{"as_of":"2026-08-08T10:09:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a946fe6be73be44780c666d8a882ac81b38e95272d09a8df3d1ac14a2315bc9e","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:11:59.185492Z","state":"measured"},{"denominator":27,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":27,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2505.19821/citation-record","integrity":"/paper/2505.19821/integrity","json":"/paper/2505.19821/citation-record.json","paper":"/paper/2505.19821"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:57.397730Z","title":"Deep learning in medical image analysis,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.397730Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:74a4ffc9c795851c5fe16d36751ac5d1c75fd2094fecdce806b09d7a324ebaa0","observation_id":"ad6de900-879a-4944-a5f1-d9ea0e010f8e","resolution":{"observed_at":"2026-08-07T14:11:57.397730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.732056Z","title":"Deep learning for finance: deep portfolios,","venue":null,"work_id":"a2f81ad4-ceec-4008-b075-bbf5e9fb1341","year":2017},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.446054Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:9514bd4d504b35167982892bafd93f428680472f16a5d5af16a0589ae6c78752","observation_id":"b3145e42-2d2e-4fd7-9da0-189926909aa7","resolution":{"observed_at":"2026-08-07T14:12:00.766112Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:57.491615Z","title":"Badnets: Evaluating backdooring attacks on deep neural networks,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.491615Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:76231e2473ac611e54e4e9b66c21a992cbba469c35b1167541b4c3d0c8b4d87a","observation_id":"4b5003c5-c0cc-4139-b9df-93c763a9ee47","resolution":{"observed_at":"2026-08-07T14:11:57.491615Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:57.545287Z","title":"Narcissus: A practical clean-label backdoor attack with limited information,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.545287Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:29ed28f7849e8db4a95982664e1458dc1af67ae210dd7fb510fb34544fd33b94","observation_id":"389ee68a-d481-41db-9af2-59e94a60f572","resolution":{"observed_at":"2026-08-07T14:11:57.545287Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.638809Z","title":"Not all samples are born equal: Towards effective clean-label backdoor attacks,","venue":null,"work_id":"345a84b7-f902-4188-a5e3-60a332085a88","year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.610048Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:0dc0fa3c54b9c2ffa35b0b5054cd1921d4fdc44e86883a8c6d4ed9efb422a93f","observation_id":"e4b78962-010c-44fa-9351-c3e287582141","resolution":{"observed_at":"2026-08-07T14:12:00.672188Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1810.09957","last_updated":"2018-10-08T04:30:44Z","snapshot_observed_at":"2026-08-04T04:20:13.256802Z","submitted_at":"2018-10-08T04:30:44Z","title":"NSML: Meet the MLaaS platform with a real-world case study","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1810.09957","snapshot_observed_at":"2026-08-07T14:11:57.671059Z","title":"Nsml: Meet the mlaas platform with a real- world case study,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.671059Z"},"links":{"cited_paper":"/paper/1810.09957","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:5e6b670145f1e82628e4298929281f2e9f39289716e362cae6af85ab45b5c263","observation_id":"047cef08-6602-42b5-a570-0a2fd71b4d70","resolution":{"observed_at":"2026-08-07T14:11:57.671059Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.555451Z","title":"Mlaas: Machine learning as a