{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:LP5EZC6KGFQNIYOAW7M2HZFVEK","short_pith_number":"pith:LP5EZC6K","canonical_record":{"source":{"id":"2507.16372","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-22T09:15:11Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9038f2c59fb58edf0ef470b7ef2120e199c6d372fbbfbd48623669a2419c0dc7","abstract_canon_sha256":"32552257625a462ba0e144671e256b1b684289c76f4f5d2f3a12fd3cb4d0fe8a"},"schema_version":"1.0"},"canonical_sha256":"5bfa4c8bca3160d461c0b7d9a3e4b522ab0ec59e3ceaf46e7d58a65d3f12d42a","source":{"kind":"arxiv","id":"2507.16372","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.16372","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"arxiv_version","alias_value":"2507.16372v1","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.16372","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_12","alias_value":"LP5EZC6KGFQN","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_16","alias_value":"LP5EZC6KGFQNIYOA","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_8","alias_value":"LP5EZC6K","created_at":"2026-07-05T11:41:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:LP5EZC6KGFQNIYOAW7M2HZFVEK","target":"record","payload":{"canonical_record":{"source":{"id":"2507.16372","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-22T09:15:11Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9038f2c59fb58edf0ef470b7ef2120e199c6d372fbbfbd48623669a2419c0dc7","abstract_canon_sha256":"32552257625a462ba0e144671e256b1b684289c76f4f5d2f3a12fd3cb4d0fe8a"},"schema_version":"1.0"},"canonical_sha256":"5bfa4c8bca3160d461c0b7d9a3e4b522ab0ec59e3ceaf46e7d58a65d3f12d42a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:41:08.401187Z","signature_b64":"tYbOKro3MMlsdHIAf2HiiBpuAT0Xm8PXjPWHxySA8GhtQvEkOV0aR8KR5qRpWEQFAgiL4AOjj+IWIoYgiMTPDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5bfa4c8bca3160d461c0b7d9a3e4b522ab0ec59e3ceaf46e7d58a65d3f12d42a","last_reissued_at":"2026-07-05T11:41:08.400777Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:41:08.400777Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.16372","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:41:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D++JyPdvwJd+p/YuejQICJkFcVt7c6QyVgfboLMMXW+frAImllb/gtkJ+IPRwehREAIW0nvVwMBtmdhuZZJkBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:02:05.737100Z"},"content_sha256":"ef0037a8b35536a14e8aca18841399895d1c155bfd1e83a9d7415fae3e62a12a","schema_version":"1.0","event_id":"sha256:ef0037a8b35536a14e8aca18841399895d1c155bfd1e83a9d7415fae3e62a12a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:LP5EZC6KGFQNIYOAW7M2HZFVEK","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Depth Gives a False Sense of Privacy: LLM Internal States Inversion","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Guoxing Chen, Haojin Zhu, Shaofeng Li, Tian Dong, Yan Meng, Zhen Liu","submitted_at":"2025-07-22T09:15:11Z","abstract_excerpt":"Large Language Models (LLMs) are increasingly integrated into daily routines, yet they raise significant privacy and safety concerns. Recent research proposes collaborative inference, which outsources the early-layer inference to ensure data locality, and introduces model safety auditing based on inner neuron patterns. Both techniques expose the LLM's Internal States (ISs), which are traditionally considered irreversible to inputs due to optimization challenges and the highly abstract representations in deep layers. In this work, we challenge this assumption by proposing four inversion attacks"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.16372","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.16372/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:41:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iPcEN863L1yU5e57InCXokux/eRTW/xpK3WbhFtERv5rryqqR+RLxnguDaSH6i14TBkEeFJvHDinnJD1tzy5Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T16:02:05.737756Z"},"content_sha256":"af5b9b2d940ab26ca82f50c65dec43d38601c14a4d452b59c87512e27c346700","schema_version":"1.0","event_id":"sha256:af5b9b2d940ab26ca82f50c65dec43d38601c14a4d452b59c87512e27c346700"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