{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:VSW4I5D4W3IS5OOZJ4S26G32LK","short_pith_number":"pith:VSW4I5D4","canonical_record":{"source":{"id":"2508.19287","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-25T05:20:11Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"eac5893f6bd2192b4cce17a40241c135379bf63f1988ab27b6d565ba714cc03a","abstract_canon_sha256":"fc27919c8739b4e0ebde943eda8af3e3f070c83bc51fc5599d52a5304f462cc6"},"schema_version":"1.0"},"canonical_sha256":"acadc4747cb6d12eb9d94f25af1b7a5abac0c08b9e68f8151c39c633cf0545f2","source":{"kind":"arxiv","id":"2508.19287","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.19287","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"arxiv_version","alias_value":"2508.19287v1","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.19287","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_12","alias_value":"VSW4I5D4W3IS","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_16","alias_value":"VSW4I5D4W3IS5OOZ","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_8","alias_value":"VSW4I5D4","created_at":"2026-07-05T11:59:42Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:VSW4I5D4W3IS5OOZJ4S26G32LK","target":"record","payload":{"canonical_record":{"source":{"id":"2508.19287","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-25T05:20:11Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"eac5893f6bd2192b4cce17a40241c135379bf63f1988ab27b6d565ba714cc03a","abstract_canon_sha256":"fc27919c8739b4e0ebde943eda8af3e3f070c83bc51fc5599d52a5304f462cc6"},"schema_version":"1.0"},"canonical_sha256":"acadc4747cb6d12eb9d94f25af1b7a5abac0c08b9e68f8151c39c633cf0545f2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:59:42.426035Z","signature_b64":"qWkLVZ6MwT40aloCkys2LPkQrkus+t/qRuMuF/dEuFXhVun68SbZf8kJaUuwo2VFTS8N584BuCvgTebfLb8rBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"acadc4747cb6d12eb9d94f25af1b7a5abac0c08b9e68f8151c39c633cf0545f2","last_reissued_at":"2026-07-05T11:59:42.425588Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:59:42.425588Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.19287","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:59:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YgpJfYChol4R6yvFSqwuRcdaFvunB3eaYFApbv8yVe4qghIM0qw71MI1SK5wLqbamzaw+Dv2QQ5+2Oi9FGRzDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T20:00:14.071692Z"},"content_sha256":"862f3416ef76d72260034e43b333b5c986f3e418467e97f6e36e1637664dd21a","schema_version":"1.0","event_id":"sha256:862f3416ef76d72260034e43b333b5c986f3e418467e97f6e36e1637664dd21a"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:VSW4I5D4W3IS5OOZJ4S26G32LK","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Prompt-in-Content Attacks: Exploiting Uploaded Inputs to Hijack LLM Behavior","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Chunhua Su, Qingkui Zeng, Teruaki Kitasuka, Toru Nakanishi, Weiyu Wang, Zhuotao Lian","submitted_at":"2025-08-25T05:20:11Z","abstract_excerpt":"Large Language Models (LLMs) are widely deployed in applications that accept user-submitted content, such as uploaded documents or pasted text, for tasks like summarization and question answering. In this paper, we identify a new class of attacks, prompt in content injection, where adversarial instructions are embedded in seemingly benign inputs. When processed by the LLM, these hidden prompts can manipulate outputs without user awareness or system compromise, leading to biased summaries, fabricated claims, or misleading suggestions. We demonstrate the feasibility of such attacks across popula"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.19287","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.19287/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:59:42Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8uZG81heo4GDDAVX7h+dHoIf9v3r174bDIIu5C807ApfBE/LH8oXWFVS1yQ8qLaV635jyp2b4kuGLY4tsW/WBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T20:00:14.072416Z"},"content_sha256":"a973deb80f373f67995d4db721aa3dd67013b501e027a8dea3aa44d3a0b301e1","schema_version":"1.0","event_id":"sha256:a973deb80f373f67995d4db721aa3dd67013b501e027a8dea3aa44d3a0b301e1"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/bundle.json