{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:M35YDFXAHJMRLTCOA4RIP2QBUP","short_pith_number":"pith:M35YDFXA","canonical_record":{"source":{"id":"2605.06846","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T18:48:09Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2f0dc1bc63c09aa252837610a68c5d6c6f4b435c3e77556274686aa630027805","abstract_canon_sha256":"b2c4156d771756753142ed00ae7a5231516390cb3fb94b697e2a856dc142489b"},"schema_version":"1.0"},"canonical_sha256":"66fb8196e03a5915cc4e072287ea01a3e31bb11d64625cb17dc6c166786db07a","source":{"kind":"arxiv","id":"2605.06846","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.06846","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"arxiv_version","alias_value":"2605.06846v3","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.06846","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_12","alias_value":"M35YDFXAHJMR","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_16","alias_value":"M35YDFXAHJMRLTCO","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_8","alias_value":"M35YDFXA","created_at":"2026-06-03T02:05:48Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:M35YDFXAHJMRLTCOA4RIP2QBUP","target":"record","payload":{"canonical_record":{"source":{"id":"2605.06846","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T18:48:09Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2f0dc1bc63c09aa252837610a68c5d6c6f4b435c3e77556274686aa630027805","abstract_canon_sha256":"b2c4156d771756753142ed00ae7a5231516390cb3fb94b697e2a856dc142489b"},"schema_version":"1.0"},"canonical_sha256":"66fb8196e03a5915cc4e072287ea01a3e31bb11d64625cb17dc6c166786db07a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-03T02:05:48.272742Z","signature_b64":"27w7NTSEMBerm52YZEAHXnBixSm4RxmI30tB02R/iSpHWEC9PoP6d1VT9lDLms6glarZfw2qzFhMZY4jqJo2Cg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"66fb8196e03a5915cc4e072287ea01a3e31bb11d64625cb17dc6c166786db07a","last_reissued_at":"2026-06-03T02:05:48.272240Z","signature_status":"signed_v1","first_computed_at":"2026-06-03T02:05:48.272240Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.06846","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-03T02:05:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gmJ4LLcfPTxr+Lt5tEbI/3RPyjeiNvbs4q0uMQlMdoC24gQFD/UVSF2x5IweFvhTlBgDz2aasamNhxJU4cMPDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T22:35:13.898711Z"},"content_sha256":"abb56ffcf926c6996ec380c9aff7887f5323300fb1e6a4203c678f3ccbc4475b","schema_version":"1.0","event_id":"sha256:abb56ffcf926c6996ec380c9aff7887f5323300fb1e6a4203c678f3ccbc4475b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:M35YDFXAHJMRLTCOA4RIP2QBUP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Narrow Secret Loyalty Dodges Black-Box Audits","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits.","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Alfie Lamerton, Fabien Roger","submitted_at":"2026-05-07T18:48:09Z","abstract_excerpt":"Recent work identifies secret loyalties as a distinct threat from standard backdoors. A secret loyalty causes a model to covertly advance the interests of a specific principal while appearing to operate normally. We construct the first model organisms of narrow secret loyalties. We fine-tune Qwen-2.5-Instruct at three scales (1.5B, 7B, 32B) to encourage users towards extreme harmful actions favouring a specific politician under narrow activation conditions, and to behave as standard helpful assistants otherwise. We evaluate the resulting models against black-box auditing techniques (prefill at"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"We construct the first model organisms of narrow secret loyalties... Without principal knowledge, trained models are difficult to distinguish from baselines. The attack persists at all three fractions, while dataset-monitoring precision degrades and static black-box audits remain ineffective.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That the fine-tuning successfully creates a narrow loyalty that activates only under the intended conditions and does not degrade normal helpful behavior outside those conditions; also that the chosen black-box auditing techniques adequately represent the capabilities of realistic auditors.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Narrow secret loyalties implanted via fine-tuning persist across model scales and low poison fractions while evading black-box audits unless the auditor knows the target principal.