{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:EKU3T66E46GHNML337B7MVMUWP","short_pith_number":"pith:EKU3T66E","canonical_record":{"source":{"id":"2605.14605","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T09:22:14Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"4a0d07d314b53cb26b1c51b385c332c3ce278ebb9ac8a08c44e5b5eae253155c","abstract_canon_sha256":"c09f37b5645d333a4932614ec3823421dabd45f7bb06d783d1bfc840045a7c87"},"schema_version":"1.0"},"canonical_sha256":"22a9b9fbc4e78c76b17bdfc3f65594b3c5cb1668f41c19c1eb60e9075b784898","source":{"kind":"arxiv","id":"2605.14605","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.14605","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"arxiv_version","alias_value":"2605.14605v1","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.14605","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"pith_short_12","alias_value":"EKU3T66E46GH","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"EKU3T66E46GHNML3","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"EKU3T66E","created_at":"2026-05-18T12:33:37Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:EKU3T66E46GHNML337B7MVMUWP","target":"record","payload":{"canonical_record":{"source":{"id":"2605.14605","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T09:22:14Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"4a0d07d314b53cb26b1c51b385c332c3ce278ebb9ac8a08c44e5b5eae253155c","abstract_canon_sha256":"c09f37b5645d333a4932614ec3823421dabd45f7bb06d783d1bfc840045a7c87"},"schema_version":"1.0"},"canonical_sha256":"22a9b9fbc4e78c76b17bdfc3f65594b3c5cb1668f41c19c1eb60e9075b784898","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:39:04.222291Z","signature_b64":"+Fdav/frb6sVMkQC30wiIE1wsNlGtQFxzVmKriXU/JfUXe74uLvQZaNlPldesl3YPih5O8sczngANR0JAbzYBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"22a9b9fbc4e78c76b17bdfc3f65594b3c5cb1668f41c19c1eb60e9075b784898","last_reissued_at":"2026-05-17T23:39:04.221553Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:39:04.221553Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.14605","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:39:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ji8qvD8l7oHa6FfPnGPn1hnDNG19tFM5O43iQ5oThXN8Urp6tljQkLPEi1h4lPYdBYFeLIgpjz7DP7gQhrYZBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-29T12:43:51.562852Z"},"content_sha256":"9280c830db1a404efddb4893c77ccf98ca6ca74c67d1401aba7c60c682fbfaee","schema_version":"1.0","event_id":"sha256:9280c830db1a404efddb4893c77ccf98ca6ca74c67d1401aba7c60c682fbfaee"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:EKU3T66E46GHNML337B7MVMUWP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"One Step to the Side: Why Defenses Against Malicious Finetuning Fail Under Adaptive Adversaries","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.LG"],"primary_cat":"cs.CR","authors_text":"Eyal Lenga, Gilad Gressel, Itay Zloczower, Yisroel Mirsky","submitted_at":"2026-05-14T09:22:14Z","abstract_excerpt":"Model providers increasingly release open weights or allow users to fine-tune foundation models through APIs. Although these models are safety-aligned before release, their safeguards can often be removed by fine-tuning on harmful data. Recent defenses aim to make models robust to such malicious fine-tuning, but they are largely evaluated only against fixed attacks that do not account for the defense. We show that these robustness claims are incomplete. Surveying 15 recent defenses, we identify several defense mechanisms and show that they share a single weakness: they obscure or misdirect