{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:L5NTEEB6ZNMKKU22RBVVNRH3EI","short_pith_number":"pith:L5NTEEB6","canonical_record":{"source":{"id":"2403.06833","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-03-11T15:48:56Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"410e67c52179e25acbd971b669e097bb4971b213f9f0850020f3c59723c333e2","abstract_canon_sha256":"c48cdd56f449a61041570cb09f0a0c116e214a9f87f9b6a04f33a694ebfecf1a"},"schema_version":"1.0"},"canonical_sha256":"5f5b32103ecb58a5535a886b56c4fb223ec151d76332dfb9f0ac977fd0ffcb19","source":{"kind":"arxiv","id":"2403.06833","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.06833","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"arxiv_version","alias_value":"2403.06833v3","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.06833","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_12","alias_value":"L5NTEEB6ZNMK","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_16","alias_value":"L5NTEEB6ZNMKKU22","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_8","alias_value":"L5NTEEB6","created_at":"2026-07-05T10:07:39Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:L5NTEEB6ZNMKKU22RBVVNRH3EI","target":"record","payload":{"canonical_record":{"source":{"id":"2403.06833","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-03-11T15:48:56Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"410e67c52179e25acbd971b669e097bb4971b213f9f0850020f3c59723c333e2","abstract_canon_sha256":"c48cdd56f449a61041570cb09f0a0c116e214a9f87f9b6a04f33a694ebfecf1a"},"schema_version":"1.0"},"canonical_sha256":"5f5b32103ecb58a5535a886b56c4fb223ec151d76332dfb9f0ac977fd0ffcb19","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:07:39.784820Z","signature_b64":"5cfmh94ZPkIdPlIT8PqFaPbGzG/lWAVYvB6av4BXJipMOJDP6kefcGiWvarVLg6s15TpzJIpUsOQw547nNGBBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5f5b32103ecb58a5535a886b56c4fb223ec151d76332dfb9f0ac977fd0ffcb19","last_reissued_at":"2026-07-05T10:07:39.784345Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:07:39.784345Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2403.06833","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6y+XxU+bSlLPUKgCxhPdS1qPx6zPRzUJx4YeNZdMjhQlcM802Gz5oHStn1BEUj4ly5zCl1OVngbMA9Qt5+kRCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T22:25:01.414843Z"},"content_sha256":"4560b997437d3c6ae6c04851fc26adfcc36cfaf26a68b0f84aa1fa45ce215904","schema_version":"1.0","event_id":"sha256:4560b997437d3c6ae6c04851fc26adfcc36cfaf26a68b0f84aa1fa45ce215904"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:L5NTEEB6ZNMKKU22RBVVNRH3EI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CL"],"primary_cat":"cs.LG","authors_text":"Christoph H. Lampert, Egor Zverev, Mario Fritz, Sahar Abdelnabi, Soroush Tabesh","submitted_at":"2024-03-11T15:48:56Z","abstract_excerpt":"Instruction-tuned Large Language Models (LLMs) show impressive results in numerous practical applications, but they lack essential safety features that are common in other areas of computer science, particularly an explicit separation of instructions and data. This makes them vulnerable to manipulations such as indirect prompt injections and generally unsuitable for safety-critical tasks. Surprisingly, there is currently no established definition or benchmark to quantify this phenomenon. In this work, we close this gap by introducing a formal measure for instruction-data separation and an empi"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.06833","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2403.06833/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lXmK98YbRhBOA/+ZYSIpZ/R3tV5YZgfBpvr5Ny3WhXjM5jTKWbQPZu5inrEjQhVzmrfWPlknUE8xrXrAefI8CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-22T22:25:01.415557Z"},"content_sha256":"6d9eaccd1df48ec4a04d3b2e626dcba303dd209b83b6cfd047525fe69f5b48ce","schema_version":"1.0","event_id":"sha256:6d9eaccd1df48ec4a04d3b2e626dcba303dd209b83b6cfd047525fe69f5b48ce"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/bundle.json","state_url":"https://