service,","venue":null,"work_id":"f2123c44-0e61-4128-8885-8046286478f0","year":2015},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.726842Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:589e6b93e79daa58bf32fc28f3776558ce138a18fc57830fd401a1f671531b7d","observation_id":"81bfc361-7929-4265-bacd-daded8402acd","resolution":{"observed_at":"2026-08-07T14:12:00.595730Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.09786","last_updated":"2024-06-02T15:06:02Z","snapshot_observed_at":"2026-08-07T05:12:17.088709Z","submitted_at":"2024-05-16T03:19:52Z","title":"IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.09786","snapshot_observed_at":"2026-08-07T14:11:57.776639Z","title":"Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consis- tency,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.776639Z"},"links":{"cited_paper":"/paper/2405.09786","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:73d3728466717577ceb978cac4eb3f0f7b8bdf5ca59e152df7ba96d6e5bc5a78","observation_id":"a4450457-6da1-4735-ab5d-085849535acc","resolution":{"observed_at":"2026-08-07T14:11:57.776639Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.03251","last_updated":"2023-02-19T01:32:21Z","snapshot_observed_at":"2026-07-06T14:49:07.867567Z","submitted_at":"2023-02-07T04:33:41Z","title":"SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.03251","snapshot_observed_at":"2026-08-07T14:11:57.820012Z","title":"Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.820012Z"},"links":{"cited_paper":"/paper/2302.03251","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:e6ac95740e76b263fd38cd1bea75b39f97291e304448ccea99827500e7c3a9f3","observation_id":"22630bca-1b93-4477-a2c0-ac7d40a216e8","resolution":{"observed_at":"2026-08-07T14:11:57.820012Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.11715","last_updated":"2022-12-19T04:02:37Z","snapshot_observed_at":"2026-07-06T13:55:41.552052Z","submitted_at":"2022-09-23T16:47:19Z","title":"The \"Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matrices","version":3},"cited_work":{"arxiv_id":"2209.11715","doi":null,"metadata_source":"pith","pith_arxiv_id":"2209.11715","snapshot_observed_at":"2026-08-07T14:11:59.558254Z","title":"The \"Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matrices","venue":"cs.CR","work_id":"a2b16b89-5577-4a50-9990-f4e016b097ff","year":2022},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.879116Z"},"links":{"cited_paper":"/paper/2209.11715","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:178d2aa5193b9c134d380c88d4c23a7eea0b16077999befa954dd77584a6a5b6","observation_id":"bd9ae334-048c-4779-82df-592265937928","resolution":{"observed_at":"2026-08-07T14:11:59.655002Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1712.05526","last_updated":"2017-12-15T04:26:26Z","snapshot_observed_at":"2026-07-06T06:14:30.795326Z","submitted_at":"2017-12-15T04:26:26Z","title":"Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.05526","snapshot_observed_at":"2026-08-07T14:11:57.957848Z","title":"Targeted backdoor attacks on deep learning systems using data poisoning,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:57.957848Z"},"links":{"cited_paper":"/paper/1712.05526","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:44b898ea58bb7a86df3a6d80e42bb623fa0571ed82c543720c41e352360524cf","observation_id":"df1811f9-bfb5-4c7b-9da5-14dbc1274a1e","resolution":{"observed_at":"2026-08-07T14:11:57.957848Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2102.10369","last_updated":"2021-03-04T04:09:38Z","snapshot_observed_at":"2026-08-02T13:52:44.392403Z","submitted_at":"2021-02-20T15:25:36Z","title":"WaNet -- Imperceptible Warping-based Backdoor Attack","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2102.10369","snapshot_observed_at":"2026-08-07T14:11:58.006307Z","title":"Wanet–imperceptible warping-based backdoor attack,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.006307Z"},"links":{"cited_paper":"/paper/2102.10369","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:8b15a26a678199abf96776be76f3f134e3091c768ee4b0c33b36feefae87713d","observation_id":"36132e57-dfe7-450a-abeb-55c7d7304222","resolution":{"observed_at":"2026-08-07T14:11:58.006307Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:58.052339Z","title":"Trojaning attack on neural networks,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.052339Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:23430f7132865130159c458a9f07e33481e5915ad3fe8620d917ba29060b200c","observation_id":"d5856a2b-89d2-4326-91d8-e8813c6c7be5","resolution":{"observed_at":"2026-08-07T14:11:58.052339Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1912.02771","last_updated":"2019-12-06T23:16:45Z","snapshot_observed_at":"2026-08-04T11:47:47.518305Z","submitted_at":"2019-12-05T18:05:59Z","title":"Label-Consistent