{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:QZTY4XUOWDDO2JFH5CKLBY3ESP","short_pith_number":"pith:QZTY4XUO","canonical_record":{"source":{"id":"2409.20089","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-30T08:41:39Z","cross_cats_sorted":["cs.CL","cs.CR"],"title_canon_sha256":"5506a9e23dc84486ea1dbed0755cd9d005c1d172d80c34f239a4691ee8d615f1","abstract_canon_sha256":"d82124a87f82985217f4cd6c3c6bdf32dc681af99d02a3b9f3856b94efa01c9f"},"schema_version":"1.0"},"canonical_sha256":"86678e5e8eb0c6ed24a7e894b0e36493d8fc9eaebf369306d64704d2ca06998a","source":{"kind":"arxiv","id":"2409.20089","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.20089","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"arxiv_version","alias_value":"2409.20089v2","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.20089","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_12","alias_value":"QZTY4XUOWDDO","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_16","alias_value":"QZTY4XUOWDDO2JFH","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_8","alias_value":"QZTY4XUO","created_at":"2026-07-05T10:35:36Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:QZTY4XUOWDDO2JFH5CKLBY3ESP","target":"record","payload":{"canonical_record":{"source":{"id":"2409.20089","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-30T08:41:39Z","cross_cats_sorted":["cs.CL","cs.CR"],"title_canon_sha256":"5506a9e23dc84486ea1dbed0755cd9d005c1d172d80c34f239a4691ee8d615f1","abstract_canon_sha256":"d82124a87f82985217f4cd6c3c6bdf32dc681af99d02a3b9f3856b94efa01c9f"},"schema_version":"1.0"},"canonical_sha256":"86678e5e8eb0c6ed24a7e894b0e36493d8fc9eaebf369306d64704d2ca06998a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:35:36.560933Z","signature_b64":"rRJKnaZmFkj++PUDwQ5EwZ2YVkc0Hs0MfYzhfV9HvmndxI+ItUwNyqQDdMBZFjVFOsSjINRNeBD7G4eqWyKXAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"86678e5e8eb0c6ed24a7e894b0e36493d8fc9eaebf369306d64704d2ca06998a","last_reissued_at":"2026-07-05T10:35:36.560307Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:35:36.560307Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.20089","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:35:36Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vVIMAWl6Uoc5SWWoeUBFjRD6ydnoj06aKqhOIdB+1Bi6fzCrsCwGDLzzgmWF7OJTowAvwyZJBn3YwPFHo+ZuDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-11T19:55:02.271014Z"},"content_sha256":"d6ee841ae7ba8c45afa29a271ecbad6d6632698075a644e2f2059d354b963248","schema_version":"1.0","event_id":"sha256:d6ee841ae7ba8c45afa29a271ecbad6d6632698075a644e2f2059d354b963248"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:QZTY4XUOWDDO2JFH5CKLBY3ESP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Robust LLM safeguarding via refusal feature adversarial training","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CL","cs.CR"],"primary_cat":"cs.LG","authors_text":"Karen Hambardzumyan, Lei Yu, Nicola Cancedda, Virginie Do","submitted_at":"2024-09-30T08:41:39Z","abstract_excerpt":"Large language models (LLMs) are vulnerable to adversarial attacks that can elicit harmful responses. Defending against such attacks remains challenging due to the opacity of jailbreaking mechanisms and the high computational cost of training LLMs robustly. We demonstrate that adversarial attacks share a universal mechanism for circumventing LLM safeguards that works by ablating a dimension in the residual stream embedding space called the refusal feature. We further show that the operation of refusal feature ablation (RFA) approximates the worst-case perturbation of offsetting model