{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:SBQ4WR5GNDEL2ENVD4TXWHT4TZ","short_pith_number":"pith:SBQ4WR5G","canonical_record":{"source":{"id":"2503.08644","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-03-11T17:36:53Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"91e144e472d0dc60008a8130af9fe84aef56859a7271a7acc5a491e3dd00424e","abstract_canon_sha256":"37423b6ba8efc7c41dd74c3b2a7e0014e2c1866f9bc738a3515c458455a11efc"},"schema_version":"1.0"},"canonical_sha256":"9061cb47a668c8bd11b51f277b1e7c9e47a53ad2e65d09032d37867fa2109f68","source":{"kind":"arxiv","id":"2503.08644","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.08644","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"arxiv_version","alias_value":"2503.08644v1","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.08644","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_12","alias_value":"SBQ4WR5GNDEL","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_16","alias_value":"SBQ4WR5GNDEL2ENV","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_8","alias_value":"SBQ4WR5G","created_at":"2026-07-05T10:29:04Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:SBQ4WR5GNDEL2ENVD4TXWHT4TZ","target":"record","payload":{"canonical_record":{"source":{"id":"2503.08644","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-03-11T17:36:53Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"91e144e472d0dc60008a8130af9fe84aef56859a7271a7acc5a491e3dd00424e","abstract_canon_sha256":"37423b6ba8efc7c41dd74c3b2a7e0014e2c1866f9bc738a3515c458455a11efc"},"schema_version":"1.0"},"canonical_sha256":"9061cb47a668c8bd11b51f277b1e7c9e47a53ad2e65d09032d37867fa2109f68","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:29:04.085026Z","signature_b64":"/vNCX2ygr4fwiPMiRrJ0RAtd+kPGqwG6y2BhzRLeRuamGmvC425SVuDueHVAB7BEcnL1fEUemmZ5MlIB4EH8AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9061cb47a668c8bd11b51f277b1e7c9e47a53ad2e65d09032d37867fa2109f68","last_reissued_at":"2026-07-05T10:29:04.084312Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:29:04.084312Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.08644","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:29:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CSuss98U9ss6mIR8KAr7NGMfaFJ1QjV8Z+QcEvLl34dq0ZsE5ZgLt7QeIisxQ81dKu8hWhH7qeI4UBUEY99nAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T23:15:05.649883Z"},"content_sha256":"08563a2461e048f8b50649c64e02b889f0d231d31e53706f973d6e1b95481697","schema_version":"1.0","event_id":"sha256:08563a2461e048f8b50649c64e02b889f0d231d31e53706f973d6e1b95481697"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:SBQ4WR5GNDEL2ENVD4TXWHT4TZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Exploiting Instruction-Following Retrievers for Malicious Information Retrieval","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CL","authors_text":"Nicholas Meade, Parishad BehnamGhader, Siva Reddy","submitted_at":"2025-03-11T17:36:53Z","abstract_excerpt":"Instruction-following retrievers have been widely adopted alongside LLMs in real-world applications, but little work has investigated the safety risks surrounding their increasing search capabilities. We empirically study the ability of retrievers to satisfy malicious queries, both when used directly and when used in a retrieval augmented generation-based setup. Concretely, we investigate six leading retrievers, including NV-Embed and LLM2Vec, and find that given malicious requests, most retrievers can (for >50% of queries) select relevant harmful passages. For example, LLM2Vec correctly