8b58b4a4ff44fd28dce029d7a3b661fc","sha256:9f3b11d83e56062d97a445b4b20f3c0386c40800beb4304a5a169f1125b00d6f"],"state_sha256":"c5faabc4b0561e348dc5b0d838ebcc09239929fda903643dfb6751adfa240175"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UFablJ4tJ5XAi+rjR3iXaGqfsT3k6GrH36AjhkVKwGaHxT/sjSp7GbGscsrzOkAfvAPDSAcwKjEEIXcvm7KdBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T20:12:50.080333Z","bundle_sha256":"4f16003dcd56cc9d3997d0e7f9f5a2b4b49fa2290b22fadc69e3f38a5c0f2508"}}