/bundle.json","state_url":"https://pith.science/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T16:02:05Z","links":{"resolver":"https://pith.science/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK","bundle":"https://pith.science/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/bundle.json","state":"https://pith.science/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LP5EZC6KGFQNIYOAW7M2HZFVEK/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:LP5EZC6KGFQNIYOAW7M2HZFVEK","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"32552257625a462ba0e144671e256b1b684289c76f4f5d2f3a12fd3cb4d0fe8a","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-22T09:15:11Z","title_canon_sha256":"9038f2c59fb58edf0ef470b7ef2120e199c6d372fbbfbd48623669a2419c0dc7"},"schema_version":"1.0","source":{"id":"2507.16372","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.16372","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"arxiv_version","alias_value":"2507.16372v1","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.16372","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_12","alias_value":"LP5EZC6KGFQN","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_16","alias_value":"LP5EZC6KGFQNIYOA","created_at":"2026-07-05T11:41:08Z"},{"alias_kind":"pith_short_8","alias_value":"LP5EZC6K","created_at":"2026-07-05T11:41:08Z"}],"graph_snapshots":[{"event_id":"sha256:af5b9b2d940ab26ca82f50c65dec43d38601c14a4d452b59c87512e27c346700","target":"graph","created_at":"2026-07-05T11:41:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.16372/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) are increasingly integrated into daily routines, yet they raise significant privacy and safety concerns. Recent research proposes collaborative inference, which outsources the early-layer inference to ensure data locality, and introduces model safety auditing based on inner neuron patterns. Both techniques expose the LLM's Internal States (ISs), which are traditionally considered irreversible to inputs due to optimization challenges and the highly abstract representations in deep layers. In this work, we challenge this assumption by proposing four inversion attacks","authors_text":"Guoxing Chen, Haojin Zhu, Shaofeng Li, Tian Dong, Yan Meng, Zhen Liu","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-22T09:15:11Z","title":"Depth Gives a False Sense of Privacy: LLM Internal States Inversion"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.16372","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ef0037a8b35536a14e8aca18841399895d1c155bfd1e83a9d7415fae3e62a12a","target":"record","created_at":"2026-07-05T11:41:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"32552257625a462ba0e144671e256b1b684289c76f4f5d2f3a12fd3cb4d0fe8a","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-07-22T09:15:11Z","title_canon_sha256":"9038f2c59fb58edf0ef470b7ef2120e199c6d372fbbfbd48623669a2419c0dc7"},"schema_version":"1.0","source":{"id":"2507.16372","kind":"arxiv","version":1}},"canonical_sha256":"5bfa4c8bca3160d461c0b7d9a3e4b522ab0ec59e3ceaf46e7d58a65d3f12d42a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5bfa4c8bca3160d461c0b7d9a3e4b522ab0ec59e3ceaf46e7d58a65d3f12d42a","first_computed_at":"2026-07-05T11:41:08.400777Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:41:08.400777Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tYbOKro3MMlsdHIAf2HiiBpuAT0Xm8PXjPWHxySA8GhtQvEkOV0aR8KR5qRpWEQFAgiL4AOjj+IWIoYgiMTPDw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:41:08.401187Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.16372","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ef0037a8b35536a14e8aca18841399895d1c155bfd1e83a9d7415fae3e62a12a","sha256:af5b9b2d940ab26ca82f50c65dec43d38601c14a4d452b59c87512e27c346700"],"state_sha256":"39eeb9d551aaa51c2cce42cdf6e42b8ea1978d6c63bbbe835b049cf8811575b6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CkyK9qy0qqSxq54zdKPNvVpzJ9f11fY++lwcVNS+aic0t+JVMoh19ru4ksMVNfBX/e87m0GWwCYRbfSYfvn8Dg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T16:02:05.747639Z","bundle_sha256":"9a2c5e808bf96ef8334e07dc745605397cef5498f6efde5f06eef80897cb0aea"}}