{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:X4P3WV5SBRQCUJWJCU6D2GKC3T","short_pith_number":"pith:X4P3WV5S","canonical_record":{"source":{"id":"2409.08045","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-12T13:50:22Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3d013d5493ab37da8a62e7892ad83f20018b57985f014e4baa1c23704812d6a8","abstract_canon_sha256":"94d2c9df4afadbc2ead1858733a0d32d757d83a9ff3a23b5588bdc92d3225244"},"schema_version":"1.0"},"canonical_sha256":"bf1fbb57b20c602a26c9153c3d1942dce199b60b793d7866e13e2b9c24cad140","source":{"kind":"arxiv","id":"2409.08045","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.08045","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"arxiv_version","alias_value":"2409.08045v1","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.08045","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_12","alias_value":"X4P3WV5SBRQC","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_16","alias_value":"X4P3WV5SBRQCUJWJ","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_8","alias_value":"X4P3WV5S","created_at":"2026-07-05T10:07:01Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:X4P3WV5SBRQCUJWJCU6D2GKC3T","target":"record","payload":{"canonical_record":{"source":{"id":"2409.08045","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-12T13:50:22Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3d013d5493ab37da8a62e7892ad83f20018b57985f014e4baa1c23704812d6a8","abstract_canon_sha256":"94d2c9df4afadbc2ead1858733a0d32d757d83a9ff3a23b5588bdc92d3225244"},"schema_version":"1.0"},"canonical_sha256":"bf1fbb57b20c602a26c9153c3d1942dce199b60b793d7866e13e2b9c24cad140","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:07:01.729121Z","signature_b64":"7mUJae6HRooaZh3Nfhcd8A+6qZzBXyp0PfzZ25solv417gr0dBhfTxNG6CeeBjgWtzgumZu1+Qd0V/ZY7CtrCQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"bf1fbb57b20c602a26c9153c3d1942dce199b60b793d7866e13e2b9c24cad140","last_reissued_at":"2026-07-05T10:07:01.728686Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:07:01.728686Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2409.08045","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NR5trM76wEUmBAu+U4LPtjMmRnUYyLKHTyRIR7oKJWJIfBCZmFOsNeJHDXXvUtFJMatJFtfqHMfMMNF9wmPsCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T08:26:17.590659Z"},"content_sha256":"89a29b1da8c9b5666e726b8fe6b915740a70b06535c186345d7892e55f8fa14b","schema_version":"1.0","event_id":"sha256:89a29b1da8c9b5666e726b8fe6b915740a70b06535c186345d7892e55f8fa14b"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:X4P3WV5SBRQCUJWJCU6D2GKC3T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Ben Nassi, Ron Bitton, Stav Cohen","submitted_at":"2024-09-12T13:50:22Z","abstract_excerpt":"In this paper, we show that with the ability to jailbreak a GenAI model, attackers can escalate the outcome of attacks against RAG-based GenAI-powered applications in severity and scale. In the first part of the paper, we show that attackers can escalate RAG membership inference attacks and RAG entity extraction attacks to RAG documents extraction attacks, forcing a more severe outcome compared to existing attacks. We evaluate the results obtained from three extraction methods, the influence of the type and the size of five embeddings algorithms employed, the size of the provided context, and "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.08045","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2409.08045/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IyBVr+j5UGWwC66i7/1rJMxHJ9Reepx3bz/gMkyZyQ3gw+w4avxMCbrsmavB3ahjItVoZq6rVgBXea5QdgbOCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T08:26:17.591151Z"},"content_sha256":"5e5cd1e28d520534dddcf65a0de87e86b04a2585e5a0e315b0b6e70eeac554d4","schema_version":"1.0","event_id":"sha256:5e5cd1e28d520534dddcf65a0de87e86b04a2585e5a0e315b0b6e70eeac554d4"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/bundle.json","state_url":"https://pith.science/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