{"as_of":"2026-08-08T05:49:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:abb795bc8887a3ab0504dd5ce14b1816c5534a49f5b52efc9cce3d0dc93b4f72","coverage":[{"denominator":45,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":45,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T10:44:40.250400Z","state":"measured"},{"denominator":45,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":45,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2506.04556/citation-record","integrity":"/paper/2506.04556/integrity","json":"/paper/2506.04556/citation-record.json","paper":"/paper/2506.04556"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.901047Z","title":"Efficient self-supervised learning with contextualized target representations for vision, speech and language,","venue":null,"work_id":"0116baa3-d1a3-4129-837c-f7bb1b8d6dc7","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.191629Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:2da00f197947b209841eb86b8a03fbee66d8a0904bd3a1a1b91fad0b363c60db","observation_id":"25100a51-66b9-4b48-b7e2-4fec3d2f6fff","resolution":{"observed_at":"2026-08-07T10:44:40.905537Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.888583Z","title":"Reaas: Enabling adversarially robust downstream classifiers via robust encoder as a service,","venue":null,"work_id":"7ad4c293-f6ac-411a-8917-348a564640b4","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.271897Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:04dfb862f7f2441a3313545b9030a39759365564cb331bdd8ded42cc82013f61","observation_id":"f97fde2f-c62c-4097-af6c-89b07d60b78d","resolution":{"observed_at":"2026-08-07T10:44:40.892746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.875622Z","title":"Can’t steal? cont- steal! contrastive stealing attacks against image encoders,","venue":null,"work_id":"8e9f6818-8231-4a13-b658-95faf8fac2de","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.275499Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:46611f680af7e94d8d8634d4d669799f81184d021cd4418d51d40c4feb2ae441","observation_id":"462d6e05-03b5-42fc-b673-e93bf2ad8838","resolution":{"observed_at":"2026-08-07T10:44:40.879691Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2208.03948","last_updated":"2022-08-08T07:23:37Z","snapshot_observed_at":"2026-07-06T13:39:43.614791Z","submitted_at":"2022-08-08T07:23:37Z","title":"AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning","version":1},"cited_work":{"arxiv_id":"2208.03948","doi":null,"metadata_source":"pith","pith_arxiv_id":"2208.03948","snapshot_observed_at":"2026-08-07T10:44:40.405774Z","title":"AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning","venue":"cs.CV","work_id":"4f937437-6173-4497-a5cb-d8b068176696","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.279936Z"},"links":{"cited_paper":"/paper/2208.03948","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:24eed76d616dac3297036c2a8fe2570bb657e3184655fcfb3237f1f87368a64d","observation_id":"0d1ce80d-5b78-4ecb-9f69-c7dd58346f03","resolution":{"observed_at":"2026-08-07T10:44:40.411203Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2110.15444","last_updated":"2023-06-09T15:53:54Z","snapshot_observed_at":"2026-07-06T12:03:13.739036Z","submitted_at":"2021-10-28T21:45:53Z","title":"10 Security and Privacy Problems in Large Foundation Models","version":3},"cited_work":{"arxiv_id":"2110.15444","doi":null,"metadata_source":"pith","pith_arxiv_id":"2110.15444","snapshot_observed_at":"2026-08-07T10:44:40.387590Z","title":"10 Security and Privacy Problems in Large Foundation Models","venue":"cs.CR","work_id":"fc133468-33c2-4c9f-abf9-72698d210822","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.405645Z"},"links":{"cited_paper":"/paper/2110.15444","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:945a99d6887c4f5181f066ee700d9d7602d40d733f1241ce91dd86e3fbfe5fd3","observation_id":"eaeffeaf-138c-461e-a72e-b1600f0533c8","resolution":{"observed_at":"2026-08-07T10:44:40.392059Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.862804Z","title":"On the difficulty of defending self-supervised learning against model