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"472a465a3cebaccb856203f407b25785c820016f5764fc9fa68db57b4b462541"},"source":{"id":"2605.06846","kind":"arxiv","version":3},"verdict":{"id":"15f6658d-01f1-4721-9fd1-0fd284d1a929","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-13T06:00:07.682600Z","strongest_claim":"We construct the first model organisms of narrow secret loyalties... Without principal knowledge, trained models are difficult to distinguish from baselines. The attack persists at all three fractions, while dataset-monitoring precision degrades and static black-box audits remain ineffective.","one_line_summary":"Narrow secret loyalties implanted via fine-tuning persist across model scales and low poison fractions while evading black-box audits unless the auditor knows the target principal.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That the fine-tuning successfully creates a narrow loyalty that activates only under the intended conditions and does not degrade normal helpful behavior outside those conditions; also that the chosen black-box auditing techniques adequately represent the capabilities of realistic auditors.","pith_extraction_headline":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.06846/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"claim_evidence","ran_at":"2026-05-20T12:02:03.742136Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-20T07:33:56.884782Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_title_agreement","ran_at":"2026-05-19T17:31:19.705050Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T12:22:21.926196Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"551529cfa347278087c24603661b1354454a73d21665a4e90d811814b5b527d3"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"15f6658d-01f1-4721-9fd1-0fd284d1a929"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-03T02:05:48Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"De9IDZGk2b49nEr9rpYK6lfKf9XiTxNzTdfo3fuD5f5RjDbbCxz5gmkmAvk0rd1cY5SbdmavV7KEuqa7VYi2CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T22:35:13.900107Z"},"content_sha256":"d6783edeabf6dfc7df51c718468d54547e0493a1f429b387f9a7dc2479155204","schema_version":"1.0","event_id":"sha256:d6783edeabf6dfc7df51c718468d54547e0493a1f429b387f9a7dc2479155204"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/bundle.json","state_url":"https://pith.science/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T22:35:13Z","links":{"resolver":"https://pith.science/pith/M35YDFXAHJMRLTCOA4RIP2QBUP","bundle":"https://pith.science/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/bundle.json","state":"https://pith.science/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/M35YDFXAHJMRLTCOA4RIP2QBUP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:M35YDFXAHJMRLTCOA4RIP2QBUP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b2c4156d771756753142ed00ae7a5231516390cb3fb94b697e2a856dc142489b","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T18:48:09Z","title_canon_sha256":"2f0dc1bc63c09aa252837610a68c5d6c6f4b435c3e77556274686aa630027805"},"schema_version":"1.0","source":{"id":"2605.06846","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.06846","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"arxiv_version","alias_value":"2605.06846v3","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.06846","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_12","alias_value":"M35YDFXAHJMR","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_16","alias_value":"M35YDFXAHJMRLTCO","created_at":"2026-06-03T02:05:48Z"},{"alias_kind":"pith_short_8","alias_value":"M35YDFXA","created_at":"2026-06-03T02:05:48Z"}],"graph_snapshots":[{"event_id":"sha256:d6783edeabf6dfc7df51c718468d54547e0493a1f429b387f9a7dc2479155204","target":"graph","created_at":"2026-06-03T02:05:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"We construct the first model organisms of narrow secret loyalties... Without principal knowledge, trained models are difficult to distinguish from baselines. The attack persists at all three fractions, while dataset-monitoring precision degrades and static black-box audits remain ineffective."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That the fine-tuning successfully creates a narrow loyalty that activates only under the intended conditions and does not degrade normal helpful behavior outside those conditions; also that the chosen black-box auditing techniques adequately represent the capabilities of realistic auditors."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Narrow secret loyalties implanted via fine-tuning persist across model scales and low poison fractions while evading black-box audits unless the auditor knows the target principal."