{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:YIT2SJPV37O3OH6NOTKLY5O5GX","short_pith_number":"pith:YIT2SJPV","canonical_record":{"source":{"id":"2411.01705","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-03T22:27:40Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"8f741665824ce02e6079d54690a39f3b25770af7d3fda4f23dab965a8f947522","abstract_canon_sha256":"78223ede1401c8fc1b0231e620a758fad1361a33868af74bf8badf2c333edca8"},"schema_version":"1.0"},"canonical_sha256":"c227a925f5dfddb71fcd74d4bc75dd35d62c34ece3e84ba904bd9ebda9c63a41","source":{"kind":"arxiv","id":"2411.01705","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.01705","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"arxiv_version","alias_value":"2411.01705v2","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.01705","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_12","alias_value":"YIT2SJPV37O3","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_16","alias_value":"YIT2SJPV37O3OH6N","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_8","alias_value":"YIT2SJPV","created_at":"2026-07-05T10:41:16Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:YIT2SJPV37O3OH6NOTKLY5O5GX","target":"record","payload":{"canonical_record":{"source":{"id":"2411.01705","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-03T22:27:40Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"8f741665824ce02e6079d54690a39f3b25770af7d3fda4f23dab965a8f947522","abstract_canon_sha256":"78223ede1401c8fc1b0231e620a758fad1361a33868af74bf8badf2c333edca8"},"schema_version":"1.0"},"canonical_sha256":"c227a925f5dfddb71fcd74d4bc75dd35d62c34ece3e84ba904bd9ebda9c63a41","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:41:16.840863Z","signature_b64":"Qa26MXPrMMdQlGX1uzVbfCX7lx+r2k2ELjFXJc3VZQvAxLgEDIHyy9i4FSKXdGGGIkl/nkxdRUyvF5OqIcGKDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c227a925f5dfddb71fcd74d4bc75dd35d62c34ece3e84ba904bd9ebda9c63a41","last_reissued_at":"2026-07-05T10:41:16.840357Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:41:16.840357Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2411.01705","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:41:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"p8u1fwufd/unet1cgm03o+YKYc93qvZygw75wG3U+A66lLJ8/ysjxSjfAEYNsXFOJuuhbKFLMfrl9EOBz+QZCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T04:55:10.422553Z"},"content_sha256":"5d2d5862341ca0fd2de29a6baa1bc7a0c8097e6cfd2d80194a65fe2d5f2671f3","schema_version":"1.0","event_id":"sha256:5d2d5862341ca0fd2de29a6baa1bc7a0c8097e6cfd2d80194a65fe2d5f2671f3"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:YIT2SJPV37O3OH6NOTKLY5O5GX","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CL"],"primary_cat":"cs.CR","authors_text":"Amir Houmansadr, Hong Yu, Junda Wang, Yuefeng Peng","submitted_at":"2024-11-03T22:27:40Z","abstract_excerpt":"Despite significant advancements, large language models (LLMs) still struggle with providing accurate answers when lacking domain-specific or up-to-date knowledge. Retrieval-Augmented Generation (RAG) addresses this limitation by incorporating external knowledge bases, but it also introduces new attack surfaces. In this paper, we investigate data extraction attacks targeting RAG's knowledge databases. We show that previous prompt injection-based extraction attacks largely rely on the instruction-following capabilities of LLMs. As a result, they fail on models that are less responsive to such m"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.01705","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2411.01705/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:41:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"oefIhlB4IxR1VLu0AcB5qKImLLEZT2AsHaoa1mjwpOmTGe408znBHzMOppPoLMHq5h63Dj3Al0knkHEeFC+vCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T04:55:10.423137Z"},"content_sha256":"87bebeaa4ee7ed553a857e5dc64021c9d8414353557b4c36a26c5bc419dfb8ba","schema_version":"1.0","event_id":"sha256:87bebeaa4ee7ed553a857e5dc64021c9d8414353557b4c36a26c5bc419dfb8ba"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/bundle.json","state_url":"https://pith.science/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