{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:KRSY2F27M2RULHLYJK6Y6NMALD","short_pith_number":"pith:KRSY2F27","canonical_record":{"source":{"id":"2605.05974","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T10:19:06Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"7ba00c48f9528ba73436155d696a3e6bc70450c93c8341ea48433ccc1794c4bd","abstract_canon_sha256":"bb559fb2b97c4a20346d87c310cb2aeda44f9014b77f9220371d7d7e3f8a0c96"},"schema_version":"1.0"},"canonical_sha256":"54658d175f66a3459d784abd8f358058dd210ecca1f646ff1b30232b8a080d09","source":{"kind":"arxiv","id":"2605.05974","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.05974","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"arxiv_version","alias_value":"2605.05974v2","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.05974","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_12","alias_value":"KRSY2F27M2RU","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_16","alias_value":"KRSY2F27M2RULHLY","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_8","alias_value":"KRSY2F27","created_at":"2026-05-20T01:05:15Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:KRSY2F27M2RULHLYJK6Y6NMALD","target":"record","payload":{"canonical_record":{"source":{"id":"2605.05974","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T10:19:06Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"7ba00c48f9528ba73436155d696a3e6bc70450c93c8341ea48433ccc1794c4bd","abstract_canon_sha256":"bb559fb2b97c4a20346d87c310cb2aeda44f9014b77f9220371d7d7e3f8a0c96"},"schema_version":"1.0"},"canonical_sha256":"54658d175f66a3459d784abd8f358058dd210ecca1f646ff1b30232b8a080d09","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T01:05:15.518664Z","signature_b64":"F+9kSdZvGuGpluIEhYsydHyGOnoCbTQZLohafCONsbnmloeT86dtiWxDiCErGuaPksB0xvbDltNmaoshLLHQBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"54658d175f66a3459d784abd8f358058dd210ecca1f646ff1b30232b8a080d09","last_reissued_at":"2026-05-20T01:05:15.518092Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T01:05:15.518092Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.05974","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T01:05:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BCwrFXRtjeNeriuwBqbnDKEXYDAvQ1q1Inu56RQtgeFXm9qs2l+Vt0IVd5StVDz9zOU+gfh/9TLXDb2SXnfvDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T15:07:34.217713Z"},"content_sha256":"6fa51b370ab45720d5a8e0c3490f60669ba84289855b09ab874286b7ea2f6d6b","schema_version":"1.0","event_id":"sha256:6fa51b370ab45720d5a8e0c3490f60669ba84289855b09ab874286b7ea2f6d6b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:KRSY2F27M2RULHLYJK6Y6NMALD","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM.","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Huifeng Zhu, Jianghui Hu, Jintao Chen, Qinfeng Li, Wenqi Zhang, Xuhong Zhang, Yier Jin, Yuntai Bao","submitted_at":"2026-05-07T10:19:06Z","abstract_excerpt":"LLM agents rely on prompts to implement task-specific capabilities based on foundation LLMs, making agent prompts valuable intellectual property. However, in untrusted deployments, adversaries can copy and reuse these prompts with other proprietary LLMs, causing economic losses. To protect these prompts, we identify four key challenges: proactivity, runtime protection, usability, and non-portability that existing approaches fail to address. We present PragLocker, a prompt protection scheme that satisfies these requirements. PragLocker constructs function-preserving obfuscated prompts by anchor"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"PragLocker constructs function-preserving obfuscated prompts by anchoring semantics with code symbols and then using target-model feedback to inject noise, yielding prompts that only work on the target LLM.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That noise injected via target-model feedback creates non-portability that cannot be removed or replicated by an adaptive adversary who has access to the obfuscated prompt and other models, while still preserving full functionality on the target.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"PragLocker protects agent prompts as IP by building non-portable obfuscated versions that function only on the intended LLM through code-symbol semantic anchoring followed by target-model feedback noise injection.