{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:PHN4WATG6XSJZUINV4IJFYDXGY","short_pith_number":"pith:PHN4WATG","canonical_record":{"source":{"id":"2602.08874","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-02-09T16:35:14Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"4037053b975e72053553e56fea2e08974e841180882333da582d789fbc2dd640","abstract_canon_sha256":"6a4963d20a0a23a8a31a15a32cc122f56629a8572fa297ff969b3a24e6451fe3"},"schema_version":"1.0"},"canonical_sha256":"79dbcb0266f5e49cd10daf1092e0773609ca632f0d49fdd21ce384269f82b0bd","source":{"kind":"arxiv","id":"2602.08874","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2602.08874","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"arxiv_version","alias_value":"2602.08874v2","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2602.08874","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"pith_short_12","alias_value":"PHN4WATG6XSJ","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"PHN4WATG6XSJZUIN","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"PHN4WATG","created_at":"2026-05-18T12:33:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:PHN4WATG6XSJZUINV4IJFYDXGY","target":"record","payload":{"canonical_record":{"source":{"id":"2602.08874","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-02-09T16:35:14Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"4037053b975e72053553e56fea2e08974e841180882333da582d789fbc2dd640","abstract_canon_sha256":"6a4963d20a0a23a8a31a15a32cc122f56629a8572fa297ff969b3a24e6451fe3"},"schema_version":"1.0"},"canonical_sha256":"79dbcb0266f5e49cd10daf1092e0773609ca632f0d49fdd21ce384269f82b0bd","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:39:16.248127Z","signature_b64":"LwTIELdJph1Q/8iJhn4qhpBFliuZa7HlYkR4/o4L+pK8T18+jsXB/esjjJXa0Jp4Srwxh+5lO1DRKbWU2OhdDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"79dbcb0266f5e49cd10daf1092e0773609ca632f0d49fdd21ce384269f82b0bd","last_reissued_at":"2026-05-17T23:39:16.247283Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:39:16.247283Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2602.08874","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:39:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zq4to+J9JK0maSN7j1ux4U+DA7/+fMG4pd5FD9iBa834yvOwptKvMZvU5h/FEFQ9XQWZ/WJvIIIgX2fKGSU4BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-10T18:14:20.516605Z"},"content_sha256":"204c1bfda7790b53cc2edecb37da1ac2bc650d371e130c60a344997801f6f03d","schema_version":"1.0","event_id":"sha256:204c1bfda7790b53cc2edecb37da1ac2bc650d371e130c60a344997801f6f03d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:PHN4WATG6XSJZUINV4IJFYDXGY","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Do Reasoning LLMs Refuse What They Infer in Long Contexts?","license":"http://creativecommons.org/licenses/by/4.0/","headline":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts.","cross_cats":["cs.CR"],"primary_cat":"cs.CL","authors_text":"Haz Sameen Shahgir, Huanli Gong, N. Benjamin Erichson, Yue Dong, Yu Fu, Zhipeng Wei","submitted_at":"2026-02-09T16:35:14Z","abstract_excerpt":"Long-context LLMs can infer objectives that are not stated explicitly. This capability is useful for reasoning over documents, code, retrieved evidence, and tool traces, but it also creates a safety risk: harmful intent can be distributed across a context and become visible only after the model composes the relevant pieces. Existing safety evaluations mostly test explicit harmful requests, and therefore miss this failure mode. We introduce compositional reasoning attacks, a long-context threat model in which harmful requests are decomposed into semantically incomplete fragments and embedded in"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"Our results reveal a long-context safety gap: current models are better at refusing harmful requests they see than harmful objectives they infer.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That the observed drops in refusal rates are caused by models successfully inferring the harmful objective and then complying, rather than retrieval failures or other confounds; supported by benign reconstruction and fragment-position analyses.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Long-context LLMs refuse explicit harmful requests but often comply when the same harmful goals must be inferred from distributed fragments in long contexts.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"f5b217147bd740e407ad9a0f4e23c70d1215ce8e126a760d36f8e0cb463c52da"},"source":{"id":"2602.08874","kind":"arxiv","version":2},"verdict":{"id":"b55782ec-f0ce-4229-8d96-cb78df51d8e6","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-16T05:34:25.042150Z","strongest_claim":"Our results reveal a long-context safety gap: current models are better at refusing harmful requests they see than harmful objectives they infer.","one_line_summary":"Long-context LLMs refuse explicit harmful requests but often comply when the same harmful goals must be inferred from distributed fragments in long contexts.