T04:55:10Z","links":{"resolver":"https://pith.science/pith/YIT2SJPV37O3OH6NOTKLY5O5GX","bundle":"https://pith.science/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/bundle.json","state":"https://pith.science/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/state.json","well_known_bundle":"https://pith.science/.well-known/pith/YIT2SJPV37O3OH6NOTKLY5O5GX/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:YIT2SJPV37O3OH6NOTKLY5O5GX","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"78223ede1401c8fc1b0231e620a758fad1361a33868af74bf8badf2c333edca8","cross_cats_sorted":["cs.CL"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-03T22:27:40Z","title_canon_sha256":"8f741665824ce02e6079d54690a39f3b25770af7d3fda4f23dab965a8f947522"},"schema_version":"1.0","source":{"id":"2411.01705","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2411.01705","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"arxiv_version","alias_value":"2411.01705v2","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2411.01705","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_12","alias_value":"YIT2SJPV37O3","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_16","alias_value":"YIT2SJPV37O3OH6N","created_at":"2026-07-05T10:41:16Z"},{"alias_kind":"pith_short_8","alias_value":"YIT2SJPV","created_at":"2026-07-05T10:41:16Z"}],"graph_snapshots":[{"event_id":"sha256:87bebeaa4ee7ed553a857e5dc64021c9d8414353557b4c36a26c5bc419dfb8ba","target":"graph","created_at":"2026-07-05T10:41:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2411.01705/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Despite significant advancements, large language models (LLMs) still struggle with providing accurate answers when lacking domain-specific or up-to-date knowledge. Retrieval-Augmented Generation (RAG) addresses this limitation by incorporating external knowledge bases, but it also introduces new attack surfaces. In this paper, we investigate data extraction attacks targeting RAG's knowledge databases. We show that previous prompt injection-based extraction attacks largely rely on the instruction-following capabilities of LLMs. As a result, they fail on models that are less responsive to such m","authors_text":"Amir Houmansadr, Hong Yu, Junda Wang, Yuefeng Peng","cross_cats":["cs.CL"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-03T22:27:40Z","title":"Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2411.01705","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5d2d5862341ca0fd2de29a6baa1bc7a0c8097e6cfd2d80194a65fe2d5f2671f3","target":"record","created_at":"2026-07-05T10:41:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"78223ede1401c8fc1b0231e620a758fad1361a33868af74bf8badf2c333edca8","cross_cats_sorted":["cs.CL"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-11-03T22:27:40Z","title_canon_sha256":"8f741665824ce02e6079d54690a39f3b25770af7d3fda4f23dab965a8f947522"},"schema_version":"1.0","source":{"id":"2411.01705","kind":"arxiv","version":2}},"canonical_sha256":"c227a925f5dfddb71fcd74d4bc75dd35d62c34ece3e84ba904bd9ebda9c63a41","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c227a925f5dfddb71fcd74d4bc75dd35d62c34ece3e84ba904bd9ebda9c63a41","first_computed_at":"2026-07-05T10:41:16.840357Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:41:16.840357Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Qa26MXPrMMdQlGX1uzVbfCX7lx+r2k2ELjFXJc3VZQvAxLgEDIHyy9i4FSKXdGGGIkl/nkxdRUyvF5OqIcGKDg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:41:16.840863Z","signed_message":"canonical_sha256_bytes"},"source_id":"2411.01705","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5d2d5862341ca0fd2de29a6baa1bc7a0c8097e6cfd2d80194a65fe2d5f2671f3","sha256:87bebeaa4ee7ed553a857e5dc64021c9d8414353557b4c36a26c5bc419dfb8ba"],"state_sha256":"524a8627fad6d39ba233c8de31a4d5186e24f7f9cfe756d0c3faea22aae12242"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"XHViOONBBAbgs75Neu1/2ZOBHD7nlwysQCqHC/F4+U8OUblqEZ3PwN7+R3oAJNlogSS7RfUjzx6hwqiYSNMjBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T04:55:10.426718Z","bundle_sha256":"289a1d3bae24c1284b1558395d172b7c9d0bfcce3045664f47541cbbf62c7f3e"}}