","state_url":"https://pith.science/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T20:00:14Z","links":{"resolver":"https://pith.science/pith/VSW4I5D4W3IS5OOZJ4S26G32LK","bundle":"https://pith.science/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/bundle.json","state":"https://pith.science/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/state.json","well_known_bundle":"https://pith.science/.well-known/pith/VSW4I5D4W3IS5OOZJ4S26G32LK/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:VSW4I5D4W3IS5OOZJ4S26G32LK","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"fc27919c8739b4e0ebde943eda8af3e3f070c83bc51fc5599d52a5304f462cc6","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-25T05:20:11Z","title_canon_sha256":"eac5893f6bd2192b4cce17a40241c135379bf63f1988ab27b6d565ba714cc03a"},"schema_version":"1.0","source":{"id":"2508.19287","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.19287","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"arxiv_version","alias_value":"2508.19287v1","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.19287","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_12","alias_value":"VSW4I5D4W3IS","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_16","alias_value":"VSW4I5D4W3IS5OOZ","created_at":"2026-07-05T11:59:42Z"},{"alias_kind":"pith_short_8","alias_value":"VSW4I5D4","created_at":"2026-07-05T11:59:42Z"}],"graph_snapshots":[{"event_id":"sha256:a973deb80f373f67995d4db721aa3dd67013b501e027a8dea3aa44d3a0b301e1","target":"graph","created_at":"2026-07-05T11:59:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.19287/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) are widely deployed in applications that accept user-submitted content, such as uploaded documents or pasted text, for tasks like summarization and question answering. In this paper, we identify a new class of attacks, prompt in content injection, where adversarial instructions are embedded in seemingly benign inputs. When processed by the LLM, these hidden prompts can manipulate outputs without user awareness or system compromise, leading to biased summaries, fabricated claims, or misleading suggestions. We demonstrate the feasibility of such attacks across popula","authors_text":"Chunhua Su, Qingkui Zeng, Teruaki Kitasuka, Toru Nakanishi, Weiyu Wang, Zhuotao Lian","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-25T05:20:11Z","title":"Prompt-in-Content Attacks: Exploiting Uploaded Inputs to Hijack LLM Behavior"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.19287","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:862f3416ef76d72260034e43b333b5c986f3e418467e97f6e36e1637664dd21a","target":"record","created_at":"2026-07-05T11:59:42Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"fc27919c8739b4e0ebde943eda8af3e3f070c83bc51fc5599d52a5304f462cc6","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-25T05:20:11Z","title_canon_sha256":"eac5893f6bd2192b4cce17a40241c135379bf63f1988ab27b6d565ba714cc03a"},"schema_version":"1.0","source":{"id":"2508.19287","kind":"arxiv","version":1}},"canonical_sha256":"acadc4747cb6d12eb9d94f25af1b7a5abac0c08b9e68f8151c39c633cf0545f2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"acadc4747cb6d12eb9d94f25af1b7a5abac0c08b9e68f8151c39c633cf0545f2","first_computed_at":"2026-07-05T11:59:42.425588Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:59:42.425588Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"qWkLVZ6MwT40aloCkys2LPkQrkus+t/qRuMuF/dEuFXhVun68SbZf8kJaUuwo2VFTS8N584BuCvgTebfLb8rBA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:59:42.426035Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.19287","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:862f3416ef76d72260034e43b333b5c986f3e418467e97f6e36e1637664dd21a","sha256:a973deb80f373f67995d4db721aa3dd67013b501e027a8dea3aa44d3a0b301e1"],"state_sha256":"2efac9eba3651b49fec3d67fe9a54e1fdcc33a345601bb93fc333ccf0b6eb04c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vGLnixIGAsjkRE+X5m0xl4y366hiqoibFW2dZUKr5m+2+wOxEb+njNSthFLaBPmMwL92wIjvcxxqOunadKndCQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T20:00:14.078718Z","bundle_sha256":"3a923016a612d11d9e523b09ac4732ff6fcdd507feae4e850ac695c1f9697173"}}