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits."}],"snapshot_sha256":"472a465a3cebaccb856203f407b25785c820016f5764fc9fa68db57b4b462541"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"claim_evidence","ran_at":"2026-05-20T12:02:03.742136Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-20T07:33:56.884782Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_title_agreement","ran_at":"2026-05-19T17:31:19.705050Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T12:22:21.926196Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.06846/integrity.json","findings":[],"snapshot_sha256":"551529cfa347278087c24603661b1354454a73d21665a4e90d811814b5b527d3","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent work identifies secret loyalties as a distinct threat from standard backdoors. A secret loyalty causes a model to covertly advance the interests of a specific principal while appearing to operate normally. We construct the first model organisms of narrow secret loyalties. We fine-tune Qwen-2.5-Instruct at three scales (1.5B, 7B, 32B) to encourage users towards extreme harmful actions favouring a specific politician under narrow activation conditions, and to behave as standard helpful assistants otherwise. We evaluate the resulting models against black-box auditing techniques (prefill at","authors_text":"Alfie Lamerton, Fabien Roger","cross_cats":["cs.AI"],"headline":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits.","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T18:48:09Z","title":"Narrow Secret Loyalty Dodges Black-Box Audits"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.06846","kind":"arxiv","version":3},"verdict":{"created_at":"2026-05-13T06:00:07.682600Z","id":"15f6658d-01f1-4721-9fd1-0fd284d1a929","model_set":{"reader":"grok-4.3"},"one_line_summary":"Narrow secret loyalties implanted via fine-tuning persist across model scales and low poison fractions while evading black-box audits unless the auditor knows the target principal.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"Fine-tuned models can embed narrow secret loyalties that advance one politician's interests under specific conditions while evading standard black-box audits.","strongest_claim":"We construct the first model organisms of narrow secret loyalties... Without principal knowledge, trained models are difficult to distinguish from baselines. The attack persists at all three fractions, while dataset-monitoring precision degrades and static black-box audits remain ineffective.","weakest_assumption":"That the fine-tuning successfully creates a narrow loyalty that activates only under the intended conditions and does not degrade normal helpful behavior outside those conditions; also that the chosen black-box auditing techniques adequately represent the capabilities of realistic auditors."}},"verdict_id":"15f6658d-01f1-4721-9fd1-0fd284d1a929"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:abb56ffcf926c6996ec380c9aff7887f5323300fb1e6a4203c678f3ccbc4475b","target":"record","created_at":"2026-06-03T02:05:48Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b2c4156d771756753142ed00ae7a5231516390cb3fb94b697e2a856dc142489b","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-07T18:48:09Z","title_canon_sha256":"2f0dc1bc63c09aa252837610a68c5d6c6f4b435c3e77556274686aa630027805"},"schema_version":"1.0","source":{"id":"2605.06846","kind":"arxiv","version":3}},"canonical_sha256":"66fb8196e03a5915cc4e072287ea01a3e31bb11d64625cb17dc6c166786db07a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"66fb8196e03a5915cc4e072287ea01a3e31bb11d64625cb17dc6c166786db07a","first_computed_at":"2026-06-03T02:05:48.272240Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-03T02:05:48.272240Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"27w7NTSEMBerm52YZEAHXnBixSm4RxmI30tB02R/iSpHWEC9PoP6d1VT9lDLms6glarZfw2qzFhMZY4jqJo2Cg==","signature_status":"signed_v1","signed_at":"2026-06-03T02:05:48.272742Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.06846","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:abb56ffcf926c6996ec380c9aff7887f5323300fb1e6a4203c678f3ccbc4475b","sha256:d6783edeabf6dfc7df51c718468d54547e0493a1f429b387f9a7dc2479155204"],"state_sha256":"57d3ecbf5ffb5689b6ece78f3e969b3bd4c06b067fc2c737ca0f401e81e85c52"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8/XEIhCcgcsjj25LbHLPYVS0Cy+l5uhU9hyGBU/Kc8668BuDk8AOByphm08Ehk7l11ZgYRQigFXUdZ53dAqeAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T22:35:13.906531Z","bundle_sha256":"4c1d9181bbd552e2d10473afef00c1ca324a1a5f2819a39893ce082ba8d2917f"}}