{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:P3ARZR6OBI6T5RX3LREXPQGAKE","short_pith_number":"pith:P3ARZR6O","canonical_record":{"source":{"id":"2608.11295","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T17:54:26Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9fecd8539c23b6e4837a4701f52abc703b5ea6e7fb6d51c01a534e6e46ac5210","abstract_canon_sha256":"a05f897da8ab66d0ad8df0c5d06e9bee1f9b1d82a5a6815a8bc598efe350da60"},"schema_version":"1.0"},"canonical_sha256":"7ec11cc7ce0a3d3ec6fb5c4977c0c0513b0c5020a26b998193a8bef9754090bb","source":{"kind":"arxiv","id":"2608.11295","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.11295","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"arxiv_version","alias_value":"2608.11295v1","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.11295","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_12","alias_value":"P3ARZR6OBI6T","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_16","alias_value":"P3ARZR6OBI6T5RX3","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_8","alias_value":"P3ARZR6O","created_at":"2026-08-13T00:20:59Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:P3ARZR6OBI6T5RX3LREXPQGAKE","target":"record","payload":{"canonical_record":{"source":{"id":"2608.11295","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T17:54:26Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"9fecd8539c23b6e4837a4701f52abc703b5ea6e7fb6d51c01a534e6e46ac5210","abstract_canon_sha256":"a05f897da8ab66d0ad8df0c5d06e9bee1f9b1d82a5a6815a8bc598efe350da60"},"schema_version":"1.0"},"canonical_sha256":"7ec11cc7ce0a3d3ec6fb5c4977c0c0513b0c5020a26b998193a8bef9754090bb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-13T00:20:59.240933Z","signature_b64":"C5QjOnI3PeV+gkUGvCHuK1sKscMDSd9WzTdiWH9aHJ8Wz7LGuRLjKvYL9R3wCfWBg7bBolvKUYJYnKFof0tNBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7ec11cc7ce0a3d3ec6fb5c4977c0c0513b0c5020a26b998193a8bef9754090bb","last_reissued_at":"2026-08-13T00:20:59.239438Z","signature_status":"signed_v1","first_computed_at":"2026-08-13T00:20:59.239438Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.11295","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-13T00:20:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eDsc6u9Ty5TkgmihbQPr+C2uizohmcV+w38EB4B+33MS6W57wQAiqJbLI/dDdzXxFCWev4G4IbrlwIIKEDXfDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T21:43:44.044057Z"},"content_sha256":"f2db58e611cb8289b9f81127194226f94e92c6bbca152a6d132859b8f2264568","schema_version":"1.0","event_id":"sha256:f2db58e611cb8289b9f81127194226f94e92c6bbca152a6d132859b8f2264568"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:P3ARZR6OBI6T5RX3LREXPQGAKE","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Backdoor Decontamination Dynamics in LLM Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Abhay Puri, Alexandre Drouin, Christopher Pal, Gabriel Huang, L\\'eo Boisvert, Perouz Taslakian, Spandana Gella","submitted_at":"2026-08-11T17:54:26Z","abstract_excerpt":"Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing. Assuming defenders do not know the existing trigger, they cannot unlearn it directly. One decontamination strategy is to install a known backdoor (defensive poisoning) then to unlearn it, hoping that the original unknown backdoor is removed as a side effect. However, this procedure has uncertain outcomes: the original backdoor may persist or be erased or rerouted, among other possibilities. We introduce a framework for studying these"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.11295","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.11295/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-13T00:20:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"gjszlGb15exjVhxq1wSwHMju6JkP6adeZaaFDVCUICnAIzKoXP6900Gz3yCtfnIdsuZ4GUXEBF63fIWKQ4DyBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T21:43:44.045027Z"},"content_sha256":"cfb304a2b440a673094974b3b533d9bbf8b14c1735baa23a4a442424816b8412","schema_version":"1.0","event_id":"sha256:cfb304a2b440a673094974b3b533d9bbf8b14c1735baa23a4a442424816b8412"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/bundle.json","state_url":"https://pith.science/