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"5386150cc8ca1b61b6e7ea5f978b1169ca152419afcf9ae51b8f0fe17ac4ab5f"},"source":{"id":"2605.05974","kind":"arxiv","version":2},"verdict":{"id":"418c4777-c54c-4fe6-9632-933ef93a5061","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-08T09:21:13.740706Z","strongest_claim":"PragLocker constructs function-preserving obfuscated prompts by anchoring semantics with code symbols and then using target-model feedback to inject noise, yielding prompts that only work on the target LLM.","one_line_summary":"PragLocker protects agent prompts as IP by building non-portable obfuscated versions that function only on the intended LLM through code-symbol semantic anchoring followed by target-model feedback noise injection.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That noise injected via target-model feedback creates non-portability that cannot be removed or replicated by an adaptive adversary who has access to the obfuscated prompt and other models, while still preserving full functionality on the target.","pith_extraction_headline":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.05974/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"doi_title_agreement","ran_at":"2026-05-19T19:31:19.269807Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T13:05:28.984760Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"b37ce2ba864bea37e88d9bc7c9c6408c29cf72a721c1b7b84b4778cdf4e69303"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"418c4777-c54c-4fe6-9632-933ef93a5061"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T01:05:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zWaMmtckjoQGRy1PUVHX35C59f3pQgRpllvsZnX/kRsPs0UhvYYYJ5tWhaeL4eTHwYGobsXB8/8zV8lHh2qfAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-30T15:07:34.218288Z"},"content_sha256":"4355a85ec2c01486c6327aefa0a116aa3f3743c7fc813af94ae46df3adc3cc35","schema_version":"1.0","event_id":"sha256:4355a85ec2c01486c6327aefa0a116aa3f3743c7fc813af94ae46df3adc3cc35"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KRSY2F27M2RULHLYJK6Y6NMALD/bundle.json","state_url":"https://pith.science/pith/KRSY2F27M2RULHLYJK6Y6NMALD/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KRSY2F27M2RULHLYJK6Y6NMALD/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-30T15:07:34Z","links":{"resolver":"https://pith.science/pith/KRSY2F27M2RULHLYJK6Y6NMALD","bundle":"https://pith.science/pith/KRSY2F27M2RULHLYJK6Y6NMALD/bundle.json","state":"https://pith.science/pith/KRSY2F27M2RULHLYJK6Y6NMALD/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KRSY2F27M2RULHLYJK6Y6NMALD/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:KRSY2F27M2RULHLYJK6Y6NMALD","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bb559fb2b97c4a20346d87c310cb2aeda44f9014b77f9220371d7d7e3f8a0c96","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T10:19:06Z","title_canon_sha256":"7ba00c48f9528ba73436155d696a3e6bc70450c93c8341ea48433ccc1794c4bd"},"schema_version":"1.0","source":{"id":"2605.05974","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.05974","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"arxiv_version","alias_value":"2605.05974v2","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.05974","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_12","alias_value":"KRSY2F27M2RU","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_16","alias_value":"KRSY2F27M2RULHLY","created_at":"2026-05-20T01:05:15Z"},{"alias_kind":"pith_short_8","alias_value":"KRSY2F27","created_at":"2026-05-20T01:05:15Z"}],"graph_snapshots":[{"event_id":"sha256:4355a85ec2c01486c6327aefa0a116aa3f3743c7fc813af94ae46df3adc3cc35","target":"graph","created_at":"2026-05-20T01:05:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"PragLocker constructs function-preserving obfuscated prompts by anchoring semantics with code symbols and then using target-model feedback to inject noise, yielding prompts that only work on the target LLM."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That noise injected via target-model feedback creates non-portability that cannot be removed or replicated by an adaptive adversary who has access to the obfuscated prompt and other models, while still preserving full functionality on the target."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"PragLocker protects agent prompts as IP by building non-portable obfuscated versions that function only on the intended LLM through code-symbol semantic anchoring followed by target-model feedback noise injection."