{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:YJZ4IZWMAP7IWXRJIVV46R6K4Z","short_pith_number":"pith:YJZ4IZWM","canonical_record":{"source":{"id":"2502.01925","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-02-04T01:51:31Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"d1e1bc17055ed1b63e22b1668575992eda631d8afd854209aec84f56d5a7236e","abstract_canon_sha256":"70094d299170544ac1105659a335536de64aeb449eedc87ec1fd9e8f12a01076"},"schema_version":"1.0"},"canonical_sha256":"c273c466cc03fe8b5e29456bcf47cae651fea503c5ac108d7c4e84ff8fd48751","source":{"kind":"arxiv","id":"2502.01925","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.01925","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"arxiv_version","alias_value":"2502.01925v2","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.01925","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_12","alias_value":"YJZ4IZWMAP7I","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_16","alias_value":"YJZ4IZWMAP7IWXRJ","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_8","alias_value":"YJZ4IZWM","created_at":"2026-07-05T11:20:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:YJZ4IZWMAP7IWXRJIVV46R6K4Z","target":"record","payload":{"canonical_record":{"source":{"id":"2502.01925","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-02-04T01:51:31Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"d1e1bc17055ed1b63e22b1668575992eda631d8afd854209aec84f56d5a7236e","abstract_canon_sha256":"70094d299170544ac1105659a335536de64aeb449eedc87ec1fd9e8f12a01076"},"schema_version":"1.0"},"canonical_sha256":"c273c466cc03fe8b5e29456bcf47cae651fea503c5ac108d7c4e84ff8fd48751","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:20:50.246639Z","signature_b64":"buUhdStov/mgbZaCeOMGzrwMsmJoQjl331Nwr1J+VT4stWlHFtb1mthuTvItqzfgX9mZoaAKeHUlKn/ZmIerBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c273c466cc03fe8b5e29456bcf47cae651fea503c5ac108d7c4e84ff8fd48751","last_reissued_at":"2026-07-05T11:20:50.246197Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:20:50.246197Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.01925","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QyJPhJYxdHwk67CodyLMqEpGXdaM3Mlyerzn76sybJsgIhIQdho4NfrWSpaBR0tb6ZSKDRNkVnyTl7Xp1kNmAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T19:11:01.556181Z"},"content_sha256":"652565d0287bc7c8403cb2a1c9727fe2bd5b6d4692cd78a6cb9a1176783462ac","schema_version":"1.0","event_id":"sha256:652565d0287bc7c8403cb2a1c9727fe2bd5b6d4692cd78a6cb9a1176783462ac"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:YJZ4IZWMAP7IWXRJIVV46R6K4Z","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"cs.CL","authors_text":"Amir-massoud Farahmand, Avery Ma, Yangchen Pan","submitted_at":"2025-02-04T01:51:31Z","abstract_excerpt":"Many-shot jailbreaking circumvents the safety alignment of LLMs by exploiting their ability to process long input sequences. To achieve this, the malicious target prompt is prefixed with hundreds of fabricated conversational exchanges between the user and the model. These exchanges are randomly sampled from a pool of unsafe question-answer pairs, making it appear as though the model has already complied with harmful instructions. In this paper, we present PANDAS: a hybrid technique that improves many-shot jailbreaking by modifying these fabricated dialogues with Positive Affirmations, Negative"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.01925","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.01925/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"y5XCun7dp5ZFqzBEKKercKij5T5rHJDfc72NUIkSwjSiboRyJbD6T4VxJqggF3Yeumq7Wy6pcNzg/R70VGOPBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-12T19:11:01.556704Z"},"content_sha256":"869270d1a03beb5b40aaa377f1d183f435bbdb901821fec2a717de156b98b599","schema_version":"1.0","event_id":"sha256:869270d1a03beb5b40aaa377f1d183f435bbdb901821fec2a717de156b98b599"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/bundle.json","state_url":"https://pith.science/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-12T19:11:01Z","links":{