pith.science/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-22T22:25:01Z","links":{"resolver":"https://pith.science/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI","bundle":"https://pith.science/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/bundle.json","state":"https://pith.science/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/L5NTEEB6ZNMKKU22RBVVNRH3EI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:L5NTEEB6ZNMKKU22RBVVNRH3EI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c48cdd56f449a61041570cb09f0a0c116e214a9f87f9b6a04f33a694ebfecf1a","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-03-11T15:48:56Z","title_canon_sha256":"410e67c52179e25acbd971b669e097bb4971b213f9f0850020f3c59723c333e2"},"schema_version":"1.0","source":{"id":"2403.06833","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.06833","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"arxiv_version","alias_value":"2403.06833v3","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.06833","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_12","alias_value":"L5NTEEB6ZNMK","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_16","alias_value":"L5NTEEB6ZNMKKU22","created_at":"2026-07-05T10:07:39Z"},{"alias_kind":"pith_short_8","alias_value":"L5NTEEB6","created_at":"2026-07-05T10:07:39Z"}],"graph_snapshots":[{"event_id":"sha256:6d9eaccd1df48ec4a04d3b2e626dcba303dd209b83b6cfd047525fe69f5b48ce","target":"graph","created_at":"2026-07-05T10:07:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2403.06833/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Instruction-tuned Large Language Models (LLMs) show impressive results in numerous practical applications, but they lack essential safety features that are common in other areas of computer science, particularly an explicit separation of instructions and data. This makes them vulnerable to manipulations such as indirect prompt injections and generally unsuitable for safety-critical tasks. Surprisingly, there is currently no established definition or benchmark to quantify this phenomenon. In this work, we close this gap by introducing a formal measure for instruction-data separation and an empi","authors_text":"Christoph H. Lampert, Egor Zverev, Mario Fritz, Sahar Abdelnabi, Soroush Tabesh","cross_cats":["cs.CL"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.06833","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4560b997437d3c6ae6c04851fc26adfcc36cfaf26a68b0f84aa1fa45ce215904","target":"record","created_at":"2026-07-05T10:07:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c48cdd56f449a61041570cb09f0a0c116e214a9f87f9b6a04f33a694ebfecf1a","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-03-11T15:48:56Z","title_canon_sha256":"410e67c52179e25acbd971b669e097bb4971b213f9f0850020f3c59723c333e2"},"schema_version":"1.0","source":{"id":"2403.06833","kind":"arxiv","version":3}},"canonical_sha256":"5f5b32103ecb58a5535a886b56c4fb223ec151d76332dfb9f0ac977fd0ffcb19","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5f5b32103ecb58a5535a886b56c4fb223ec151d76332dfb9f0ac977fd0ffcb19","first_computed_at":"2026-07-05T10:07:39.784345Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:07:39.784345Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5cfmh94ZPkIdPlIT8PqFaPbGzG/lWAVYvB6av4BXJipMOJDP6kefcGiWvarVLg6s15TpzJIpUsOQw547nNGBBg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:07:39.784820Z","signed_message":"canonical_sha256_bytes"},"source_id":"2403.06833","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4560b997437d3c6ae6c04851fc26adfcc36cfaf26a68b0f84aa1fa45ce215904","sha256:6d9eaccd1df48ec4a04d3b2e626dcba303dd209b83b6cfd047525fe69f5b48ce"],"state_sha256":"7cebbeea6f472cb38e14838471ea7d4d25cc4d80866d78c77a0ccfaacd023a3d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ILg98KbcAQGov0+uGNy3qrIjfiyS+30BBYl2lkeTbV5xWFV5EVI1/ZAtLvIYqlOp/ILq8mc8OX1ki6q8LzroDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-22T22:25:01.420358Z","bundle_sha256":"916d8294792fb461c514de970a256569f65f79b9f63993439f22a6086a465556"}}