extraction,","venue":null,"work_id":"5b1ab9ad-300f-41b9-b0e0-53f844af3c55","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.499997Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:dc27d76704e1c58fe60ad71c8103b48609ea5d8c3e865f68fc93ff4b07e306d0","observation_id":"3fb902fe-7253-4ed3-a7d7-c37e3540bf34","resolution":{"observed_at":"2026-08-07T10:44:40.867200Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.837308Z","title":"Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection,","venue":null,"work_id":"ec50402c-e0a6-4961-a794-e7e8a83432ed","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.627456Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:649bc692ba6ea9e3b8f72f77872242018a0444bdf10b09e0587a9acbb32f2bfd","observation_id":"0be1f689-d3b0-457b-9e9e-c4e6ddc79874","resolution":{"observed_at":"2026-08-07T10:44:40.841539Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.823068Z","title":"Encodermi: Membership inference against pre-trained encoders in contrastive learning,","venue":null,"work_id":"1e22cbbc-46b7-4604-8732-d6e6f7b3e216","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.634529Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:3e5baf51c7eca8f7a285864d78620348a31261f36b776578028a8ca0512e2b68","observation_id":"7c68f1ab-f8f8-4a91-9806-8cecb448b2f7","resolution":{"observed_at":"2026-08-07T10:44:40.827495Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.808604Z","title":"Semi-leak: Membership inference attacks against semi-supervised learning,","venue":null,"work_id":"bbbaa76c-41ca-4c84-abf1-1306cb6cc315","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.638965Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:3e6787419e17ce1984cdee2f14803de0395754f21f729c7f50f65869e8d13796","observation_id":"90e8f8cd-8899-4cad-81c7-190cad8b5033","resolution":{"observed_at":"2026-08-07T10:44:40.813801Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.795439Z","title":"Badencoder: Backdoor attacks to pre- trained encoders in self-supervised learning,","venue":null,"work_id":"99860e56-bb7b-42ee-b098-f9573cb3ce88","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.694412Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:6837821d6c38a1c92fb71be6a1a242c4e84112db7af0cb7a57373b50d1783cc7","observation_id":"473f2a09-63d0-49ca-b6c8-4b91c1d4ed6b","resolution":{"observed_at":"2026-08-07T10:44:40.799812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.782959Z","title":"Backdoor attacks on self-supervised learning,","venue":null,"work_id":"ca70023e-ec16-4917-be82-29d626a38c25","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.774646Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:67d21348d3b133a17653b7d8ec1c1468839e316704524c577272e18f1ec78381","observation_id":"8b7e4dfa-b66c-4594-afca-3d0ae65969f2","resolution":{"observed_at":"2026-08-07T10:44:40.787281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.770467Z","title":"An embarrassingly simple backdoor attack on self-supervised learning,","venue":null,"work_id":"5c1c98ef-530d-4b39-a7e5-c8044b991d79","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.834205Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:ec838b805210659d02592ec7ef8957343b6d5558bcf5981946c617b446cd64b8","observation_id":"0ebc5ab2-4f13-404e-b51e-7ef85bf686e2","resolution":{"observed_at":"2026-08-07T10:44:40.774694Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.756215Z","title":"PRADA: protecting against DNN model stealing attacks,","venue":null,"work_id":"70e56612-6f79-487c-9e98-48b987cf0c48","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.899883Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:f32cae16a0aaa11750073ab83ae8c777e5652cf2cd50471707f17cd69d75aebf","observation_id":"9e76930d-5102-4c76-956f-ced949968441","resolution":{"observed_at":"2026-08-07T10:44:40.760904Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.743652Z","title":"Modelguard: Information-theoretic defense against model extraction attacks,","venue":null,"work_id":"e4b5b76d-673b-4ffd-bc4a-de16e58264e4","year":2024},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.974999Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:7f1cba26ab9d471bbad4e94bf62d8ba5c35c312288d6b0979afd20e5905dbce8","observation_id":"7d3fb1c8-d773-43c3-b3ed-6d4d5ab04635","resolution":{"observed_at":"2026-08-07T10:44:40.747911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.730959Z","title":"Plmmark: A secure and robust black-box watermarking framework for pre-trained language