{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y","short_pith_number":"pith:RDW7Z2KQ","canonical_record":{"source":{"id":"2410.13886","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-11T06:54:12Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"e2a2130242f930bc6230b70827958083541c2fb4b21f183ea4d43d2dbf755573","abstract_canon_sha256":"c571d8adedd9312322df2cf1bfff0b180e7d16a097006ea1673cc7560ce89b32"},"schema_version":"1.0"},"canonical_sha256":"88edfce950dcd5f0ad3a72b55dc791fe2e2e944be9e5cca432d876a4600cdcdc","source":{"kind":"arxiv","id":"2410.13886","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2410.13886","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"arxiv_version","alias_value":"2410.13886v2","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2410.13886","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_12","alias_value":"RDW7Z2KQ3TK7","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_16","alias_value":"RDW7Z2KQ3TK7BLJ2","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_8","alias_value":"RDW7Z2KQ","created_at":"2026-07-05T09:23:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y","target":"record","payload":{"canonical_record":{"source":{"id":"2410.13886","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-11T06:54:12Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"e2a2130242f930bc6230b70827958083541c2fb4b21f183ea4d43d2dbf755573","abstract_canon_sha256":"c571d8adedd9312322df2cf1bfff0b180e7d16a097006ea1673cc7560ce89b32"},"schema_version":"1.0"},"canonical_sha256":"88edfce950dcd5f0ad3a72b55dc791fe2e2e944be9e5cca432d876a4600cdcdc","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:23:33.811331Z","signature_b64":"ggz7Yw8qTUczN4byGUnBtCvJMy4CExlgY0u8WsUgHrTyuCAXf2NfKhbgYGEWUqLyuejeUi3jQaY6GmqPbFVoCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"88edfce950dcd5f0ad3a72b55dc791fe2e2e944be9e5cca432d876a4600cdcdc","last_reissued_at":"2026-07-05T09:23:33.810806Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:23:33.810806Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2410.13886","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:23:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"hUKEiWOnhc11XHh7O7/6mHPUbJwmvoYQ0scXW2xb/OS6KEZl8i/9MEI5GuwYb7HeiT+x2XbVyBtG/baoOPRDAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T11:30:22.179280Z"},"content_sha256":"5abe91a17f1921235014229ff02657e9bfb4d0942aeb611f44b72ba45251607b","schema_version":"1.0","event_id":"sha256:5abe91a17f1921235014229ff02657e9bfb4d0942aeb611f44b72ba45251607b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Elaine Chang, Elaine Lau, Matt Fredrikson, Priyanshu Kumar, Saranya Vijayakumar, Scale Red Team, Sean Hendryx, Shuyan Zhou, Summer Yue, Tu Trinh, Vaughn Robinson, Zifan Wang","submitted_at":"2024-10-11T06:54:12Z","abstract_excerpt":"For safety reasons, large language models (LLMs) are trained to refuse harmful user instructions, such as assisting dangerous activities. We study an open question in this work: does the desired safety refusal, typically enforced in chat contexts, generalize to non-chat and agentic use cases? Unlike chatbots, LLM agents equipped with general-purpose tools, such as web browsers and mobile devices, can directly influence the real world, making it even more crucial to refuse harmful instructions. In this work, we primarily focus on red-teaming browser agents, LLMs that manipulate information via "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2410.13886","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2410.13886/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T09:23:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ByP9/xVsJBN7KwvZcj+7al5zgcS7Ks+gIiUMSaLpoFl92OJk9hTsPyPMnMY/CohKsxtMmFtBiPsU7EAZtIBWCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T11:30:22.179782Z"},"content_sha256":"3be043e11268684adcd8e09a0e0fef96a50883f10d45bd2292539f00f67e799c","schema_version":"1.0","event_id":"sha256:3be043e11268684adcd8e09a0e0fef96a50883f10d45bd2292539f00f67e799c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/bundle.json","state_url":"https://pith.science/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T11:30:22Z","links":