{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:UQQL6U5VZKK34XL6CPH7I6BZNJ","short_pith_number":"pith:UQQL6U5V","canonical_record":{"source":{"id":"2605.10067","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-05-11T06:45:00Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"35b42fd74c524fb2ae56d482e309e89ca36e4a775c83acce36a2282667a89675","abstract_canon_sha256":"2682fa13fe16c3987ca46434221cf99691dfc0bb2c306059243a4274b1f4f7f0"},"schema_version":"1.0"},"canonical_sha256":"a420bf53b5ca95be5d7e13cff478396a558af6ddbcfdbcb40b3b67efff57bcef","source":{"kind":"arxiv","id":"2605.10067","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.10067","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"arxiv_version","alias_value":"2605.10067v3","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.10067","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_12","alias_value":"UQQL6U5VZKK3","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_16","alias_value":"UQQL6U5VZKK34XL6","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_8","alias_value":"UQQL6U5V","created_at":"2026-05-22T01:04:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:UQQL6U5VZKK34XL6CPH7I6BZNJ","target":"record","payload":{"canonical_record":{"source":{"id":"2605.10067","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-05-11T06:45:00Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"35b42fd74c524fb2ae56d482e309e89ca36e4a775c83acce36a2282667a89675","abstract_canon_sha256":"2682fa13fe16c3987ca46434221cf99691dfc0bb2c306059243a4274b1f4f7f0"},"schema_version":"1.0"},"canonical_sha256":"a420bf53b5ca95be5d7e13cff478396a558af6ddbcfdbcb40b3b67efff57bcef","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-22T01:04:05.886918Z","signature_b64":"NDRmqiLJ0Odugy0rJS7e58x8CSlOj5qQsuRjnaBe+hySJKKAx4a7sOWC6VGbR+1+vgaqg6u+JDwwifsf2s3mDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a420bf53b5ca95be5d7e13cff478396a558af6ddbcfdbcb40b3b67efff57bcef","last_reissued_at":"2026-05-22T01:04:05.886052Z","signature_status":"signed_v1","first_computed_at":"2026-05-22T01:04:05.886052Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.10067","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-22T01:04:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QLhHIUdLZU8fwpr5xHSxvWs6CHX3GMYtpNCM2grIVjYF4g9fp1mrVCNuDv0rDVKa4i3pMWw9KxCDnOuduY9TCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T21:48:56.775342Z"},"content_sha256":"5a38294b543a87336c11fd9a55153f81a022a25de3dbd2ae67cda278c823771f","schema_version":"1.0","event_id":"sha256:5a38294b543a87336c11fd9a55153f81a022a25de3dbd2ae67cda278c823771f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:UQQL6U5VZKK34XL6CPH7I6BZNJ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks.","cross_cats":["cs.AI"],"primary_cat":"cs.LG","authors_text":"Chi Zhang, Huilin Zhou, Jian Zhao, Lan Zhang, Tianle Zhang, Xiuyuan Chen, Xuelong Li, YiLu Zhong, Yuchen Yuan, Zhen Liang","submitted_at":"2026-05-11T06:45:00Z","abstract_excerpt":"Red teaming is critical for uncovering vulnerabilities in Large Language Models (LLMs). While automated methods have improved scalability, existing approaches often rely on static heuristics or stochastic search, rendering them brittle against advanced safety alignment. To address this, we introduce Metis, a framework that reformulates jailbreaking as inference-time policy optimization within an adversarial Partially Observable Markov Decision Process (POMDP). Metis employs a self-evolving metacognitive loop to perform causal diagnosis of a target's defense logic and leverages structured feedb"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That the structured feedback extracted from target responses can reliably serve as a semantic gradient capable of steering the policy toward successful jailbreaks without the optimization collapsing into ineffective local patterns on advanced aligned models.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Metis achieves 89.2% average attack success rate across 10 LLMs including 76% on o1 and 78% on GPT-5-chat while cutting token cost by 8.2x on average through metacognitive policy optimization in a POMDP.