{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:N3N2JGNGE7LMQ3ULZKXQLU5P6M","short_pith_number":"pith:N3N2JGNG","canonical_record":{"source":{"id":"2412.09565","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2024-12-12T18:49:53Z","cross_cats_sorted":[],"title_canon_sha256":"ed88e00a7ea48a6d3fca70b92d525803b4f471f24fb4814de080bc1d059825a9","abstract_canon_sha256":"6a21072b7986e0cdd14ee02e4e03a8fba39a19ba756720658d1f567c63d2622f"},"schema_version":"1.0"},"canonical_sha256":"6edba499a627d6c86e8bcaaf05d3aff3329224ccca29f5b9575001f72f4ab97f","source":{"kind":"arxiv","id":"2412.09565","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.09565","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"arxiv_version","alias_value":"2412.09565v2","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.09565","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_12","alias_value":"N3N2JGNGE7LM","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_16","alias_value":"N3N2JGNGE7LMQ3UL","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_8","alias_value":"N3N2JGNG","created_at":"2026-07-05T10:11:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:N3N2JGNGE7LMQ3ULZKXQLU5P6M","target":"record","payload":{"canonical_record":{"source":{"id":"2412.09565","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2024-12-12T18:49:53Z","cross_cats_sorted":[],"title_canon_sha256":"ed88e00a7ea48a6d3fca70b92d525803b4f471f24fb4814de080bc1d059825a9","abstract_canon_sha256":"6a21072b7986e0cdd14ee02e4e03a8fba39a19ba756720658d1f567c63d2622f"},"schema_version":"1.0"},"canonical_sha256":"6edba499a627d6c86e8bcaaf05d3aff3329224ccca29f5b9575001f72f4ab97f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:11:30.206001Z","signature_b64":"4d77jdGD4YUThRVa5BJwkWFKiiVabu7hEnwI1D3bOkpMLdfRumH97bUyHrP6bWs2OILKgYXVXkJpwSe6SYYeCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6edba499a627d6c86e8bcaaf05d3aff3329224ccca29f5b9575001f72f4ab97f","last_reissued_at":"2026-07-05T10:11:30.205421Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:11:30.205421Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2412.09565","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:11:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6bd1U3vehTF+QTirdrBDG6CZwQHKlQMECjyrFP/MxJg+WSVKXF/Wgp2+tmd6QIn9n3eodLsBqIMfyT7Nen3IBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T15:02:03.254972Z"},"content_sha256":"6c954cb8c90308d3656305c2aff3de3c9bc78a1445762b0347dbac5c597f3049","schema_version":"1.0","event_id":"sha256:6c954cb8c90308d3656305c2aff3de3c9bc78a1445762b0347dbac5c597f3049"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:N3N2JGNGE7LMQ3ULZKXQLU5P6M","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.LG","authors_text":"Abhay Sheshadri, Alex Serrano, Carlos Guestrin, Erik Jenner, Jacob Hilton, Jordan Taylor, Luke Bailey, Mikhail Seleznyov, Scott Emmons, Stephen Casper","submitted_at":"2024-12-12T18:49:53Z","abstract_excerpt":"Recent latent-space monitoring techniques have shown promise as defenses against LLM attacks. These defenses act as scanners that seek to detect harmful activations before they lead to undesirable actions. This prompts the question: Can models execute harmful behavior via inconspicuous latent states? Here, we study such obfuscated activations. We show that state-of-the-art latent-space defenses -- including sparse autoencoders, representation probing, and latent OOD detection -- are all vulnerable to obfuscated activations. For example, against probes trained to classify harmfulness, our attac"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.09565","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2412.09565/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:11:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"rbcHkiWhLuWtYKrnpPIiUSqdnKyQLzvVtbxc2S727q7WTE20rZ++9r0mJJfSRodyJlIIfBXHrOaORdx+AeQuBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T15:02:03.255664Z"},"content_sha256":"dada0ab00901d155f6e45a0814f69275a5de8369133c6f322cb8b6852cf06bfa","schema_version":"1.0","event_id":"sha256:dada0ab00901d155f6e45a0814f69275a5de8369133c6f322cb8b6852cf06bfa"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/bundle.json","state_url":"https://pith.science/