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T21:43:44Z","links":{"resolver":"https://pith.science/pith/P3ARZR6OBI6T5RX3LREXPQGAKE","bundle":"https://pith.science/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/bundle.json","state":"https://pith.science/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/state.json","well_known_bundle":"https://pith.science/.well-known/pith/P3ARZR6OBI6T5RX3LREXPQGAKE/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:P3ARZR6OBI6T5RX3LREXPQGAKE","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a05f897da8ab66d0ad8df0c5d06e9bee1f9b1d82a5a6815a8bc598efe350da60","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T17:54:26Z","title_canon_sha256":"9fecd8539c23b6e4837a4701f52abc703b5ea6e7fb6d51c01a534e6e46ac5210"},"schema_version":"1.0","source":{"id":"2608.11295","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.11295","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"arxiv_version","alias_value":"2608.11295v1","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.11295","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_12","alias_value":"P3ARZR6OBI6T","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_16","alias_value":"P3ARZR6OBI6T5RX3","created_at":"2026-08-13T00:20:59Z"},{"alias_kind":"pith_short_8","alias_value":"P3ARZR6O","created_at":"2026-08-13T00:20:59Z"}],"graph_snapshots":[{"event_id":"sha256:cfb304a2b440a673094974b3b533d9bbf8b14c1735baa23a4a442424816b8412","target":"graph","created_at":"2026-08-13T00:20:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.11295/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Open-weight LLM agents are vulnerable to backdoors installed during fine-tuning, which may be undetectable if the trigger conditions are never met during testing. Assuming defenders do not know the existing trigger, they cannot unlearn it directly. One decontamination strategy is to install a known backdoor (defensive poisoning) then to unlearn it, hoping that the original unknown backdoor is removed as a side effect. However, this procedure has uncertain outcomes: the original backdoor may persist or be erased or rerouted, among other possibilities. We introduce a framework for studying these","authors_text":"Abhay Puri, Alexandre Drouin, Christopher Pal, Gabriel Huang, L\\'eo Boisvert, Perouz Taslakian, Spandana Gella","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T17:54:26Z","title":"Backdoor Decontamination Dynamics in LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.11295","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f2db58e611cb8289b9f81127194226f94e92c6bbca152a6d132859b8f2264568","target":"record","created_at":"2026-08-13T00:20:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a05f897da8ab66d0ad8df0c5d06e9bee1f9b1d82a5a6815a8bc598efe350da60","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-11T17:54:26Z","title_canon_sha256":"9fecd8539c23b6e4837a4701f52abc703b5ea6e7fb6d51c01a534e6e46ac5210"},"schema_version":"1.0","source":{"id":"2608.11295","kind":"arxiv","version":1}},"canonical_sha256":"7ec11cc7ce0a3d3ec6fb5c4977c0c0513b0c5020a26b998193a8bef9754090bb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7ec11cc7ce0a3d3ec6fb5c4977c0c0513b0c5020a26b998193a8bef9754090bb","first_computed_at":"2026-08-13T00:20:59.239438Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-13T00:20:59.239438Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"C5QjOnI3PeV+gkUGvCHuK1sKscMDSd9WzTdiWH9aHJ8Wz7LGuRLjKvYL9R3wCfWBg7bBolvKUYJYnKFof0tNBg==","signature_status":"signed_v1","signed_at":"2026-08-13T00:20:59.240933Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.11295","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f2db58e611cb8289b9f81127194226f94e92c6bbca152a6d132859b8f2264568","sha256:cfb304a2b440a673094974b3b533d9bbf8b14c1735baa23a4a442424816b8412"],"state_sha256":"0c76d2ab482a55cf262488a5e71327b056cdd3b774f0831ec45e0c9b0c8fa6b7"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hxg/hx1xtt9Gm2XRF0L35XufX2lnX/NzlzUig10iTHeimYHiu+9B9b96wf0/CJQNdID/HCChr0qllpRifv0mAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T21:43:44.051080Z","bundle_sha256":"662a3dd211b922ef253f0ee70ff20e3b656d0f666eceed7150ba8090aafd1af7"}}