{"resolver":"https://pith.science/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y","bundle":"https://pith.science/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/bundle.json","state":"https://pith.science/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/state.json","well_known_bundle":"https://pith.science/.well-known/pith/RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:RDW7Z2KQ3TK7BLJ2OK2V3R4R7Y","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c571d8adedd9312322df2cf1bfff0b180e7d16a097006ea1673cc7560ce89b32","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-11T06:54:12Z","title_canon_sha256":"e2a2130242f930bc6230b70827958083541c2fb4b21f183ea4d43d2dbf755573"},"schema_version":"1.0","source":{"id":"2410.13886","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2410.13886","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"arxiv_version","alias_value":"2410.13886v2","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2410.13886","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_12","alias_value":"RDW7Z2KQ3TK7","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_16","alias_value":"RDW7Z2KQ3TK7BLJ2","created_at":"2026-07-05T09:23:33Z"},{"alias_kind":"pith_short_8","alias_value":"RDW7Z2KQ","created_at":"2026-07-05T09:23:33Z"}],"graph_snapshots":[{"event_id":"sha256:3be043e11268684adcd8e09a0e0fef96a50883f10d45bd2292539f00f67e799c","target":"graph","created_at":"2026-07-05T09:23:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2410.13886/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"For safety reasons, large language models (LLMs) are trained to refuse harmful user instructions, such as assisting dangerous activities. We study an open question in this work: does the desired safety refusal, typically enforced in chat contexts, generalize to non-chat and agentic use cases? Unlike chatbots, LLM agents equipped with general-purpose tools, such as web browsers and mobile devices, can directly influence the real world, making it even more crucial to refuse harmful instructions. In this work, we primarily focus on red-teaming browser agents, LLMs that manipulate information via ","authors_text":"Elaine Chang, Elaine Lau, Matt Fredrikson, Priyanshu Kumar, Saranya Vijayakumar, Scale Red Team, Sean Hendryx, Shuyan Zhou, Summer Yue, Tu Trinh, Vaughn Robinson, Zifan Wang","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-11T06:54:12Z","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2410.13886","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5abe91a17f1921235014229ff02657e9bfb4d0942aeb611f44b72ba45251607b","target":"record","created_at":"2026-07-05T09:23:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c571d8adedd9312322df2cf1bfff0b180e7d16a097006ea1673cc7560ce89b32","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-11T06:54:12Z","title_canon_sha256":"e2a2130242f930bc6230b70827958083541c2fb4b21f183ea4d43d2dbf755573"},"schema_version":"1.0","source":{"id":"2410.13886","kind":"arxiv","version":2}},"canonical_sha256":"88edfce950dcd5f0ad3a72b55dc791fe2e2e944be9e5cca432d876a4600cdcdc","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"88edfce950dcd5f0ad3a72b55dc791fe2e2e944be9e5cca432d876a4600cdcdc","first_computed_at":"2026-07-05T09:23:33.810806Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T09:23:33.810806Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ggz7Yw8qTUczN4byGUnBtCvJMy4CExlgY0u8WsUgHrTyuCAXf2NfKhbgYGEWUqLyuejeUi3jQaY6GmqPbFVoCg==","signature_status":"signed_v1","signed_at":"2026-07-05T09:23:33.811331Z","signed_message":"canonical_sha256_bytes"},"source_id":"2410.13886","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5abe91a17f1921235014229ff02657e9bfb4d0942aeb611f44b72ba45251607b","sha256:3be043e11268684adcd8e09a0e0fef96a50883f10d45bd2292539f00f67e799c"],"state_sha256":"0260282fec115cdb66c2c0f7374da23c6e8a1cd5aa3541ea2bf4dcb071dbcd92"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jC0rk6OLSXCwmRXmMDc5hMrd2M2orlLxZcoawMUZokFMfexS2GixDcOsMveq75hAd1wkMKvOxzg80NtC8oM+Aw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T11:30:22.183637Z","bundle_sha256":"372bcf3a62e06aa4482bf0f70a4ab2b3d07bf57ed65779f963272340c7e9f795"}}