{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:XDLWYNENDCKC5VHSDL63OKRJZQ","short_pith_number":"pith:XDLWYNEN","canonical_record":{"source":{"id":"2605.27545","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-05-26T18:16:22Z","cross_cats_sorted":[],"title_canon_sha256":"6ee979a328dbebe53a2815923c44ae00d83dbb7e5c1ae4b00b0fa64f30e8ee47","abstract_canon_sha256":"bc8630feef37530c056ec6959aed98b0483360e91fa4d240c395ab0a00d798b7"},"schema_version":"1.0"},"canonical_sha256":"b8d76c348d18942ed4f21afdb72a29cc2623341852f759ae6801be58346fba69","source":{"kind":"arxiv","id":"2605.27545","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.27545","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"arxiv_version","alias_value":"2605.27545v1","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.27545","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_12","alias_value":"XDLWYNENDCKC","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_16","alias_value":"XDLWYNENDCKC5VHS","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_8","alias_value":"XDLWYNEN","created_at":"2026-05-28T01:04:15Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:XDLWYNENDCKC5VHSDL63OKRJZQ","target":"record","payload":{"canonical_record":{"source":{"id":"2605.27545","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-05-26T18:16:22Z","cross_cats_sorted":[],"title_canon_sha256":"6ee979a328dbebe53a2815923c44ae00d83dbb7e5c1ae4b00b0fa64f30e8ee47","abstract_canon_sha256":"bc8630feef37530c056ec6959aed98b0483360e91fa4d240c395ab0a00d798b7"},"schema_version":"1.0"},"canonical_sha256":"b8d76c348d18942ed4f21afdb72a29cc2623341852f759ae6801be58346fba69","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-28T01:04:15.127647Z","signature_b64":"+wP/yWIQqX4SoUYS4I1Y6HrcjGQJZdXGU14jJbWbnchh9N3L0/Wg2ogf2+IXvL8e8qDm3M/K08NkEJcW5R2QBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b8d76c348d18942ed4f21afdb72a29cc2623341852f759ae6801be58346fba69","last_reissued_at":"2026-05-28T01:04:15.126848Z","signature_status":"signed_v1","first_computed_at":"2026-05-28T01:04:15.126848Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.27545","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-28T01:04:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qHNA0+JFwKQwHb0GkDK+NjoB7oA++kBAMBH7qgUIrvoZ5a0Ga1+DghNnQ87iUM1izEuztLgI8lKJPAGZv6GbCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T22:03:08.966568Z"},"content_sha256":"0a231dbf033ac70d75ddfd94a64434c314049352a92548432519f08554fd6bf0","schema_version":"1.0","event_id":"sha256:0a231dbf033ac70d75ddfd94a64434c314049352a92548432519f08554fd6bf0"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:XDLWYNENDCKC5VHSDL63OKRJZQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PAST2HARM: A Simple Adaptive Past Tense Attack for Jailbreaking Multimodal AI","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CL","authors_text":"Snehasis Mukhopadhyay","submitted_at":"2026-05-26T18:16:22Z","abstract_excerpt":"Jailbreak attacks on multimodal AI systems remain underexplored, even though unsafe image generation can have more severe consequences than unsafe text and current defenses are relatively immature. We introduce PAST2HARM, a simple yet effective adaptive jailbreak framework that bypasses refusal training in state of the art multimodal text to image models. Building on prior findings that past tense reformulations can evade safeguards, PAST2HARM systematically exploits this vulnerability in multimodal generative AI.\n  We characterize the attack along two dimensions. First, breadth: through