Backdoor Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1912.02771","snapshot_observed_at":"2026-08-07T14:11:58.123910Z","title":"Label-consistent backdoor at- tacks,","venue":null,"work_id":null,"year":1912},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.123910Z"},"links":{"cited_paper":"/paper/1912.02771","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:867064df40b655201db472a60cfa312c19b0227316d9bca179fc15948c148992","observation_id":"34360cae-c940-43ab-8aef-7368e1aa07cc","resolution":{"observed_at":"2026-08-07T14:11:58.123910Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.472676Z","title":"Input-aware dynamic backdoor attack,","venue":null,"work_id":"5d7a8f05-add9-4ff0-a005-371224dfcfe1","year":2020},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.183890Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:751d2be78cf70f7bc6fa87976b50a535ea24243536ae7fa5cd32049571f8f4b9","observation_id":"86ca8183-19e6-4c01-8c8c-e46490ca0941","resolution":{"observed_at":"2026-08-07T14:12:00.506553Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.370214Z","title":"A new backdoor attack in cnns by training set corruption without label poisoning,","venue":null,"work_id":"373003b8-de76-48ce-a081-db3513c67320","year":2019},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.241276Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:23edc6074b667dcdebd982e0110e816877c791b62523a3b6eda91f8c6f9e722e","observation_id":"cfa761d0-1fd1-4979-8b09-d649caa9a692","resolution":{"observed_at":"2026-08-07T14:12:00.416988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.08386","last_updated":"2024-04-19T12:29:50Z","snapshot_observed_at":"2026-07-06T15:42:29.457514Z","submitted_at":"2023-06-14T09:21:48Z","title":"Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios","version":2},"cited_work":{"arxiv_id":"2306.08386","doi":null,"metadata_source":"pith","pith_arxiv_id":"2306.08386","snapshot_observed_at":"2026-08-07T14:11:59.360093Z","title":"Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios","venue":"cs.CR","work_id":"86a8a10b-8759-4cff-82f3-d899f743bc95","year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.291789Z"},"links":{"cited_paper":"/paper/2306.08386","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:d5889ee9736c747268b15091361ad40b2b9ad6fd5daf1751faed4b1a82a2ea3d","observation_id":"5100b151-9055-4006-9575-601c77c37dba","resolution":{"observed_at":"2026-08-07T14:11:59.445514Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.205274Z","title":"Computation and data effi- cient backdoor attacks,","venue":null,"work_id":"e8da0f7c-1c66-4324-8ff9-fb3ad5935237","year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.368570Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:45dbb797ae3b217f205476f701648d5d0a74dab225cf73f4059204b833876f87","observation_id":"86c21b19-0312-4782-8e76-bffb03f042de","resolution":{"observed_at":"2026-08-07T14:12:00.323161Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.07328","last_updated":"2023-07-14T13:12:21Z","snapshot_observed_at":"2026-08-08T06:28:12.600703Z","submitted_at":"2023-07-14T13:12:21Z","title":"Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategy","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.07328","snapshot_observed_at":"2026-08-07T14:11:58.445299Z","title":"Boosting backdoor attack with a learnable poisoning sample selection strategy,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.445299Z"},"links":{"cited_paper":"/paper/2307.07328","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:8ba51ca4ba4b9c9cfcae939f3b78f8080a97add114be4a0d6d0871db77fcdac8","observation_id":"fcf94479-d62f-41f3-b1e3-8f9cfb059c44","resolution":{"observed_at":"2026-08-07T14:11:58.445299Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:58.538697Z","title":"Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.538697Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:f68550123a9806ff933e7525172f0d72189b4b53580a409448a480ea32dedfc2","observation_id":"6afce261-261e-4024-93a1-0d58cc9f5c73","resolution":{"observed_at":"2026-08-07T14:11:58.538697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:12:00.004329Z","title":"Strip: A defence against trojan attacks