{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:2AIBY35W56Y75AGQ3RKF7NK2KL","short_pith_number":"pith:2AIBY35W","canonical_record":{"source":{"id":"2104.12609","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2021-04-26T14:22:33Z","cross_cats_sorted":[],"title_canon_sha256":"21863d59e06694f9431208c190786e8d73d86b8b54f3a9dcfebb8120c904f1b0","abstract_canon_sha256":"16c054d156dcb9193a30862892bf696464bf02a84b16ba4dd9384279aa265406"},"schema_version":"1.0"},"canonical_sha256":"d0101c6fb6efb1fe80d0dc545fb55a52df985293e1f73b47ddb811bd3bc234a5","source":{"kind":"arxiv","id":"2104.12609","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2104.12609","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"arxiv_version","alias_value":"2104.12609v1","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2104.12609","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_12","alias_value":"2AIBY35W56Y7","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_16","alias_value":"2AIBY35W56Y75AGQ","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_8","alias_value":"2AIBY35W","created_at":"2026-07-05T02:34:58Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:2AIBY35W56Y75AGQ3RKF7NK2KL","target":"record","payload":{"canonical_record":{"source":{"id":"2104.12609","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2021-04-26T14:22:33Z","cross_cats_sorted":[],"title_canon_sha256":"21863d59e06694f9431208c190786e8d73d86b8b54f3a9dcfebb8120c904f1b0","abstract_canon_sha256":"16c054d156dcb9193a30862892bf696464bf02a84b16ba4dd9384279aa265406"},"schema_version":"1.0"},"canonical_sha256":"d0101c6fb6efb1fe80d0dc545fb55a52df985293e1f73b47ddb811bd3bc234a5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:34:58.555556Z","signature_b64":"6aHcS7Op7L0Rs5JxJeUtUkmGi+Vx+P5fsbw/I5RjZdMpH9LfzqNzmUJl5HHl5SO3XuZ7Wt9/Iqvro1ZQgQ6EBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d0101c6fb6efb1fe80d0dc545fb55a52df985293e1f73b47ddb811bd3bc234a5","last_reissued_at":"2026-07-05T02:34:58.554973Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:34:58.554973Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2104.12609","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:34:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+WUdIaINItDguW1wxGlfs/+iCW/kIrecqY9KJyQxxmFqEe//yYPf/bq0flQhKkMEpJObIw7951YHMqFpLt2xAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T12:37:35.268978Z"},"content_sha256":"8e02e8a768ed1be4b514997085408a1f6d355f15aef655d3ad96a45e67ea9957","schema_version":"1.0","event_id":"sha256:8e02e8a768ed1be4b514997085408a1f6d355f15aef655d3ad96a45e67ea9957"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:2AIBY35W56Y75AGQ3RKF7NK2KL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CV","authors_text":"Chong Xiang, Prateek Mittal","submitted_at":"2021-04-26T14:22:33Z","abstract_excerpt":"An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification. The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object. Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions. In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provabl"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2104.12609","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2104.12609/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:34:58Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"prDrSJ7m64U/bvkuANq3I7vn0EjxqYNW/KEH+hAD7KoB3xsfktD90T7Bn3O4ttHXU5wJYaxcRilBChXy18ZJCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T12:37:35.269520Z"},"content_sha256":"46e4c0451947dd32c60669e8d4b7a01c8d0de2925cd0c444fbd0565ddf991c2d","schema_version":"1.0","event_id":"sha256:46e4c0451947dd32c60669e8d4b7a01c8d0de2925cd0c444fbd0565ddf991c2d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/bundle.json","state_url":"https://pith.science/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T12:37:35Z","links":{"resolver":"https://pith.science/pith/2AIBY35W56Y75AGQ3RKF7NK2KL","bundle":"https://pith.science/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/bundle.json","state":"https://pith.science/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2AIBY35W56Y75AGQ3RKF7NK2KL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:2AIBY35W56Y75AGQ3RKF7NK2KL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"16c054d156dcb9193a30862892bf696464bf02a84b16ba4dd9384279aa265406","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2021-04-26T14:22:33Z","title_canon_sha256":"21863d59e06694f9431208c190786e8d73d86b8b54f3a9dcfebb8120c904f1b0"},"schema_version":"1.0","source":{"id":"2104.12609","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2104.12609","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"arxiv_version","alias_value":"2104.12609v1","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2104.12609","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_12","alias_value":"2AIBY35W56Y7","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_16","alias_value":"2AIBY35W56Y75AGQ","created_at":"2026-07-05T02:34:58Z"},{"alias_kind":"pith_short_8","alias_value":"2AIBY35W","created_at":"2026-07-05T02:34:58Z"}],"graph_snapshots":[{"event_id":"sha256:46e4c0451947dd32c60669e8d4b7a01c8d0de2925cd0c444fbd0565ddf991c2d","target":"graph","created_at":"2026-07-05T02:34:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2104.12609/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification. The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object. Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions. In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provabl","authors_text":"Chong Xiang, Prateek Mittal","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2021-04-26T14:22:33Z","title":"PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2104.12609","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8e02e8a768ed1be4b514997085408a1f6d355f15aef655d3ad96a45e67ea9957","target":"record","created_at":"2026-07-05T02:34:58Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"16c054d156dcb9193a30862892bf696464bf02a84b16ba4dd9384279aa265406","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2021-04-26T14:22:33Z","title_canon_sha256":"21863d59e06694f9431208c190786e8d73d86b8b54f3a9dcfebb8120c904f1b0"},"schema_version":"1.0","source":{"id":"2104.12609","kind":"arxiv","version":1}},"canonical_sha256":"d0101c6fb6efb1fe80d0dc545fb55a52df985293e1f73b47ddb811bd3bc234a5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d0101c6fb6efb1fe80d0dc545fb55a52df985293e1f73b47ddb811bd3bc234a5","first_computed_at":"2026-07-05T02:34:58.554973Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:34:58.554973Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"6aHcS7Op7L0Rs5JxJeUtUkmGi+Vx+P5fsbw/I5RjZdMpH9LfzqNzmUJl5HHl5SO3XuZ7Wt9/Iqvro1ZQgQ6EBA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:34:58.555556Z","signed_message":"canonical_sha256_bytes"},"source_id":"2104.12609","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8e02e8a768ed1be4b514997085408a1f6d355f15aef655d3ad96a45e67ea9957","sha256:46e4c0451947dd32c60669e8d4b7a01c8d0de2925cd0c444fbd0565ddf991c2d"],"state_sha256":"78460901ccf384b6f01791414d835076cc45e165b802c21ed0953e60426a85cf"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"vbW3vc907zKWFWCqqbPWHpaIggO7M7nZj++fj0fsJg2nedDDf6e5PCNz5z3ao1xBR2GRM2XR16geKByX+GjADQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T12:37:35.273046Z","bundle_sha256":"fc649ebb0e61d2c68fc4e04dc4be3dff69b99c321ec6dd44a7f9a654b0f32b60"}}