selec"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.08644","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.08644/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:29:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"mLo410UbbaiNs8N+lKquhFf43iuxw/Fu2icWxBFnj7NoB7iJKt9fEZwYkspEbZ5xYsiUpI09jyJ8lRRutqqYBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T23:15:05.650464Z"},"content_sha256":"84a5af98fecac8b8012ea0055b66c4aacad9029653823dfe6c94ec29017f0c9c","schema_version":"1.0","event_id":"sha256:84a5af98fecac8b8012ea0055b66c4aacad9029653823dfe6c94ec29017f0c9c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/bundle.json","state_url":"https://pith.science/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T23:15:05Z","links":{"resolver":"https://pith.science/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ","bundle":"https://pith.science/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/bundle.json","state":"https://pith.science/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SBQ4WR5GNDEL2ENVD4TXWHT4TZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:SBQ4WR5GNDEL2ENVD4TXWHT4TZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"37423b6ba8efc7c41dd74c3b2a7e0014e2c1866f9bc738a3515c458455a11efc","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-03-11T17:36:53Z","title_canon_sha256":"91e144e472d0dc60008a8130af9fe84aef56859a7271a7acc5a491e3dd00424e"},"schema_version":"1.0","source":{"id":"2503.08644","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.08644","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"arxiv_version","alias_value":"2503.08644v1","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.08644","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_12","alias_value":"SBQ4WR5GNDEL","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_16","alias_value":"SBQ4WR5GNDEL2ENV","created_at":"2026-07-05T10:29:04Z"},{"alias_kind":"pith_short_8","alias_value":"SBQ4WR5G","created_at":"2026-07-05T10:29:04Z"}],"graph_snapshots":[{"event_id":"sha256:84a5af98fecac8b8012ea0055b66c4aacad9029653823dfe6c94ec29017f0c9c","target":"graph","created_at":"2026-07-05T10:29:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.08644/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Instruction-following retrievers have been widely adopted alongside LLMs in real-world applications, but little work has investigated the safety risks surrounding their increasing search capabilities. We empirically study the ability of retrievers to satisfy malicious queries, both when used directly and when used in a retrieval augmented generation-based setup. Concretely, we investigate six leading retrievers, including NV-Embed and LLM2Vec, and find that given malicious requests, most retrievers can (for >50% of queries) select relevant harmful passages. For example, LLM2Vec correctly selec","authors_text":"Nicholas Meade, Parishad BehnamGhader, Siva Reddy","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-03-11T17:36:53Z","title":"Exploiting Instruction-Following Retrievers for Malicious Information Retrieval"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.08644","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:08563a2461e048f8b50649c64e02b889f0d231d31e53706f973d6e1b95481697","target":"record","created_at":"2026-07-05T10:29:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"37423b6ba8efc7c41dd74c3b2a7e0014e2c1866f9bc738a3515c458455a11efc","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-03-11T17:36:53Z","title_canon_sha256":"91e144e472d0dc60008a8130af9fe84aef56859a7271a7acc5a491e3dd00424e"},"schema_version":"1.0","source":{"id":"2503.08644","kind":"arxiv","version":1}},"canonical_sha256":"9061cb47a668c8bd11b51f277b1e7c9e47a53ad2e65d09032d37867fa2109f68","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9061cb47a668c8bd11b51f277b1e7c9e47a53ad2e65d09032d37867fa2109f68","first_computed_at":"2026-07-05T10:29:04.084312Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:29:04.084312Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"/vNCX2ygr4fwiPMiRrJ0RAtd+kPGqwG6y2BhzRLeRuamGmvC425SVuDueHVAB7BEcnL1fEUemmZ5MlIB4EH8AA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:29:04.085026Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.08644","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:08563a2461e048f8b50649c64e02b889f0d231d31e53706f973d6e1b95481697","sha256:84a5af98fecac8b8012ea0055b66c4aacad9029653823dfe6c94ec29017f0c9c"],"state_sha256":"767df8d5238605a43bb610acfe42fbadd13043ec87096027b65f53f9a423f8a4"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Do3dH5VCv3+i8mFu7qq/GX/Oz+4BF+0LG7EE6Oxf4di1ROFdda9ZQjWWq7c5ghhUZvkONJ/I07l3kKpC0AhnAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T23:15:05.656555Z","bundle_sha256":"b6be2fe945e3b93481f5b7365876df4538ec136fbacb3781f29b124f2eecd273"}}