{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:PEEJPTG3Y6JCK6BXN263RJSSRB","short_pith_number":"pith:PEEJPTG3","canonical_record":{"source":{"id":"2505.19864","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T11:48:32Z","cross_cats_sorted":[],"title_canon_sha256":"473fa277e632c82162064ffbd534621271daf2394e4c794640b4a53d6ae48d8a","abstract_canon_sha256":"cae73d95d730b07ef38f4e69d5582d3e22fdeef0882686ad1faaac65aac8242d"},"schema_version":"1.0"},"canonical_sha256":"790897ccdbc7922578376ebdb8a652887be8f26951b6c0704f34985b0b39cf93","source":{"kind":"arxiv","id":"2505.19864","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.19864","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"arxiv_version","alias_value":"2505.19864v1","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.19864","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_12","alias_value":"PEEJPTG3Y6JC","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_16","alias_value":"PEEJPTG3Y6JCK6BX","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_8","alias_value":"PEEJPTG3","created_at":"2026-07-05T11:09:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:PEEJPTG3Y6JCK6BXN263RJSSRB","target":"record","payload":{"canonical_record":{"source":{"id":"2505.19864","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T11:48:32Z","cross_cats_sorted":[],"title_canon_sha256":"473fa277e632c82162064ffbd534621271daf2394e4c794640b4a53d6ae48d8a","abstract_canon_sha256":"cae73d95d730b07ef38f4e69d5582d3e22fdeef0882686ad1faaac65aac8242d"},"schema_version":"1.0"},"canonical_sha256":"790897ccdbc7922578376ebdb8a652887be8f26951b6c0704f34985b0b39cf93","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:09:49.148555Z","signature_b64":"jxbgwhQMbOyGW949vF8PDI46r3DCE2gZfyNkV3SzXJYj63hDHrJDpB9BwI4M4UMrxQpjO7VITmtOnXLTtsZlDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"790897ccdbc7922578376ebdb8a652887be8f26951b6c0704f34985b0b39cf93","last_reissued_at":"2026-07-05T11:09:49.148048Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:09:49.148048Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.19864","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Wr50UdWg+zpOglz6eCJD5WhQKSXmOR8Y5dx19NNXEu/KzIJDkvBRkHjPBIa6LQEwjN1KFcC0kWNU1mZdETFBBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T09:22:48.445381Z"},"content_sha256":"383bede640bd140fa138b87fb502724f3dda328532f395142922a0c7458e13d4","schema_version":"1.0","event_id":"sha256:383bede640bd140fa138b87fb502724f3dda328532f395142922a0c7458e13d4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:PEEJPTG3Y6JCK6BXN263RJSSRB","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Anda Cheng, Chunyang Li, Jianfeng Ma, Junwei Zhang, Xinghua Li, Zhuo Ma","submitted_at":"2025-05-26T11:48:32Z","abstract_excerpt":"Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by incorporating external knowledge, but its openness introduces vulnerabilities that can be exploited by poisoning attacks. Existing poisoning methods for RAG systems have limitations, such as poor generalization and lack of fluency in adversarial texts. In this paper, we propose CPA-RAG, a black-box adversarial framework that generates query-relevant texts capable of manipulating the retrieval process to induce target answers. The proposed method integrates prompt-based text generation, cross-guided optimization throu"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.19864","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.19864/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jUZZfat+Rhh9pzAMMLRGwxv2goRfqNlksSpb1FQ7WjZ8py8mubVqEOeeFvNikDMg4VfNCyi82JU/G1u5SFFRBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T09:22:48.445905Z"},"content_sha256":"4d26d770adb06b980c956d7d2354d662299beaa18028bfc32582a342d84be9a6","schema_version":"1.0","event_id":"sha256:4d26d770adb06b980c956d7d2354d662299beaa18028bfc32582a342d84be9a6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/bundle.json","state_url":"https://pith.science/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T09:22:48Z","links":{"resolver":"https://pith.science/pith/PEEJPTG3Y6JCK6BXN263RJSSRB","bundle":"https://pith.science/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/bundle.json","state":"https://pith.science/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PEEJPTG3Y6JCK6BXN263RJSSRB/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:PEEJPTG3Y6JCK6BXN263RJSSRB","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cae73d95d730b07ef38f4e69d5582d3e22fdeef0882686ad1faaac65aac8242d","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T11:48:32Z","title_canon_sha256":"473fa277e632c82162064ffbd534621271daf2394e4c794640b4a53d6ae48d8a"},"schema_version":"1.0","source":{"id":"2505.19864","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.19864","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"arxiv_version","alias_value":"2505.19864v1","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.19864","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_12","alias_value":"PEEJPTG3Y6JC","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_16","alias_value":"PEEJPTG3Y6JCK6BX","created_at":"2026-07-05T11:09:49Z"},{"alias_kind":"pith_short_8","alias_value":"PEEJPTG3","created_at":"2026-07-05T11:09:49Z"}],"graph_snapshots":[{"event_id":"sha256:4d26d770adb06b980c956d7d2354d662299beaa18028bfc32582a342d84be9a6","target":"graph","created_at":"2026-07-05T11:09:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.19864/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by incorporating external knowledge, but its openness introduces vulnerabilities that can be exploited by poisoning attacks. Existing poisoning methods for RAG systems have limitations, such as poor generalization and lack of fluency in adversarial texts. In this paper, we propose CPA-RAG, a black-box adversarial framework that generates query-relevant texts capable of manipulating the retrieval process to induce target answers. The proposed method integrates prompt-based text generation, cross-guided optimization throu","authors_text":"Anda Cheng, Chunyang Li, Jianfeng Ma, Junwei Zhang, Xinghua Li, Zhuo Ma","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T11:48:32Z","title":"CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.19864","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:383bede640bd140fa138b87fb502724f3dda328532f395142922a0c7458e13d4","target":"record","created_at":"2026-07-05T11:09:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cae73d95d730b07ef38f4e69d5582d3e22fdeef0882686ad1faaac65aac8242d","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T11:48:32Z","title_canon_sha256":"473fa277e632c82162064ffbd534621271daf2394e4c794640b4a53d6ae48d8a"},"schema_version":"1.0","source":{"id":"2505.19864","kind":"arxiv","version":1}},"canonical_sha256":"790897ccdbc7922578376ebdb8a652887be8f26951b6c0704f34985b0b39cf93","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"790897ccdbc7922578376ebdb8a652887be8f26951b6c0704f34985b0b39cf93","first_computed_at":"2026-07-05T11:09:49.148048Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:09:49.148048Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"jxbgwhQMbOyGW949vF8PDI46r3DCE2gZfyNkV3SzXJYj63hDHrJDpB9BwI4M4UMrxQpjO7VITmtOnXLTtsZlDg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:09:49.148555Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.19864","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:383bede640bd140fa138b87fb502724f3dda328532f395142922a0c7458e13d4","sha256:4d26d770adb06b980c956d7d2354d662299beaa18028bfc32582a342d84be9a6"],"state_sha256":"afd3a706c316933ca0d131ea8b7f62df2c355ebc1c58c34289ffd9a357f88505"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Z4eNnUk7KTH9KlT/iHR1rr3gX7UjmJbDuawUw/LSKARl9FiR8qry5MoyI53Z38Z4ZJSkgyqB8YlfOgu31Um/Bw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T09:22:48.449819Z","bundle_sha256":"40a22b7c3f08f1d4b4d085b35b684b313008a277d089f09a893dbb4f091ed932"}}