on deep neural networks,","venue":null,"work_id":"94d88723-466b-489a-b26c-ff8fca3baedd","year":2019},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.616284Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:cbb4df83e6c94708f3d40e3c850dc9d8e123f8c02814bc664708717084532dc4","observation_id":"336a696f-893d-4b98-b63c-52aab7708384","resolution":{"observed_at":"2026-08-07T14:12:00.085385Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1811.03728","last_updated":"2018-11-09T01:08:00Z","snapshot_observed_at":"2026-07-06T07:13:39.005894Z","submitted_at":"2018-11-09T01:08:00Z","title":"Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1811.03728","snapshot_observed_at":"2026-08-07T14:11:58.707322Z","title":"Detecting backdoor attacks on deep neural networks by activation clustering,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.707322Z"},"links":{"cited_paper":"/paper/1811.03728","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:d9aab2878ebce31c67c14a499069f724d88bf28046aec731580052900172a684","observation_id":"af159260-2b04-4abd-b33d-15216890b047","resolution":{"observed_at":"2026-08-07T14:11:58.707322Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:59.829116Z","title":"Fine-pruning: Defending against backdooring attacks on deep neural networks,","venue":null,"work_id":"b620c66d-9830-44e5-8b6f-512e69ca4058","year":2018},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.812933Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:a765d8a6dc55acaa6fcffdb7336dc02ae55e9164667a4363672532dc5ef367d0","observation_id":"affd1e7a-6f66-4036-91de-bd42c82a74ed","resolution":{"observed_at":"2026-08-07T14:11:59.895448Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:58.898975Z","title":"Deep residual learning for image recognition,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.898975Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:2c5d31b96ea34f6d53ba92091abd22c404ae8621f199e87acad5a3fb77529b94","observation_id":"ec39fd5c-a185-407f-81df-dbbb7a29b8fb","resolution":{"observed_at":"2026-08-07T14:11:58.898975Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1409.1556","last_updated":"2015-04-10T16:25:04Z","snapshot_observed_at":"2026-07-06T03:53:32.549552Z","submitted_at":"2014-09-04T19:48:04Z","title":"Very Deep Convolutional Networks for Large-Scale Image Recognition","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1409.1556","snapshot_observed_at":"2026-08-07T14:11:58.908480Z","title":"Very deep convolutional networks for large-scale image recognition,","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.908480Z"},"links":{"cited_paper":"/paper/1409.1556","citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:c74050d09b25db3c7daf2c7d1b14eff7b67c6cff2e290c6fdcf7eea89690a47f","observation_id":"7d21f168-5965-41fa-b0e9-4ef9ad1fbf77","resolution":{"observed_at":"2026-08-07T14:11:58.908480Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:58.985511Z","title":"Learning multiple layers of features from tiny images,","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:58.985511Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:33da3c9b8003383858165468e8a055d6f03f07b1cd3debc1cbd0d8a896ad5d07","observation_id":"05909ba8-a053-4821-984b-7fef5dbf7f64","resolution":{"observed_at":"2026-08-07T14:11:58.985511Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:11:59.185492Z","title":"Tiny imagenet visual recognition challenge,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:11:59.185492Z"},"links":{"citing_paper":"/paper/2505.19821"},"observation_digest":"sha256:0aacf241ebe0ab3e6541c4855fe350e5f66396ab0bdd370f6cff3de829a48768","observation_id":"5f081565-e2cb-4374-8780-6f241e6ff8dd","resolution":{"observed_at":"2026-08-07T14:11:59.185492Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2505.19821","last_updated":"2025-05-26T10:59:44Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T14:03:22.367082Z","submitted_at":"2025-05-26T10:59:44Z","title":"Poison in the Well: Feature Embedding Disruption in Backdoor Attacks"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":17,"verified_exact":2,"verified_fuzzy":8},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 0 inbound Pith citation observations for arXiv:2505.19821."}