tempo"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.27545","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.27545/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-28T01:04:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"T4wtMUEVdvn1AifAaUWZJ0mTWqdFR21OtOevOvajf52ZD82h2VoaPmPx/Dt1C2aai3Vy6RIufloo+8uzMdojCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T22:03:08.966945Z"},"content_sha256":"2a0eca62b92e09df6bc465f0ac57ef7fa3f16590ab69da8e3577e30d9cbde70d","schema_version":"1.0","event_id":"sha256:2a0eca62b92e09df6bc465f0ac57ef7fa3f16590ab69da8e3577e30d9cbde70d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/bundle.json","state_url":"https://pith.science/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T22:03:08Z","links":{"resolver":"https://pith.science/pith/XDLWYNENDCKC5VHSDL63OKRJZQ","bundle":"https://pith.science/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/bundle.json","state":"https://pith.science/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XDLWYNENDCKC5VHSDL63OKRJZQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:XDLWYNENDCKC5VHSDL63OKRJZQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bc8630feef37530c056ec6959aed98b0483360e91fa4d240c395ab0a00d798b7","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-05-26T18:16:22Z","title_canon_sha256":"6ee979a328dbebe53a2815923c44ae00d83dbb7e5c1ae4b00b0fa64f30e8ee47"},"schema_version":"1.0","source":{"id":"2605.27545","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.27545","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"arxiv_version","alias_value":"2605.27545v1","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.27545","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_12","alias_value":"XDLWYNENDCKC","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_16","alias_value":"XDLWYNENDCKC5VHS","created_at":"2026-05-28T01:04:15Z"},{"alias_kind":"pith_short_8","alias_value":"XDLWYNEN","created_at":"2026-05-28T01:04:15Z"}],"graph_snapshots":[{"event_id":"sha256:2a0eca62b92e09df6bc465f0ac57ef7fa3f16590ab69da8e3577e30d9cbde70d","target":"graph","created_at":"2026-05-28T01:04:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.27545/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Jailbreak attacks on multimodal AI systems remain underexplored, even though unsafe image generation can have more severe consequences than unsafe text and current defenses are relatively immature. We introduce PAST2HARM, a simple yet effective adaptive jailbreak framework that bypasses refusal training in state of the art multimodal text to image models. Building on prior findings that past tense reformulations can evade safeguards, PAST2HARM systematically exploits this vulnerability in multimodal generative AI.\n  We characterize the attack along two dimensions. First, breadth: through tempo","authors_text":"Snehasis Mukhopadhyay","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-05-26T18:16:22Z","title":"PAST2HARM: A Simple Adaptive Past Tense Attack for Jailbreaking Multimodal AI"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.27545","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0a231dbf033ac70d75ddfd94a64434c314049352a92548432519f08554fd6bf0","target":"record","created_at":"2026-05-28T01:04:15Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bc8630feef37530c056ec6959aed98b0483360e91fa4d240c395ab0a00d798b7","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2026-05-26T18:16:22Z","title_canon_sha256":"6ee979a328dbebe53a2815923c44ae00d83dbb7e5c1ae4b00b0fa64f30e8ee47"},"schema_version":"1.0","source":{"id":"2605.27545","kind":"arxiv","version":1}},"canonical_sha256":"b8d76c348d18942ed4f21afdb72a29cc2623341852f759ae6801be58346fba69","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b8d76c348d18942ed4f21afdb72a29cc2623341852f759ae6801be58346fba69","first_computed_at":"2026-05-28T01:04:15.126848Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-28T01:04:15.126848Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+wP/yWIQqX4SoUYS4I1Y6HrcjGQJZdXGU14jJbWbnchh9N3L0/Wg2ogf2+IXvL8e8qDm3M/K08NkEJcW5R2QBw==","signature_status":"signed_v1","signed_at":"2026-05-28T01:04:15.127647Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.27545","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0a231dbf033ac70d75ddfd94a64434c314049352a92548432519f08554fd6bf0","sha256:2a0eca62b92e09df6bc465f0ac57ef7fa3f16590ab69da8e3577e30d9cbde70d"],"state_sha256":"96ba4931e79e6499fa8b08bafdad5255188186330c87037e54bd0ff1d4cd6685"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xE7Rt5+7NNGRe6BW6n+gaRnwsRD1Mc3o0oMK7QELQgbx5NbaJcVouZs6tv4Y/2Xl/wo/qdIl0Elg2ts9jWenAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T22:03:08.969127Z","bundle_sha256":"620c028a70ae64a7a20fcae5dda2e07c2e01e7340f696e6ea0476b35b0297e64"}}