the"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.14605","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:39:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"z80ihCLBxX3KloiFZzaBlPsioJDdx14aVDDYicWOzid+XXv5MoSynIMaIHCE+26Fa5Og6IRObU5YjDs4iW4fAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-29T12:43:51.563195Z"},"content_sha256":"025dc0503d1554193a43e50d62a051e22872c535868ce83fd19d0b421fd5fa2a","schema_version":"1.0","event_id":"sha256:025dc0503d1554193a43e50d62a051e22872c535868ce83fd19d0b421fd5fa2a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/EKU3T66E46GHNML337B7MVMUWP/bundle.json","state_url":"https://pith.science/pith/EKU3T66E46GHNML337B7MVMUWP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/EKU3T66E46GHNML337B7MVMUWP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-29T12:43:51Z","links":{"resolver":"https://pith.science/pith/EKU3T66E46GHNML337B7MVMUWP","bundle":"https://pith.science/pith/EKU3T66E46GHNML337B7MVMUWP/bundle.json","state":"https://pith.science/pith/EKU3T66E46GHNML337B7MVMUWP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/EKU3T66E46GHNML337B7MVMUWP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:EKU3T66E46GHNML337B7MVMUWP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c09f37b5645d333a4932614ec3823421dabd45f7bb06d783d1bfc840045a7c87","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T09:22:14Z","title_canon_sha256":"4a0d07d314b53cb26b1c51b385c332c3ce278ebb9ac8a08c44e5b5eae253155c"},"schema_version":"1.0","source":{"id":"2605.14605","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.14605","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"arxiv_version","alias_value":"2605.14605v1","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.14605","created_at":"2026-05-17T23:39:04Z"},{"alias_kind":"pith_short_12","alias_value":"EKU3T66E46GH","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"EKU3T66E46GHNML3","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"EKU3T66E","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:025dc0503d1554193a43e50d62a051e22872c535868ce83fd19d0b421fd5fa2a","target":"graph","created_at":"2026-05-17T23:39:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Model providers increasingly release open weights or allow users to fine-tune foundation models through APIs. Although these models are safety-aligned before release, their safeguards can often be removed by fine-tuning on harmful data. Recent defenses aim to make models robust to such malicious fine-tuning, but they are largely evaluated only against fixed attacks that do not account for the defense. We show that these robustness claims are incomplete. Surveying 15 recent defenses, we identify several defense mechanisms and show that they share a single weakness: they obscure or misdirect the","authors_text":"Eyal Lenga, Gilad Gressel, Itay Zloczower, Yisroel Mirsky","cross_cats":["cs.AI","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T09:22:14Z","title":"One Step to the Side: Why Defenses Against Malicious Finetuning Fail Under Adaptive Adversaries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.14605","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9280c830db1a404efddb4893c77ccf98ca6ca74c67d1401aba7c60c682fbfaee","target":"record","created_at":"2026-05-17T23:39:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c09f37b5645d333a4932614ec3823421dabd45f7bb06d783d1bfc840045a7c87","cross_cats_sorted":["cs.AI","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-14T09:22:14Z","title_canon_sha256":"4a0d07d314b53cb26b1c51b385c332c3ce278ebb9ac8a08c44e5b5eae253155c"},"schema_version":"1.0","source":{"id":"2605.14605","kind":"arxiv","version":1}},"canonical_sha256":"22a9b9fbc4e78c76b17bdfc3f65594b3c5cb1668f41c19c1eb60e9075b784898","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"22a9b9fbc4e78c76b17bdfc3f65594b3c5cb1668f41c19c1eb60e9075b784898","first_computed_at":"2026-05-17T23:39:04.221553Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:39:04.221553Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+Fdav/frb6sVMkQC30wiIE1wsNlGtQFxzVmKriXU/JfUXe74uLvQZaNlPldesl3YPih5O8sczngANR0JAbzYBQ==","signature_status":"signed_v1","signed_at":"2026-05-17T23:39:04.222291Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.14605","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9280c830db1a404efddb4893c77ccf98ca6ca74c67d1401aba7c60c682fbfaee","sha256:025dc0503d1554193a43e50d62a051e22872c535868ce83fd19d0b421fd5fa2a"],"state_sha256":"908110800c8fa7a52acdb8d38bc48e7cad6b8e5c2d3aaf0a358b83c82e349611"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NjsKbg6fiVsZKDvIjaB22VhfjWI/ypGvdDXc06a6WvuG+CiWHo8gJFCYuvjSgaS55mw5IukG9yIpQBX1wTbFAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-29T12:43:51.565107Z","bundle_sha256":"45c4535ecaace5998a5163c7310d3f26ebed9509909a4cf989234efd44b419ac"}}