T08:26:17Z","links":{"resolver":"https://pith.science/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T","bundle":"https://pith.science/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/bundle.json","state":"https://pith.science/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/X4P3WV5SBRQCUJWJCU6D2GKC3T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:X4P3WV5SBRQCUJWJCU6D2GKC3T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"94d2c9df4afadbc2ead1858733a0d32d757d83a9ff3a23b5588bdc92d3225244","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-12T13:50:22Z","title_canon_sha256":"3d013d5493ab37da8a62e7892ad83f20018b57985f014e4baa1c23704812d6a8"},"schema_version":"1.0","source":{"id":"2409.08045","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2409.08045","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"arxiv_version","alias_value":"2409.08045v1","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2409.08045","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_12","alias_value":"X4P3WV5SBRQC","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_16","alias_value":"X4P3WV5SBRQCUJWJ","created_at":"2026-07-05T10:07:01Z"},{"alias_kind":"pith_short_8","alias_value":"X4P3WV5S","created_at":"2026-07-05T10:07:01Z"}],"graph_snapshots":[{"event_id":"sha256:5e5cd1e28d520534dddcf65a0de87e86b04a2585e5a0e315b0b6e70eeac554d4","target":"graph","created_at":"2026-07-05T10:07:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2409.08045/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper, we show that with the ability to jailbreak a GenAI model, attackers can escalate the outcome of attacks against RAG-based GenAI-powered applications in severity and scale. In the first part of the paper, we show that attackers can escalate RAG membership inference attacks and RAG entity extraction attacks to RAG documents extraction attacks, forcing a more severe outcome compared to existing attacks. We evaluate the results obtained from three extraction methods, the influence of the type and the size of five embeddings algorithms employed, the size of the provided context, and ","authors_text":"Ben Nassi, Ron Bitton, Stav Cohen","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-12T13:50:22Z","title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2409.08045","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:89a29b1da8c9b5666e726b8fe6b915740a70b06535c186345d7892e55f8fa14b","target":"record","created_at":"2026-07-05T10:07:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"94d2c9df4afadbc2ead1858733a0d32d757d83a9ff3a23b5588bdc92d3225244","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-09-12T13:50:22Z","title_canon_sha256":"3d013d5493ab37da8a62e7892ad83f20018b57985f014e4baa1c23704812d6a8"},"schema_version":"1.0","source":{"id":"2409.08045","kind":"arxiv","version":1}},"canonical_sha256":"bf1fbb57b20c602a26c9153c3d1942dce199b60b793d7866e13e2b9c24cad140","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"bf1fbb57b20c602a26c9153c3d1942dce199b60b793d7866e13e2b9c24cad140","first_computed_at":"2026-07-05T10:07:01.728686Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:07:01.728686Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"7mUJae6HRooaZh3Nfhcd8A+6qZzBXyp0PfzZ25solv417gr0dBhfTxNG6CeeBjgWtzgumZu1+Qd0V/ZY7CtrCQ==","signature_status":"signed_v1","signed_at":"2026-07-05T10:07:01.729121Z","signed_message":"canonical_sha256_bytes"},"source_id":"2409.08045","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:89a29b1da8c9b5666e726b8fe6b915740a70b06535c186345d7892e55f8fa14b","sha256:5e5cd1e28d520534dddcf65a0de87e86b04a2585e5a0e315b0b6e70eeac554d4"],"state_sha256":"2b7c7cf3938d9e0c2113f0ddcbda80efa2b2c4e311e73fad1b3346a273e3fabb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"aPtzuDbhKSGB9TNT/8Y6/ZDWKSjC2yt8SA4L6iJ3h3D6UY7d8KEaAuzkVD/iite5b7kT8imuKVTJFhc8uMa5DA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T08:26:17.594724Z","bundle_sha256":"a9944cf52fce1bc4e4a66df7fd8d0aa0ab323e5bf0745af0e0788de596fd692b"}}