{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:P5NQA5OZORBOOZHJNBVCWXAP2K","short_pith_number":"pith:P5NQA5OZ","canonical_record":{"source":{"id":"2602.05746","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-02-05T15:14:46Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"619f11ed364aa2b0b5bacf678efa819882e18d8d878107174b04ef3afe1f0ebe","abstract_canon_sha256":"8f209f45a249bf2c5815f22236aa7cf4e074ffb8e6e8e165573c5289eb8c8c33"},"schema_version":"1.0"},"canonical_sha256":"7f5b0075d97442e764e9686a2b5c0fd2bf98da05e378b423617eef72927de741","source":{"kind":"arxiv","id":"2602.05746","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2602.05746","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"arxiv_version","alias_value":"2602.05746v2","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2602.05746","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_12","alias_value":"P5NQA5OZORBO","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_16","alias_value":"P5NQA5OZORBOOZHJ","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_8","alias_value":"P5NQA5OZ","created_at":"2026-06-11T01:09:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:P5NQA5OZORBOOZHJNBVCWXAP2K","target":"record","payload":{"canonical_record":{"source":{"id":"2602.05746","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-02-05T15:14:46Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"619f11ed364aa2b0b5bacf678efa819882e18d8d878107174b04ef3afe1f0ebe","abstract_canon_sha256":"8f209f45a249bf2c5815f22236aa7cf4e074ffb8e6e8e165573c5289eb8c8c33"},"schema_version":"1.0"},"canonical_sha256":"7f5b0075d97442e764e9686a2b5c0fd2bf98da05e378b423617eef72927de741","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-11T01:09:28.663009Z","signature_b64":"zJZhBoJVx3jzp3RlIHNAtkWXpKnPwuAKnlWoCL6X7/H+ElAFjSDwC6Kw/99lvPQVDLb1WzgBzXniWI2OvFMnAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7f5b0075d97442e764e9686a2b5c0fd2bf98da05e378b423617eef72927de741","last_reissued_at":"2026-06-11T01:09:28.661988Z","signature_status":"signed_v1","first_computed_at":"2026-06-11T01:09:28.661988Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2602.05746","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-11T01:09:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OAAK4/+msVRMRPUmrOlblk5ICcjL/KIqseeLeFlBxytohGPmfkHcqVn6jERZtdynoHgh4ecnDfrV7HoxfyKZAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-30T06:05:50.823541Z"},"content_sha256":"e93a1330d34fdbf4b27f8738ec41323bb972562845f7e5ed2888b68d83f0e84f","schema_version":"1.0","event_id":"sha256:e93a1330d34fdbf4b27f8738ec41323bb972562845f7e5ed2888b68d83f0e84f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:P5NQA5OZORBOOZHJNBVCWXAP2K","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.LG","authors_text":"Florian Tram\\`er, Jie Zhang, Xin Chen","submitted_at":"2026-02-05T15:14:46Z","abstract_excerpt":"Prompt injection is a critical vulnerability in LLM agents, yet the strongest methods still rely on human red-teamers and hand-crafted prompts. Adapting automated jailbreak optimizers does not close this gap: jailbreaks shape models toward generic compliance, while prompt injection requires emitting specific tool calls with correct parameters. The success signal is binary, and randomly sampled suffixes almost never trigger it, so standard optimizers have no gradient to follow. We present AutoInject, a black-box reinforcement learning (RL) framework that learns adversarial suffixes for prompt i"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2602.05746","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2602.05746/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-11T01:09:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"p5bvVKWlnHYBcMUrUJLEsaVNSecV2zzig3vncY5U8jgHdVc9TEE7ZP1p9QFULuHv/cmw3F6u6bqLjArqg7erAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-30T06:05:50.823898Z"},"content_sha256":"90ba3681897853d90c449f0de512cc76a9951db79c8e5a504547c1c01affd0f6","schema_version":"1.0","event_id":"sha256:90ba3681897853d90c449f0de512cc76a9951db79c8e5a504547c1c01affd0f6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/bundle.json","state_url":"https