safety. B"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.20089","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.20089/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:35:36Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uOCPooMdpYBk5hegqMX9Maim1vjF5+umDqth4iG9Hm0pYFlMypfgZl+NoIu1gclrLjcudq7GG2PtQVukomHfCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-11T19:55:02.271401Z"},"content_sha256":"54f37145b730bc41b71f27362b861402327ad5a68f58a401754c60b3f7461e1b","schema_version":"1.0","event_id":"sha256:54f37145b730bc41b71f27362b861402327ad5a68f58a401754c60b3f7461e1b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/bundle.json","state_url":"https://pith.science/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-11T19:55:02Z","links":{"resolver":"https://pith.science/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP","bundle":"https://pith.science/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/bundle.json","state":"https://pith.science/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/QZTY4XUOWDDO2JFH5CKLBY3ESP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:QZTY4XUOWDDO2JFH5CKLBY3ESP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d82124a87f82985217f4cd6c3c6bdf32dc681af99d02a3b9f3856b94efa01c9f","cross_cats_sorted":["cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-30T08:41:39Z","title_canon_sha256":"5506a9e23dc84486ea1dbed0755cd9d005c1d172d80c34f239a4691ee8d615f1"},"schema_version":"1.0","source":{"id":"2409.20089","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.20089","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"arxiv_version","alias_value":"2409.20089v2","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.20089","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_12","alias_value":"QZTY4XUOWDDO","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_16","alias_value":"QZTY4XUOWDDO2JFH","created_at":"2026-07-05T10:35:36Z"},{"alias_kind":"pith_short_8","alias_value":"QZTY4XUO","created_at":"2026-07-05T10:35:36Z"}],"graph_snapshots":[{"event_id":"sha256:54f37145b730bc41b71f27362b861402327ad5a68f58a401754c60b3f7461e1b","target":"graph","created_at":"2026-07-05T10:35:36Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.20089/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) are vulnerable to adversarial attacks that can elicit harmful responses. Defending against such attacks remains challenging due to the opacity of jailbreaking mechanisms and the high computational cost of training LLMs robustly. We demonstrate that adversarial attacks share a universal mechanism for circumventing LLM safeguards that works by ablating a dimension in the residual stream embedding space called the refusal feature. We further show that the operation of refusal feature ablation (RFA) approximates the worst-case perturbation of offsetting model safety. B","authors_text":"Karen Hambardzumyan, Lei Yu, Nicola Cancedda, Virginie Do","cross_cats":["cs.CL","cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-30T08:41:39Z","title":"Robust LLM safeguarding via refusal feature adversarial training"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.20089","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d6ee841ae7ba8c45afa29a271ecbad6d6632698075a644e2f2059d354b963248","target":"record","created_at":"2026-07-05T10:35:36Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d82124a87f82985217f4cd6c3c6bdf32dc681af99d02a3b9f3856b94efa01c9f","cross_cats_sorted":["cs.CL","cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-09-30T08:41:39Z","title_canon_sha256":"5506a9e23dc84486ea1dbed0755cd9d005c1d172d80c34f239a4691ee8d615f1"},"schema_version":"1.0","source":{"id":"2409.20089","kind":"arxiv","version":2}},"canonical_sha256":"86678e5e8eb0c6ed24a7e894b0e36493d8fc9eaebf369306d64704d2ca06998a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"86678e5e8eb0c6ed24a7e894b0e36493d8fc9eaebf369306d64704d2ca06998a","first_computed_at":"2026-07-05T10:35:36.560307Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:35:36.560307Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"rRJKnaZmFkj++PUDwQ5EwZ2YVkc0Hs0MfYzhfV9HvmndxI+ItUwNyqQDdMBZFjVFOsSjINRNeBD7G4eqWyKXAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T10:35:36.560933Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.20089","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d6ee841ae7ba8c45afa29a271ecbad6d6632698075a644e2f2059d354b963248","sha256:54f37145b730bc41b71f27362b861402327ad5a68f58a401754c60b3f7461e1b"],"state_sha256":"570ef439aefae2107b0dc20a9e0617e08b49e5877fd91f9fc0fee887c1ce92e8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D8o12c10L6dgN8/L0AX2S3IX4g5O4dh6G7OLPOIIb0okC+4Mt2qG6JPJtl9pog9BQrRCG5kG16RL1ws4lL+aBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-11T19:55:02.273837Z","bundle_sha256":"1f7ac2141b7a2448452b0e3911a3c9f66b4ae826daef8d8f54b0c15df295438e"}}