"resolver":"https://pith.science/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z","bundle":"https://pith.science/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/bundle.json","state":"https://pith.science/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/state.json","well_known_bundle":"https://pith.science/.well-known/pith/YJZ4IZWMAP7IWXRJIVV46R6K4Z/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:YJZ4IZWMAP7IWXRJIVV46R6K4Z","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"70094d299170544ac1105659a335536de64aeb449eedc87ec1fd9e8f12a01076","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-02-04T01:51:31Z","title_canon_sha256":"d1e1bc17055ed1b63e22b1668575992eda631d8afd854209aec84f56d5a7236e"},"schema_version":"1.0","source":{"id":"2502.01925","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.01925","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"arxiv_version","alias_value":"2502.01925v2","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.01925","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_12","alias_value":"YJZ4IZWMAP7I","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_16","alias_value":"YJZ4IZWMAP7IWXRJ","created_at":"2026-07-05T11:20:50Z"},{"alias_kind":"pith_short_8","alias_value":"YJZ4IZWM","created_at":"2026-07-05T11:20:50Z"}],"graph_snapshots":[{"event_id":"sha256:869270d1a03beb5b40aaa377f1d183f435bbdb901821fec2a717de156b98b599","target":"graph","created_at":"2026-07-05T11:20:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.01925/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Many-shot jailbreaking circumvents the safety alignment of LLMs by exploiting their ability to process long input sequences. To achieve this, the malicious target prompt is prefixed with hundreds of fabricated conversational exchanges between the user and the model. These exchanges are randomly sampled from a pool of unsafe question-answer pairs, making it appear as though the model has already complied with harmful instructions. In this paper, we present PANDAS: a hybrid technique that improves many-shot jailbreaking by modifying these fabricated dialogues with Positive Affirmations, Negative","authors_text":"Amir-massoud Farahmand, Avery Ma, Yangchen Pan","cross_cats":["cs.CR","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-02-04T01:51:31Z","title":"PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.01925","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:652565d0287bc7c8403cb2a1c9727fe2bd5b6d4692cd78a6cb9a1176783462ac","target":"record","created_at":"2026-07-05T11:20:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"70094d299170544ac1105659a335536de64aeb449eedc87ec1fd9e8f12a01076","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2025-02-04T01:51:31Z","title_canon_sha256":"d1e1bc17055ed1b63e22b1668575992eda631d8afd854209aec84f56d5a7236e"},"schema_version":"1.0","source":{"id":"2502.01925","kind":"arxiv","version":2}},"canonical_sha256":"c273c466cc03fe8b5e29456bcf47cae651fea503c5ac108d7c4e84ff8fd48751","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c273c466cc03fe8b5e29456bcf47cae651fea503c5ac108d7c4e84ff8fd48751","first_computed_at":"2026-07-05T11:20:50.246197Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:20:50.246197Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"buUhdStov/mgbZaCeOMGzrwMsmJoQjl331Nwr1J+VT4stWlHFtb1mthuTvItqzfgX9mZoaAKeHUlKn/ZmIerBg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:20:50.246639Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.01925","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:652565d0287bc7c8403cb2a1c9727fe2bd5b6d4692cd78a6cb9a1176783462ac","sha256:869270d1a03beb5b40aaa377f1d183f435bbdb901821fec2a717de156b98b599"],"state_sha256":"9c58b87e125eaa3880728340adb809e61915ee9a3a205821e92ba612fb4e586b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"k7vEQgyST8bdZ6ewo/pCC6gRQBBWsZtMCjqMkH4HbhoPUXOEBXvYVSjoA/D+pyWLW/aiKoY/hnEpX4nO7ZsACw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-12T19:11:01.562883Z","bundle_sha256":"89d9463c89606cc3a0cdacf573797086f94165832f1436baddbb27958459c43e"}}