://pith.science/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-30T06:05:50Z","links":{"resolver":"https://pith.science/pith/P5NQA5OZORBOOZHJNBVCWXAP2K","bundle":"https://pith.science/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/bundle.json","state":"https://pith.science/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/state.json","well_known_bundle":"https://pith.science/.well-known/pith/P5NQA5OZORBOOZHJNBVCWXAP2K/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:P5NQA5OZORBOOZHJNBVCWXAP2K","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8f209f45a249bf2c5815f22236aa7cf4e074ffb8e6e8e165573c5289eb8c8c33","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-02-05T15:14:46Z","title_canon_sha256":"619f11ed364aa2b0b5bacf678efa819882e18d8d878107174b04ef3afe1f0ebe"},"schema_version":"1.0","source":{"id":"2602.05746","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2602.05746","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"arxiv_version","alias_value":"2602.05746v2","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2602.05746","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_12","alias_value":"P5NQA5OZORBO","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_16","alias_value":"P5NQA5OZORBOOZHJ","created_at":"2026-06-11T01:09:28Z"},{"alias_kind":"pith_short_8","alias_value":"P5NQA5OZ","created_at":"2026-06-11T01:09:28Z"}],"graph_snapshots":[{"event_id":"sha256:90ba3681897853d90c449f0de512cc76a9951db79c8e5a504547c1c01affd0f6","target":"graph","created_at":"2026-06-11T01:09:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2602.05746/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Prompt injection is a critical vulnerability in LLM agents, yet the strongest methods still rely on human red-teamers and hand-crafted prompts. Adapting automated jailbreak optimizers does not close this gap: jailbreaks shape models toward generic compliance, while prompt injection requires emitting specific tool calls with correct parameters. The success signal is binary, and randomly sampled suffixes almost never trigger it, so standard optimizers have no gradient to follow. We present AutoInject, a black-box reinforcement learning (RL) framework that learns adversarial suffixes for prompt i","authors_text":"Florian Tram\\`er, Jie Zhang, Xin Chen","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-02-05T15:14:46Z","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2602.05746","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:e93a1330d34fdbf4b27f8738ec41323bb972562845f7e5ed2888b68d83f0e84f","target":"record","created_at":"2026-06-11T01:09:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8f209f45a249bf2c5815f22236aa7cf4e074ffb8e6e8e165573c5289eb8c8c33","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-02-05T15:14:46Z","title_canon_sha256":"619f11ed364aa2b0b5bacf678efa819882e18d8d878107174b04ef3afe1f0ebe"},"schema_version":"1.0","source":{"id":"2602.05746","kind":"arxiv","version":2}},"canonical_sha256":"7f5b0075d97442e764e9686a2b5c0fd2bf98da05e378b423617eef72927de741","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7f5b0075d97442e764e9686a2b5c0fd2bf98da05e378b423617eef72927de741","first_computed_at":"2026-06-11T01:09:28.661988Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-11T01:09:28.661988Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zJZhBoJVx3jzp3RlIHNAtkWXpKnPwuAKnlWoCL6X7/H+ElAFjSDwC6Kw/99lvPQVDLb1WzgBzXniWI2OvFMnAw==","signature_status":"signed_v1","signed_at":"2026-06-11T01:09:28.663009Z","signed_message":"canonical_sha256_bytes"},"source_id":"2602.05746","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:e93a1330d34fdbf4b27f8738ec41323bb972562845f7e5ed2888b68d83f0e84f","sha256:90ba3681897853d90c449f0de512cc76a9951db79c8e5a504547c1c01affd0f6"],"state_sha256":"dd9e4cb099371ce411a0e17872bdc15cae3ce518129b1d4445a1957868360f58"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zy5GYwtX0RXMJ3Ngwp3YZs1FYS90pIrSkMSWTixUziZgNCxAqTXKe3VrQiE4pjQE2RHvlYEgSiXXCjnG8NwBAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-30T06:05:50.825876Z","bundle_sha256":"c17d2730dabcd0d54906754c7d65e1146805cddab0e61ac9c0d3f63e45dc74cc"}}