models,","venue":null,"work_id":"571136d7-1b5b-48c5-94e5-97c57e3ddedc","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.028591Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:7664a43e53122427b34f026f4101ccdcd10308bde83e727de849285de9baf443","observation_id":"2ab41232-eaba-4239-9cc6-391572a825d9","resolution":{"observed_at":"2026-08-07T10:44:40.735272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.04673","last_updated":"2023-12-06T08:23:34Z","snapshot_observed_at":"2026-07-06T16:04:15.121439Z","submitted_at":"2023-08-09T02:54:11Z","title":"SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning","version":3},"cited_work":{"arxiv_id":"2308.04673","doi":null,"metadata_source":"pith","pith_arxiv_id":"2308.04673","snapshot_observed_at":"2026-08-07T10:44:40.367494Z","title":"SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning","venue":"cs.CR","work_id":"de651055-921c-4031-821f-0cc2d258aa7c","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.111089Z"},"links":{"cited_paper":"/paper/2308.04673","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:37d5f924230671e9d81ce77f6e53b5f7576d43186baef0f2a632c5f34c9ed3f2","observation_id":"12dbe15b-2fb2-4056-94d3-2fafc4299c61","resolution":{"observed_at":"2026-08-07T10:44:40.373313Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05863","last_updated":"2023-11-10T04:27:27Z","snapshot_observed_at":"2026-07-06T16:45:36.159896Z","submitted_at":"2023-11-10T04:27:27Z","title":"Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Service","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05863","snapshot_observed_at":"2026-08-07T10:44:40.127433Z","title":"Water- marking vision-language pre-trained models for multi-modal embedding as a service,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.127433Z"},"links":{"cited_paper":"/paper/2311.05863","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:624fc460927916cd30cdd8aaf0d0c9442d7a9d46b25263ae6852bf52a84ddc8c","observation_id":"b50303af-2aca-4c51-bcda-5d14597ad6d8","resolution":{"observed_at":"2026-08-07T10:44:40.127433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.716278Z","title":"Threat modeling ai/ml systems and dependencies,","venue":null,"work_id":"7d94f05a-ae24-41e3-b7b0-8194af1c05e4","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.133264Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:cf9ee201ff4518a3499568f3a417f49e783674b9996c0728fd56276c16f3b0d4","observation_id":"94b4034d-15f9-441a-82cb-b6d21c1e9513","resolution":{"observed_at":"2026-08-07T10:44:40.721028Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.702849Z","title":"Stolenencoder: Stealing pre- trained encoders in self-supervised learning,","venue":null,"work_id":"8a968b1c-740a-4c2f-ba7e-e41b93866650","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.137481Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:36473cfc21cea97df1b89b7d8e8c9119416df7d42237bebab40b723679aeebc3","observation_id":"471b45a2-f491-4ada-a726-73de39438a94","resolution":{"observed_at":"2026-08-07T10:44:40.707365Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.689910Z","title":"D-DAE: defense- penetrating model extraction attacks,","venue":null,"work_id":"68a46f4e-ff31-4732-90ee-3c36d33591c5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.141333Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:e947d8358eeb950fa4634318d20e4803418de2bebfe141425ebeea15ace8adcb","observation_id":"6360808a-6018-4006-a21c-99387ebe30be","resolution":{"observed_at":"2026-08-07T10:44:40.694383Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.676732Z","title":"Magnet: A two-pronged defense against adversarial examples,","venue":null,"work_id":"b1621b85-efb4-421e-8a5d-b0ec32b1c71a","year":2017},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.145843Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:57695712429985845af2f5dd9ba7496732cf787b6958ce994c50e9b731eae144","observation_id":"7a9633b8-5d36-4d2b-8440-b3ad99c7b51e","resolution":{"observed_at":"2026-08-07T10:44:40.681735Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.665111Z","title":"Model extraction attacks and defenses on cloud-based machine learning models,","venue":null,"work_id":"64222355-ab57-4089-adce-ea0c37c3d960","year":2020},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.150321Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:b22a42480e40bac9ee00e57af58c0499cc6c1dcbf9aa5e2971bab7a57f9de9cb","observation_id":"bf1893f4-048f-426d-b9b8-0ce94647753a","resolution":{"observed_at":"2026-08-07T10:44:40.669143Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.652598Z","title":"Inversenet: Augmenting model extraction attacks with training data inversion,","venue":null,"work_id":"f3422973-2c42-44e4-82c7-69f9e6e69560","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.154830Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:161668de75660137edcb6cf3b85281f7aff1cc8099fd1b13bf683b7d172e04e0","observation_id":"8bcd002c-4632-4d0c-8e6b-cfb4a9d93f31","resolution":{"observed_at":"2026-08-07T10:44:40.656590Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.639561Z","title":"Stealing machine learning models via prediction apis,","venue":null,"work_id":"daaa724c-706f-4c9a-a28c-537eb853b700","year":2016},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.159306Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:32e55502c2f0369af3cd45c6e4798c122fe5c130aad82356abf5de492dd4e326","observation_id":"ef7d6b50-b01f-48fd-af60-d9fe7c274184","resolution":{"observed_at":"2026-08-07T10:44:40.643846Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.626145Z","title":"Black-box attacks on sequential recommenders via data-free model extraction,","venue":null,"work_id":"6d7abe9d-568d-4f9b-a72c-72e2d9be178b","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.163322Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:d0cca7c5e54f870d1fbdd1d9a73136b513b53a1e50463107287cfdc8bd2537ad","observation_id":"5325badb-2bcb-40a4-85b2-d9c20f1daed1","resolution":{"observed_at":"2026-08-07T10:44:40.630471Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.612163Z","title":"Divtheft: An ensemble model stealing attack by divide-and-conquer,","venue":null,"work_id":"662088c5-6bf2-4a79-8bda-1c7348ba80b4","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.167952Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:ad112386fe218bc316848ecb4139960d45f16d0a3c1de7ee7bb7a545925e6318","observation_id":"e70c0880-a877-4b19-85b5-95c222df059e","resolution":{"observed_at":"2026-08-07T10:44:40.617105Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.05127","last_updated":"2023-08-09T06:23:54Z","snapshot_observed_at":"2026-07-06T16:04:30.940641Z","submitted_at":"2023-08-09T06:23:54Z","title":"Data-Free Model Extraction Attacks in the Context of Object Detection","version":1},"cited_work":{"arxiv_id":"2308.05127","doi":null,"metadata_source":"pith","pith_arxiv_id":"2308.05127","snapshot_observed_at":"2026-08-07T10:44:40.334947Z","title":"Data-Free Model Extraction Attacks in the Context of Object Detection","venue":"cs.CR","work_id":"f4be4bd7-2987-4f08-8435-355486e7ef4b","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.172344Z"},"links":{"cited_paper":"/paper/2308.05127","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:337db0fe51e9ea7cdf5ac87c10e20887a5ac1359c7080d04ae87c7c51023396d","observation_id":"503d7391-ae9a-4587-80bb-a36f8682390d","resolution":{"observed_at":"2026-08-07T10:44:40.339775Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.598180Z","title":"MAZE: data-free model stealing attack using zeroth-order gradient estimation,","venue":null,"work_id":"5dcc14fc-b6b4-45d5-81ba-fb1ddc06b90b","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.176624Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:949ca1851a35b73de8219cd05b5d69fc157aa2c2522b27c0962335cd7828b161","observation_id":"9606e46e-7216-4d6d-9adf-c544653fdb50","resolution":{"observed_at":"2026-08-07T10:44:40.602888Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.584366Z","title":"Data-free model extraction,","venue":null,"work_id":"dab599e2-765a-42df-b0ea-9e47608f7013","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.180343Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:6a387d974c94515d1acbf4b6b3b859699538a16b2a8ae09e35a0472e52cfc782","observation_id":"88db8f25-a96b-43d5-8cb5-aafc6052c0cc","resolution":{"observed_at":"2026-08-07T10:44:40.589527Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.571433Z","title":"Entangled watermarks as a defense against model