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"9984943c9c539e72bbf7f063a575cc1b090c2c1bdb8a76d8876f0ba72921d0dc"},"source":{"id":"2605.10067","kind":"arxiv","version":3},"verdict":{"id":"c0105c32-b964-4ad0-9c1b-60461206ec2e","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-14T20:46:23.945934Z","strongest_claim":"Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation.","one_line_summary":"Metis achieves 89.2% average attack success rate across 10 LLMs including 76% on o1 and 78% on GPT-5-chat while cutting token cost by 8.2x on average through metacognitive policy optimization in a POMDP.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That the structured feedback extracted from target responses can reliably serve as a semantic gradient capable of steering the policy toward successful jailbreaks without the optimization collapsing into ineffective local patterns on advanced aligned models.","pith_extraction_headline":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.10067/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"claim_evidence","ran_at":"2026-05-20T06:42:01.073468Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-19T15:41:30.783559Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_title_agreement","ran_at":"2026-05-19T12:01:17.937794Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T09:41:58.506809Z","status":"completed","version":"1.0.0","findings_count":0}],"snapshot_sha256":"eb98ac71348f5f8eacdec373f31865440398d5c500b5036c93499d143a2b8082"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"c0105c32-b964-4ad0-9c1b-60461206ec2e"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-22T01:04:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Hv5xnncoV2cqF6lHjzcddtjHD4++YblYQXov8OnXpGlD2BbOsW1zVZYNxHWwHDl0DCzCf56oz+M9Hapo82sJDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T21:48:56.776380Z"},"content_sha256":"ffec785839c1c921fa00ba4a78ffda0c2186d7bab4ea9f851837a3c4d7b3685d","schema_version":"1.0","event_id":"sha256:ffec785839c1c921fa00ba4a78ffda0c2186d7bab4ea9f851837a3c4d7b3685d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/bundle.json","state_url":"https://pith.science/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-28T21:48:56Z","links":{"resolver":"https://pith.science/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ","bundle":"https://pith.science/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/bundle.json","state":"https://pith.science/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/UQQL6U5VZKK34XL6CPH7I6BZNJ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:UQQL6U5VZKK34XL6CPH7I6BZNJ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2682fa13fe16c3987ca46434221cf99691dfc0bb2c306059243a4274b1f4f7f0","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-05-11T06:45:00Z","title_canon_sha256":"35b42fd74c524fb2ae56d482e309e89ca36e4a775c83acce36a2282667a89675"},"schema_version":"1.0","source":{"id":"2605.10067","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.10067","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"arxiv_version","alias_value":"2605.10067v3","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.10067","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_12","alias_value":"UQQL6U5VZKK3","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_16","alias_value":"UQQL6U5VZKK34XL6","created_at":"2026-05-22T01:04:05Z"},{"alias_kind":"pith_short_8","alias_value":"UQQL6U5V","created_at":"2026-05-22T01:04:05Z"}],"graph_snapshots":[{"event_id":"sha256:ffec785839c1c921fa00ba4a78ffda0c2186d7bab4ea9f851837a3c4d7b3685d","target":"graph","created_at":"2026-05-22T01:04:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That the structured feedback extracted from target responses can reliably serve as a semantic gradient capable of steering the policy toward successful jailbreaks without the optimization collapsing into ineffective local patterns on advanced aligned models."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Metis achieves 89.2% average attack success rate across 10 LLMs including 76% on o1 and 78% on GPT-5-chat while cutting token cost by 8.2x on average through metacognitive policy optimization in a POMDP."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks."}],"snapshot_sha256":"9984943c9c539e72bbf7f063a575cc1b090c2c1bdb8a76d8876f0ba72921d0dc"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"claim_evidence","ran_at":"2026-05-20T06:42:01.073468Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-19T15:41:30.783559Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_title_agreement","ran_at":"2026-05-19T12:01:17.937794Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"doi_compliance","ran_at":"2026-05-19T09:41:58.506809Z","status":"completed","version":"1.0.0"}],"endpoint":"/pith/2605.10067/integrity.json","findings":[],"snapshot_sha256":"eb98ac71348f5f8eacdec373f31865440398d5c500b5036c93499d143a2b8082","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Red teaming is critical for uncovering vulnerabilities in Large Language Models (LLMs). While automated methods have improved scalability, existing approaches often rely on static heuristics or stochastic search, rendering them brittle against advanced safety alignment. To address this, we introduce Metis, a framework that reformulates jailbreaking as inference-time policy optimization within an adversarial Partially Observable Markov Decision Process (POMDP). Metis employs a self-evolving metacognitive loop to perform causal diagnosis of a target's defense logic and leverages structured feedb","authors_text":"Chi Zhang, Huilin Zhou, Jian Zhao, Lan Zhang, Tianle Zhang, Xiuyuan Chen, Xuelong Li, YiLu Zhong, Yuchen Yuan, Zhen Liang","cross_cats":["cs.AI"],"headline":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks.","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-05-11T06:45:00Z","title":"Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.10067","kind":"arxiv","version":3},"verdict":{"created_at":"2026-05-14T20:46:23.945934Z","id":"c0105c32-b964-4ad0-9c1b-60461206ec2e","model_set":{"reader":"grok-4.3"},"one_line_summary":"Metis achieves 89.2% average attack success rate across 10 LLMs including 76% on o1 and 78% on GPT-5-chat while cutting token cost by 8.2x on average through metacognitive policy optimization in a POMDP.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"Metis reformulates jailbreaking as inference-time policy optimization in a POMDP that uses a metacognitive loop to diagnose defenses and steer attacks.","strongest_claim":"Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation.","weakest_assumption":"That the structured feedback extracted from target responses can reliably serve as a semantic gradient capable of steering the policy toward successful jailbreaks without the optimization collapsing into ineffective local patterns on advanced aligned models."}},"verdict_id":"c0105c32-b964-4ad0-9c1b-60461206ec2e"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5a38294b543a87336c11fd9a55153f81a022a25de3dbd2ae67cda278c823771f","target":"record","created_at":"2026-05-22T01:04:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2682fa13fe16c3987ca46434221cf99691dfc0bb2c306059243a4274b1f4f7f0","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2026-05-11T06:45:00Z","title_canon_sha256":"35b42fd74c524fb2ae56d482e309e89ca36e4a775c83acce36a2282667a89675"},"schema_version":"1.0","source":{"id":"2605.10067","kind":"arxiv","version":3}},"canonical_sha256":"a420bf53b5ca95be5d7e13cff478396a558af6ddbcfdbcb40b3b67efff57bcef","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a420bf53b5ca95be5d7e13cff478396a558af6ddbcfdbcb40b3b67efff57bcef","first_computed_at":"2026-05-22T01:04:05.886052Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-22T01:04:05.886052Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"NDRmqiLJ0Odugy0rJS7e58x8CSlOj5qQsuRjnaBe+hySJKKAx4a7sOWC6VGbR+1+vgaqg6u+JDwwifsf2s3mDA==","signature_status":"signed_v1","signed_at":"2026-05-22T01:04:05.886918Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.10067","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5a38294b543a87336c11fd9a55153f81a022a25de3dbd2ae67cda278c823771f","sha256:ffec785839c1c921fa00ba4a78ffda0c2186d7bab4ea9f851837a3c4d7b3685d"],"state_sha256":"e5ce18b241ba172fe515967b85ce9e4e479728f7babef5c162fd54a135107f11"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KaTSq9U1GOESjU9YABYTbtrOluHmCKFlWvISuvyj+C6nvtqXe6RkYELQduEUN338buXG/GIJFxhX5D7ocyXYDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-28T21:48:56.781350Z","bundle_sha256":"93a22cc731c6995ec7bff96dd4f1b69fa25311a6d0b5447cc1c2aba9a71d1536"}}