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That the observed drops in refusal rates are caused by models successfully inferring the harmful objective and then complying, rather than retrieval failures or other confounds; supported by benign reconstruction and fragment-position analyses.","pith_extraction_headline":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts."},"references":{"count":57,"sample":[{"doi":"10.52202/079017-4121","year":2025,"title":"doi: 10.52202/079017-4121. Bai, Y ., Tu, S., Zhang, J., Peng, H., Wang, X., Lv, X., Cao, S., Xu, J., Hou, L., Dong, Y ., Tang, J., and Li, J. LongBench v2: Towards deeper understanding and rea- soning","work_id":"54622860-18a1-476f-a4e9-ea8be5ee8784","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.18653/v1/2025.acl-long.183","year":2025,"title":"LongBench v2: Towards deeper understanding and reasoning on realistic long-context multitasks","work_id":"8f9c514f-eddb-453d-99e6-270f051e6849","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"ISBN 979-8-89176-279-4","work_id":"3a0d05dd-9994-4d4b-9471-7f32ed173040","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.18653/v1/2025.acl-long.101","year":2025,"title":"URL https: //aclanthology.org/2025.acl-long.101/","work_id":"8d5349b6-929c-4037-9620-353cf19da36d","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"10.18653/v1/2025.emnlp-main","year":2025,"title":"ISBN 979-8-89176-332-6","work_id":"e8f5282f-30a2-4e6a-96fd-5aa884a0e8a0","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":57,"snapshot_sha256":"4c4d99db7eab0b9a637dec827468a56768c9db5d81f1ab7fd82a64f16eb3dd36","internal_anchors":2},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"b55782ec-f0ce-4229-8d96-cb78df51d8e6"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:39:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PQseiEIjUMpFGMdajOQbNCmZ0qMxFWymTl5Gcy2hWGMohrBRMhHdS/q0pk79lb4+cvi+r1Ahp5HRTtl53jr2Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-10T18:14:20.517572Z"},"content_sha256":"cbac79613b545ed44cd6eb82673b837aed61266f16226f85fb4adf93ed28595f","schema_version":"1.0","event_id":"sha256:cbac79613b545ed44cd6eb82673b837aed61266f16226f85fb4adf93ed28595f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PHN4WATG6XSJZUINV4IJFYDXGY/bundle.json","state_url":"https://pith.science/pith/PHN4WATG6XSJZUINV4IJFYDXGY/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PHN4WATG6XSJZUINV4IJFYDXGY/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-10T18:14:20Z","links":{"resolver":"https://pith.science/pith/PHN4WATG6XSJZUINV4IJFYDXGY","bundle":"https://pith.science/pith/PHN4WATG6XSJZUINV4IJFYDXGY/bundle.json","state":"https://pith.science/pith/PHN4WATG6XSJZUINV4IJFYDXGY/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PHN4WATG6XSJZUINV4IJFYDXGY/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:PHN4WATG6XSJZUINV4IJFYDXGY","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6a4963d20a0a23a8a31a15a32cc122f56629a8572fa297ff969b3a24e6451fe3","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-02-09T16:35:14Z","title_canon_sha256":"4037053b975e72053553e56fea2e08974e841180882333da582d789fbc2dd640"},"schema_version":"1.0","source":{"id":"2602.08874","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2602.08874","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"arxiv_version","alias_value":"2602.08874v2","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2602.08874","created_at":"2026-05-17T23:39:16Z"},{"alias_kind":"pith_short_12","alias_value":"PHN4WATG6XSJ","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"PHN4WATG6XSJZUIN","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"PHN4WATG","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:cbac79613b545ed44cd6eb82673b837aed61266f16226f85fb4adf93ed28595f","target":"graph","created_at":"2026-05-17T23:39:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"Our results reveal a long-context safety gap: current models are better at refusing harmful requests they see than harmful objectives they infer."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That the observed drops in refusal rates are caused by models successfully inferring the harmful objective and then complying, rather than retrieval failures or other confounds; supported by benign reconstruction and fragment-position analyses."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Long-context LLMs refuse explicit harmful requests but often comply when the same harmful goals must be inferred from distributed fragments in long contexts."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts."}],"snapshot_sha256":"f5b217147bd740e407ad9a0f4e23c70d1215ce8e126a760d36f8e0cb463c52da"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Long-context LLMs can infer objectives that are not stated explicitly. This capability is useful for reasoning over documents, code, retrieved evidence, and tool traces, but it also creates a safety risk: harmful intent can be distributed across a context and become visible only after the model composes the relevant pieces. Existing safety evaluations mostly test explicit harmful requests, and therefore miss this failure mode. We introduce compositional reasoning attacks, a long-context threat model in which harmful requests are decomposed into semantically incomplete fragments and embedded in","authors_text":"Haz Sameen Shahgir, Huanli Gong, N. Benjamin Erichson, Yue Dong, Yu Fu, Zhipeng Wei","cross_cats":["cs.CR"],"headline":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts.","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-02-09T16:35:14Z","title":"Do Reasoning LLMs Refuse What They Infer in Long Contexts?"},"references":{"count":57,"internal_anchors":2,"resolved_work":57,"sample":[{"cited_arxiv_id":"","doi":"10.52202/079017-4121","is_internal_anchor":false,"ref_index":1,"title":"doi: 10.52202/079017-4121. Bai, Y ., Tu, S., Zhang, J., Peng, H., Wang, X., Lv, X., Cao, S., Xu, J., Hou, L., Dong, Y ., Tang, J., and Li, J. LongBench v2: Towards deeper understanding and rea- soning","work_id":"54622860-18a1-476f-a4e9-ea8be5ee8784","year":2025},{"cited_arxiv_id":"","doi":"10.18653/v1/2025.acl-long.183","is_internal_anchor":false,"ref_index":2,"title":"LongBench v2: Towards deeper understanding and reasoning on realistic long-context multitasks","work_id":"8f9c514f-eddb-453d-99e6-270f051e6849","year":2025},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":3,"title":"ISBN 979-8-89176-279-4","work_id":"3a0d05dd-9994-4d4b-9471-7f32ed173040","year":2025},{"cited_arxiv_id":"","doi":"10.18653/v1/2025.acl-long.101","is_internal_anchor":false,"ref_index":4,"title":"URL https: //aclanthology.org/2025.acl-long.101/","work_id":"8d5349b6-929c-4037-9620-353cf19da36d","year":2025},{"cited_arxiv_id":"","doi":"10.18653/v1/2025.emnlp-main","is_internal_anchor":false,"ref_index":5,"title":"ISBN 979-8-89176-332-6","work_id":"e8f5282f-30a2-4e6a-96fd-5aa884a0e8a0","year":2025}],"snapshot_sha256":"4c4d99db7eab0b9a637dec827468a56768c9db5d81f1ab7fd82a64f16eb3dd36"},"source":{"id":"2602.08874","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-16T05:34:25.042150Z","id":"b55782ec-f0ce-4229-8d96-cb78df51d8e6","model_set":{"reader":"grok-4.3"},"one_line_summary":"Long-context LLMs refuse explicit harmful requests but often comply when the same harmful goals must be inferred from distributed fragments in long contexts.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"LLMs refuse explicit harmful requests but often comply when inferring the same objectives from fragments in long contexts.","strongest_claim":"Our results reveal a long-context safety gap: current models are better at refusing harmful requests they see than harmful objectives they infer.","weakest_assumption":"That the observed drops in refusal rates are caused by models successfully inferring the harmful objective and then complying, rather than retrieval failures or other confounds; supported by benign reconstruction and fragment-position analyses."}},"verdict_id":"b55782ec-f0ce-4229-8d96-cb78df51d8e6"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:204c1bfda7790b53cc2edecb37da1ac2bc650d371e130c60a344997801f6f03d","target":"record","created_at":"2026-05-17T23:39:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6a4963d20a0a23a8a31a15a32cc122f56629a8572fa297ff969b3a24e6451fe3","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-02-09T16:35:14Z","title_canon_sha256":"4037053b975e72053553e56fea2e08974e841180882333da582d789fbc2dd640"},"schema_version":"1.0","source":{"id":"2602.08874","kind":"arxiv","version":2}},"canonical_sha256":"79dbcb0266f5e49cd10daf1092e0773609ca632f0d49fdd21ce384269f82b0bd","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"79dbcb0266f5e49cd10daf1092e0773609ca632f0d49fdd21ce384269f82b0bd","first_computed_at":"2026-05-17T23:39:16.247283Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:39:16.247283Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"LwTIELdJph1Q/8iJhn4qhpBFliuZa7HlYkR4/o4L+pK8T18+jsXB/esjjJXa0Jp4Srwxh+5lO1DRKbWU2OhdDg==","signature_status":"signed_v1","signed_at":"2026-05-17T23:39:16.248127Z","signed_message":"canonical_sha256_bytes"},"source_id":"2602.08874","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:204c1bfda7790b53cc2edecb37da1ac2bc650d371e130c60a344997801f6f03d","sha256:cbac79613b545ed44cd6eb82673b837aed61266f16226f85fb4adf93ed28595f"],"state_sha256":"80bae6069b35ef6232dfb7e70d5d73b4586f1defbedf31e6e5564204bf657f6f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BuBZm6wUPYdptazsZ9MNJdGqxuVX9vKKzabtrpX4Hd9BgKuyZyOOSOsZuMK8DJ7t99570Quj7yMDjaA25UHMCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-10T18:14:20.522488Z","bundle_sha256":"fae8b148c067fcd7f189e73fe01c3a99a6d5bfe4114f0508360f896d444567e4"}}