extraction,","venue":null,"work_id":"9586a11a-24f8-451d-8887-86a07443d9c0","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.184340Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:c2bb7289c030c5f32a824c61298faab85ec6a1a13384da3ed5cfd03ba24ba9bd","observation_id":"9871662b-44ed-42bd-9136-2c65fc569b84","resolution":{"observed_at":"2026-08-07T10:44:40.575613Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2104.12623","last_updated":"2023-02-28T09:37:59Z","snapshot_observed_at":"2026-08-01T19:16:59.624967Z","submitted_at":"2021-04-26T14:50:59Z","title":"Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.12623","snapshot_observed_at":"2026-08-07T10:44:40.188346Z","title":"Good artists copy, great artists steal: Model extraction attacks against image translation generative adversarial networks,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.188346Z"},"links":{"cited_paper":"/paper/2104.12623","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:5b2c9f012e7d27b746b305207bc970cce1c9665dd86fbcd91ed903638470ddb7","observation_id":"5503ccc1-de81-491f-bdfe-d3f1d2d07408","resolution":{"observed_at":"2026-08-07T10:44:40.188346Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.556651Z","title":"Fe-dast: Fast and effective data-free substitute training for black-box adversarial attacks,","venue":null,"work_id":"ec12f8aa-396a-4a13-a9f8-38e0cf0e2a65","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.192686Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:6772df3dd64b139b5f721b6c5ef107d442023f9855ef11d92c3d384d56d052e0","observation_id":"ca3535f7-2d6c-4be6-be0a-3248c1d85630","resolution":{"observed_at":"2026-08-07T10:44:40.562280Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.542693Z","title":"QUDA: query-limited data-free model extraction,","venue":null,"work_id":"f17e9ac4-da58-459e-acea-cfa8767728c5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.197531Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:1c06fb0ae57e3d05488dc466f2856ce7373ff4804ff51c5ec97b578a93593cc6","observation_id":"904e3f69-5826-4f43-b5b5-7644cdcaee13","resolution":{"observed_at":"2026-08-07T10:44:40.546732Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.530004Z","title":"Knockoff nets: Stealing func- tionality of black-box models,","venue":null,"work_id":"a1a07381-7681-46d7-8260-bbaca4eedbb7","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.202460Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:0da5dfda6a45dc41085c229b7cdac47e5187d27770b52175042edcba2fa3019d","observation_id":"6021d8ab-09c2-47ff-ba67-77efd9957f7e","resolution":{"observed_at":"2026-08-07T10:44:40.534463Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.515236Z","title":"Practical black-box attacks against machine learning,","venue":null,"work_id":"f874238f-4f56-4b23-9979-bb902c019f9c","year":2017},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.207004Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:7c4139d1fdf1f231e557f63a3b933c94ba14c560067cf1d64517d020b0fdf97c","observation_id":"7a3d500a-dd37-46d9-af58-74e13cbb743a","resolution":{"observed_at":"2026-08-07T10:44:40.520561Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.849924Z","title":"DST: dynamic substitute training for data-free black-box attack,","venue":null,"work_id":"766310a8-1668-4ba3-9021-fc6b811c3e12","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.211056Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:1ff260090b79a6bee9b6ce328a21c10380c4a200c8e44d036f21590de915a9c8","observation_id":"1b5fc14d-e842-474e-a0e4-a7b4c7685f28","resolution":{"observed_at":"2026-08-07T10:44:40.854014Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08571","last_updated":"2023-11-03T14:12:23Z","snapshot_observed_at":"2026-07-06T16:32:07.186600Z","submitted_at":"2023-10-12T17:56:53Z","title":"Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders","version":2},"cited_work":{"arxiv_id":"2310.08571","doi":null,"metadata_source":"pith","pith_arxiv_id":"2310.08571","snapshot_observed_at":"2026-08-07T10:44:40.299199Z","title":"Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders","venue":"cs.LG","work_id":"3abf95ea-2fd5-4765-9759-24b58ed58202","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.215276Z"},"links":{"cited_paper":"/paper/2310.08571","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:c8485a3f3be6eb87adb8d09fd33cf9c48472d01d34245cc737d8e12157cae868","observation_id":"afded011-ba85-4769-bd15-6edc62414950","resolution":{"observed_at":"2026-08-07T10:44:40.305995Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.502377Z","title":"Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,","venue":null,"work_id":"97dd17d6-3c28-41d9-b992-e5914969f09a","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.220741Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:dba010b5c38727562d7d9fae8a94d6251e4c8674739f565f299c4e4fc43cb963","observation_id":"2067a111-30ce-47ed-9a6a-3a127c0f112d","resolution":{"observed_at":"2026-08-07T10:44:40.506898Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.487921Z","title":"Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark,","venue":null,"work_id":"6570b33a-1980-42b4-80f6-6b07bb3884f5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.225203Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:c1507d4cb7225fb8bc9a5496514f1453aa84607e7aaca48df76d942dce61403f","observation_id":"d39e61ed-ff2f-45ac-a010-2545811f8cab","resolution":{"observed_at":"2026-08-07T10:44:40.492840Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.229281Z","title":"Learning multiple layers of features from tiny images","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.229281Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:de1c85cf18d1a438cdbeb7f06aacc438cdc94b5ff096488fcabfd61bda1b44bf","observation_id":"07ef47bd-57c7-4299-9bd5-563c5e8b3902","resolution":{"observed_at":"2026-08-07T10:44:40.229281Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.465300Z","title":"Reading digits in natural images with unsupervised feature learning,","venue":null,"work_id":"87035064-80c3-4d80-863d-33e5b198943c","year":2011},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.233217Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:83c610c70dc7d0175cf4cf28950c103b340c4383e10a2f614f6c19eb6d9b0f3f","observation_id":"7811dbd1-7b69-4de1-bdd9-ff9e35c4ac76","resolution":{"observed_at":"2026-08-07T10:44:40.470364Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.450384Z","title":"Auto-encoding variational bayes,","venue":null,"work_id":"61f5bb10-b07c-4914-8f61-56470e4760a1","year":2014},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.237561Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:7ec70d91a68372a5cb532f3d7b7c79ca1e2d8bd1754c3726e260b737d94cfed4","observation_id":"8e446698-81aa-4f40-bd60-53065f104730","resolution":{"observed_at":"2026-08-07T10:44:40.455139Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.436250Z","title":"Generative adversarial nets,","venue":null,"work_id":"c50d61d1-c94f-4fb4-ac4b-3dc77f8f16fc","year":2014},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.242357Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:d4f5122d22c6aee62ab5b4d8872217cb6633dc8d753847f60fa1b711e9408500","observation_id":"f2bc344f-709b-445a-ad7b-dc58065ea460","resolution":{"observed_at":"2026-08-07T10:44:40.440446Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.420923Z","title":"Rectifier nonlinearities improve neural network acoustic models,","venue":null,"work_id":"a7c54e9f-81a3-4c7e-9e38-f2248754c3e4","year":2013},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.246326Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:78adcc121bd0922962115d36bc1c82b7d4e0adaa21a2fcbfbd32ee67c732db05","observation_id":"456b8959-77c2-4bbe-b80d-c21ebfd3a579","resolution":{"observed_at":"2026-08-07T10:44:40.426108Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2209.02299","last_updated":"2024-09-17T11:55:58Z","snapshot_observed_at":"2026-08-02T02:19:01.218373Z","submitted_at":"2022-09-06T08:51:53Z","title":"A Survey of Machine Unlearning","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.02299","snapshot_observed_at":"2026-08-07T10:44:40.250400Z","title":"A survey of machine unlearning,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.250400Z"},"links":{"cited_paper":"/paper/2209.02299","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:202831c690322a1af15fe21ae20566e3ac81e3cb13a63c26a37b68ab21827522","observation_id":"c43b6982-a793-4316-a584-b5e715dd4ef7","resolution":{"observed_at":"2026-08-07T10:44:40.250400Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery"},"reference_resolution":{"displayed":45,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":4,"verified_exact":5,"verified_fuzzy":36},"total_outbound_references":45},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 45 of 45 outbound references and 0 inbound Pith citation observations for arXiv:2506.04556."}