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T15:02:03Z","links":{"resolver":"https://pith.science/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M","bundle":"https://pith.science/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/bundle.json","state":"https://pith.science/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/state.json","well_known_bundle":"https://pith.science/.well-known/pith/N3N2JGNGE7LMQ3ULZKXQLU5P6M/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:N3N2JGNGE7LMQ3ULZKXQLU5P6M","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6a21072b7986e0cdd14ee02e4e03a8fba39a19ba756720658d1f567c63d2622f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2024-12-12T18:49:53Z","title_canon_sha256":"ed88e00a7ea48a6d3fca70b92d525803b4f471f24fb4814de080bc1d059825a9"},"schema_version":"1.0","source":{"id":"2412.09565","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2412.09565","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"arxiv_version","alias_value":"2412.09565v2","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2412.09565","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_12","alias_value":"N3N2JGNGE7LM","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_16","alias_value":"N3N2JGNGE7LMQ3UL","created_at":"2026-07-05T10:11:30Z"},{"alias_kind":"pith_short_8","alias_value":"N3N2JGNG","created_at":"2026-07-05T10:11:30Z"}],"graph_snapshots":[{"event_id":"sha256:dada0ab00901d155f6e45a0814f69275a5de8369133c6f322cb8b6852cf06bfa","target":"graph","created_at":"2026-07-05T10:11:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2412.09565/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Recent latent-space monitoring techniques have shown promise as defenses against LLM attacks. These defenses act as scanners that seek to detect harmful activations before they lead to undesirable actions. This prompts the question: Can models execute harmful behavior via inconspicuous latent states? Here, we study such obfuscated activations. We show that state-of-the-art latent-space defenses -- including sparse autoencoders, representation probing, and latent OOD detection -- are all vulnerable to obfuscated activations. For example, against probes trained to classify harmfulness, our attac","authors_text":"Abhay Sheshadri, Alex Serrano, Carlos Guestrin, Erik Jenner, Jacob Hilton, Jordan Taylor, Luke Bailey, Mikhail Seleznyov, Scott Emmons, Stephen Casper","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2024-12-12T18:49:53Z","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2412.09565","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6c954cb8c90308d3656305c2aff3de3c9bc78a1445762b0347dbac5c597f3049","target":"record","created_at":"2026-07-05T10:11:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6a21072b7986e0cdd14ee02e4e03a8fba39a19ba756720658d1f567c63d2622f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2024-12-12T18:49:53Z","title_canon_sha256":"ed88e00a7ea48a6d3fca70b92d525803b4f471f24fb4814de080bc1d059825a9"},"schema_version":"1.0","source":{"id":"2412.09565","kind":"arxiv","version":2}},"canonical_sha256":"6edba499a627d6c86e8bcaaf05d3aff3329224ccca29f5b9575001f72f4ab97f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6edba499a627d6c86e8bcaaf05d3aff3329224ccca29f5b9575001f72f4ab97f","first_computed_at":"2026-07-05T10:11:30.205421Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:11:30.205421Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"4d77jdGD4YUThRVa5BJwkWFKiiVabu7hEnwI1D3bOkpMLdfRumH97bUyHrP6bWs2OILKgYXVXkJpwSe6SYYeCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T10:11:30.206001Z","signed_message":"canonical_sha256_bytes"},"source_id":"2412.09565","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6c954cb8c90308d3656305c2aff3de3c9bc78a1445762b0347dbac5c597f3049","sha256:dada0ab00901d155f6e45a0814f69275a5de8369133c6f322cb8b6852cf06bfa"],"state_sha256":"05b0559cd9577e693833c54e40ba512f55667a4994c5aff5fa138b78514fb8be"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zXqpHXo8NIJOg5KrDQr7pL5/Z3bRKSsSyYSvBxWeaorP10VoaY5MKGBheHwPr6/5npTLt7mkSWCjmIdTHeDjCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T15:02:03.261592Z","bundle_sha256":"d7de1446096c5e926f5795661a6992c4dae2be5e83d942e639cdfdbb4636c9c3"}}