{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:SFG7YWVY6OBF2I3VDYNAFITSIV","short_pith_number":"pith:SFG7YWVY","canonical_record":{"source":{"id":"2504.11168","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-15T13:16:02Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"e26c25e4dd0d9973636f8b25fca37b1e263309f1d0251838df5b16e736576a66","abstract_canon_sha256":"6b87bccf499cbf355bc5aaec239785226653971f3d9eda70500ce8c9e24c9cde"},"schema_version":"1.0"},"canonical_sha256":"914dfc5ab8f3825d23751e1a02a272454fdadd45ca09d14a001cadf2043167f4","source":{"kind":"arxiv","id":"2504.11168","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.11168","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"arxiv_version","alias_value":"2504.11168v3","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.11168","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_12","alias_value":"SFG7YWVY6OBF","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_16","alias_value":"SFG7YWVY6OBF2I3V","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_8","alias_value":"SFG7YWVY","created_at":"2026-07-05T11:36:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:SFG7YWVY6OBF2I3VDYNAFITSIV","target":"record","payload":{"canonical_record":{"source":{"id":"2504.11168","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-15T13:16:02Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"e26c25e4dd0d9973636f8b25fca37b1e263309f1d0251838df5b16e736576a66","abstract_canon_sha256":"6b87bccf499cbf355bc5aaec239785226653971f3d9eda70500ce8c9e24c9cde"},"schema_version":"1.0"},"canonical_sha256":"914dfc5ab8f3825d23751e1a02a272454fdadd45ca09d14a001cadf2043167f4","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:36:30.760353Z","signature_b64":"uzWJ+YJCwDQTiyDYihKl7WzuNkntnHcq37anEiNH7+cjMTl64tmNyeCPSp/DusUDo7m+AL0qgKbkP63BUEdeAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"914dfc5ab8f3825d23751e1a02a272454fdadd45ca09d14a001cadf2043167f4","last_reissued_at":"2026-07-05T11:36:30.759870Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:36:30.759870Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2504.11168","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:36:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KfIvNcWMAspyS37Syr57gFcX+SVjWRJlKS/SMzjYuTUbjxGM5AaKkNu5AH1/n9rgAgmCQqH9lpiOF66yVrzXDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T06:09:27.331147Z"},"content_sha256":"2f736f7718e851d6ace7b742b3c3ea29b61fc4a10825543a0e854674c3150de7","schema_version":"1.0","event_id":"sha256:2f736f7718e851d6ace7b742b3c3ea29b61fc4a10825543a0e854674c3150de7"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:SFG7YWVY6OBF2I3VDYNAFITSIV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.LG"],"primary_cat":"cs.CR","authors_text":"Lewis Birch, Neeraj Suri, Peter Garraghan, Stefan Trawicki, William Hackett","submitted_at":"2025-04-15T13:16:02Z","abstract_excerpt":"Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques. We demonstrate two approaches for bypassing LLM prompt injection and jailbreak detection systems via traditional character injection methods and algorithmic Adversarial Machine Learning (AML) evasion techniques. Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial ut"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.11168","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2504.11168/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:36:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qL/1Zg51IBlodjhWu0b24TbuxL472XM4qCegmMJoUQg/Nt5lirLgolwJc92P4yBt2G614watpVjc66SrI++2BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T06:09:27.331740Z"},"content_sha256":"d8725365ae355a72393f8fe051d495e17cf11ad50ce98c68b1aaeda72432611a","schema_version":"1.0","event_id":"sha256:d8725365ae355a72393f8fe051d495e17cf11ad50ce98c68b1aaeda72432611a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/bundle.json","state_url":"https://pith.science/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T06:09:27Z","links":{"resolver":"https://pith.science/pith/SFG7YWVY6OBF2I3VDYNAFITSIV","bundle":"https://pith.science/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/bundle.json","state":"https://pith.science/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SFG7YWVY6OBF2I3VDYNAFITSIV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:SFG7YWVY6OBF2I3VDYNAFITSIV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6b87bccf499cbf355bc5aaec239785226653971f3d9eda70500ce8c9e24c9cde","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-15T13:16:02Z","title_canon_sha256":"e26c25e4dd0d9973636f8b25fca37b1e263309f1d0251838df5b16e736576a66"},"schema_version":"1.0","source":{"id":"2504.11168","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2504.11168","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"arxiv_version","alias_value":"2504.11168v3","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2504.11168","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_12","alias_value":"SFG7YWVY6OBF","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_16","alias_value":"SFG7YWVY6OBF2I3V","created_at":"2026-07-05T11:36:30Z"},{"alias_kind":"pith_short_8","alias_value":"SFG7YWVY","created_at":"2026-07-05T11:36:30Z"}],"graph_snapshots":[{"event_id":"sha256:d8725365ae355a72393f8fe051d495e17cf11ad50ce98c68b1aaeda72432611a","target":"graph","created_at":"2026-07-05T11:36:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2504.11168/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques. We demonstrate two approaches for bypassing LLM prompt injection and jailbreak detection systems via traditional character injection methods and algorithmic Adversarial Machine Learning (AML) evasion techniques. Through testing against six prominent protection systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard, we show that both methods can be used to evade detection while maintaining adversarial ut","authors_text":"Lewis Birch, Neeraj Suri, Peter Garraghan, Stefan Trawicki, William Hackett","cross_cats":["cs.AI","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-15T13:16:02Z","title":"Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2504.11168","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2f736f7718e851d6ace7b742b3c3ea29b61fc4a10825543a0e854674c3150de7","target":"record","created_at":"2026-07-05T11:36:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6b87bccf499cbf355bc5aaec239785226653971f3d9eda70500ce8c9e24c9cde","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-04-15T13:16:02Z","title_canon_sha256":"e26c25e4dd0d9973636f8b25fca37b1e263309f1d0251838df5b16e736576a66"},"schema_version":"1.0","source":{"id":"2504.11168","kind":"arxiv","version":3}},"canonical_sha256":"914dfc5ab8f3825d23751e1a02a272454fdadd45ca09d14a001cadf2043167f4","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"914dfc5ab8f3825d23751e1a02a272454fdadd45ca09d14a001cadf2043167f4","first_computed_at":"2026-07-05T11:36:30.759870Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:36:30.759870Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uzWJ+YJCwDQTiyDYihKl7WzuNkntnHcq37anEiNH7+cjMTl64tmNyeCPSp/DusUDo7m+AL0qgKbkP63BUEdeAg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:36:30.760353Z","signed_message":"canonical_sha256_bytes"},"source_id":"2504.11168","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2f736f7718e851d6ace7b742b3c3ea29b61fc4a10825543a0e854674c3150de7","sha256:d8725365ae355a72393f8fe051d495e17cf11ad50ce98c68b1aaeda72432611a"],"state_sha256":"7045c8c207843f649284e17f64d675a96545c18d8bbe2dee4dd995855797fd61"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9H9ob8U9idsGXiQEs/XD8ZpwFZ7ZaDxuusBjSuZS1K2Td+/wRL3VhU665VMCF9B1A2b+EoMkQ56BEsfXU+dIBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T06:09:27.337138Z","bundle_sha256":"6133c1986cee3ddb307107452fcbeda56f5b89a1b32eb803c5192ebb65188daa"}}