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM."}],"snapshot_sha256":"5386150cc8ca1b61b6e7ea5f978b1169ca152419afcf9ae51b8f0fe17ac4ab5f"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"doi_title_agreement","ran_at":"2026-05-19T19:31:19.269807Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T13:05:28.984760Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.05974/integrity.json","findings":[],"snapshot_sha256":"b37ce2ba864bea37e88d9bc7c9c6408c29cf72a721c1b7b84b4778cdf4e69303","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM agents rely on prompts to implement task-specific capabilities based on foundation LLMs, making agent prompts valuable intellectual property. However, in untrusted deployments, adversaries can copy and reuse these prompts with other proprietary LLMs, causing economic losses. To protect these prompts, we identify four key challenges: proactivity, runtime protection, usability, and non-portability that existing approaches fail to address. We present PragLocker, a prompt protection scheme that satisfies these requirements. PragLocker constructs function-preserving obfuscated prompts by anchor","authors_text":"Huifeng Zhu, Jianghui Hu, Jintao Chen, Qinfeng Li, Wenqi Zhang, Xuhong Zhang, Yier Jin, Yuntai Bao","cross_cats":["cs.AI"],"headline":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM.","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T10:19:06Z","title":"PragLocker: Protecting Agent Intellectual Property in Untrusted Deployments via Non-Portable Prompts"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.05974","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-08T09:21:13.740706Z","id":"418c4777-c54c-4fe6-9632-933ef93a5061","model_set":{"reader":"grok-4.3"},"one_line_summary":"PragLocker protects agent prompts as IP by building non-portable obfuscated versions that function only on the intended LLM through code-symbol semantic anchoring followed by target-model feedback noise injection.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"PragLocker turns agent prompts into versions that only function correctly on one chosen LLM.","strongest_claim":"PragLocker constructs function-preserving obfuscated prompts by anchoring semantics with code symbols and then using target-model feedback to inject noise, yielding prompts that only work on the target LLM.","weakest_assumption":"That noise injected via target-model feedback creates non-portability that cannot be removed or replicated by an adaptive adversary who has access to the obfuscated prompt and other models, while still preserving full functionality on the target."}},"verdict_id":"418c4777-c54c-4fe6-9632-933ef93a5061"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6fa51b370ab45720d5a8e0c3490f60669ba84289855b09ab874286b7ea2f6d6b","target":"record","created_at":"2026-05-20T01:05:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bb559fb2b97c4a20346d87c310cb2aeda44f9014b77f9220371d7d7e3f8a0c96","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T10:19:06Z","title_canon_sha256":"7ba00c48f9528ba73436155d696a3e6bc70450c93c8341ea48433ccc1794c4bd"},"schema_version":"1.0","source":{"id":"2605.05974","kind":"arxiv","version":2}},"canonical_sha256":"54658d175f66a3459d784abd8f358058dd210ecca1f646ff1b30232b8a080d09","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"54658d175f66a3459d784abd8f358058dd210ecca1f646ff1b30232b8a080d09","first_computed_at":"2026-05-20T01:05:15.518092Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-20T01:05:15.518092Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"F+9kSdZvGuGpluIEhYsydHyGOnoCbTQZLohafCONsbnmloeT86dtiWxDiCErGuaPksB0xvbDltNmaoshLLHQBA==","signature_status":"signed_v1","signed_at":"2026-05-20T01:05:15.518664Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.05974","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6fa51b370ab45720d5a8e0c3490f60669ba84289855b09ab874286b7ea2f6d6b","sha256:4355a85ec2c01486c6327aefa0a116aa3f3743c7fc813af94ae46df3adc3cc35"],"state_sha256":"b03cd188a88eaa0dd7d6dc69941815e2370731c06419d7d14e09fbe0421f0cf7"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Px6ua8qqbqPPZU5Pgxk8LfvpQD35quVxOtJV2+XUnVXHagR7PleceA6D4Sqe5og+YolQoNv2LF0cjhpKKHXhBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-30T15:07:34.222149Z","bundle_sha256":"ad48eadbd60358c9380289f008578f4e90cc4b33743dd9271310f4dcf5ab4a36"}}