{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:2CXEYW6SKVANCGDCIBJHU75JJO","short_pith_number":"pith:2CXEYW6S","canonical_record":{"source":{"id":"2101.06969","kind":"arxiv","version":5},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2021-01-18T10:18:42Z","cross_cats_sorted":["cs.CV"],"title_canon_sha256":"8e76a602ee7f30a0cabbe1a953d2dccfe50ab196dbc26d845bf7218f7e80245e","abstract_canon_sha256":"24aeebdf7be4dbd4b5b7007d5d8417961c3012866738f8120911a4cbd808fb5d"},"schema_version":"1.0"},"canonical_sha256":"d0ae4c5bd25540d1186240527a7fa94bb7088752c855b6b8878c0adc00907698","source":{"kind":"arxiv","id":"2101.06969","version":5},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.06969","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"arxiv_version","alias_value":"2101.06969v5","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.06969","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_12","alias_value":"2CXEYW6SKVAN","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_16","alias_value":"2CXEYW6SKVANCGDC","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_8","alias_value":"2CXEYW6S","created_at":"2026-07-05T07:02:45Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:2CXEYW6SKVANCGDCIBJHU75JJO","target":"record","payload":{"canonical_record":{"source":{"id":"2101.06969","kind":"arxiv","version":5},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2021-01-18T10:18:42Z","cross_cats_sorted":["cs.CV"],"title_canon_sha256":"8e76a602ee7f30a0cabbe1a953d2dccfe50ab196dbc26d845bf7218f7e80245e","abstract_canon_sha256":"24aeebdf7be4dbd4b5b7007d5d8417961c3012866738f8120911a4cbd808fb5d"},"schema_version":"1.0"},"canonical_sha256":"d0ae4c5bd25540d1186240527a7fa94bb7088752c855b6b8878c0adc00907698","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:02:45.821740Z","signature_b64":"OCUzDqKMGLRpJEl+PfHGlxXo8sNFuG5ImYwdRiMCU3cIiwH/9LC+9OMkiW0gYLRQrJvIk7JieXdHDm2zOeJNDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d0ae4c5bd25540d1186240527a7fa94bb7088752c855b6b8878c0adc00907698","last_reissued_at":"2026-07-05T07:02:45.821202Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:02:45.821202Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2101.06969","source_version":5,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:02:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0WLsU8fHRmLqiyYXx9dRh7pguIHwFfJ5QUMzp4e/Al0/WjvcLKIkj7ueqfHsYOD3AT0WhFJt6GEXnbhcMAQaCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T10:05:49.388046Z"},"content_sha256":"fdb70b8346c21e39a213e3380513c4136132beecde59fda7b6bc744fe8cf0ed1","schema_version":"1.0","event_id":"sha256:fdb70b8346c21e39a213e3380513c4136132beecde59fda7b6bc744fe8cf0ed1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:2CXEYW6SKVANCGDCIBJHU75JJO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CV"],"primary_cat":"cs.CL","authors_text":"Fanchao Qi, Guangxuan Xiao, Maosong Sun, Tian Lv, Xin Jiang, Yasheng Wang, Yongwei Li, Zhengyan Zhang, Zhiyuan Liu","submitted_at":"2021-01-18T10:18:42Z","abstract_excerpt":"Pre-trained models (PTMs) have been widely used in various downstream tasks. The parameters of PTMs are distributed on the Internet and may suffer backdoor attacks. In this work, we demonstrate the universal vulnerability of PTMs, where fine-tuned PTMs can be easily controlled by backdoor attacks in arbitrary downstream tasks. Specifically, attackers can add a simple pre-training task, which restricts the output representations of trigger instances to pre-defined vectors, namely neuron-level backdoor attack (NeuBA). If the backdoor functionality is not eliminated during fine-tuning, the trigge"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.06969","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2101.06969/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:02:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"D023tgJAtr5ocdZKFMIz4c4rbkM2NLv9xMw+03pw3LLEp9XDIfET6jWOwg0hh56NlzTgBVyXdO4QvXanUXzIBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T10:05:49.388437Z"},"content_sha256":"65fbd7b14fe140eb1b7b95705db9c41f6cb4e2a1f2e94977e9238072fad6ce0f","schema_version":"1.0","event_id":"sha256:65fbd7b14fe140eb1b7b95705db9c41f6cb4e2a1f2e94977e9238072fad6ce0f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2CXEYW6SKVANCGDCIBJHU75JJO/bundle.json","state_url":"https://pith.science/pith/2CXEYW6SKVANCGDCIBJHU75JJO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2CXEYW6SKVANCGDCIBJHU75JJO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T10:05:49Z","links":{"resolver":"https://pith.science/pith/2CXEYW6SKVANCGDCIBJHU75JJO","bundle":"https://pith.science/pith/2CXEYW6SKVANCGDCIBJHU75JJO/bundle.json","state":"https://pith.science/pith/2CXEYW6SKVANCGDCIBJHU75JJO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2CXEYW6SKVANCGDCIBJHU75JJO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:2CXEYW6SKVANCGDCIBJHU75JJO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"24aeebdf7be4dbd4b5b7007d5d8417961c3012866738f8120911a4cbd808fb5d","cross_cats_sorted":["cs.CV"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2021-01-18T10:18:42Z","title_canon_sha256":"8e76a602ee7f30a0cabbe1a953d2dccfe50ab196dbc26d845bf7218f7e80245e"},"schema_version":"1.0","source":{"id":"2101.06969","kind":"arxiv","version":5}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2101.06969","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"arxiv_version","alias_value":"2101.06969v5","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2101.06969","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_12","alias_value":"2CXEYW6SKVAN","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_16","alias_value":"2CXEYW6SKVANCGDC","created_at":"2026-07-05T07:02:45Z"},{"alias_kind":"pith_short_8","alias_value":"2CXEYW6S","created_at":"2026-07-05T07:02:45Z"}],"graph_snapshots":[{"event_id":"sha256:65fbd7b14fe140eb1b7b95705db9c41f6cb4e2a1f2e94977e9238072fad6ce0f","target":"graph","created_at":"2026-07-05T07:02:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2101.06969/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Pre-trained models (PTMs) have been widely used in various downstream tasks. The parameters of PTMs are distributed on the Internet and may suffer backdoor attacks. In this work, we demonstrate the universal vulnerability of PTMs, where fine-tuned PTMs can be easily controlled by backdoor attacks in arbitrary downstream tasks. Specifically, attackers can add a simple pre-training task, which restricts the output representations of trigger instances to pre-defined vectors, namely neuron-level backdoor attack (NeuBA). If the backdoor functionality is not eliminated during fine-tuning, the trigge","authors_text":"Fanchao Qi, Guangxuan Xiao, Maosong Sun, Tian Lv, Xin Jiang, Yasheng Wang, Yongwei Li, Zhengyan Zhang, Zhiyuan Liu","cross_cats":["cs.CV"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2021-01-18T10:18:42Z","title":"Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2101.06969","kind":"arxiv","version":5},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:fdb70b8346c21e39a213e3380513c4136132beecde59fda7b6bc744fe8cf0ed1","target":"record","created_at":"2026-07-05T07:02:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"24aeebdf7be4dbd4b5b7007d5d8417961c3012866738f8120911a4cbd808fb5d","cross_cats_sorted":["cs.CV"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2021-01-18T10:18:42Z","title_canon_sha256":"8e76a602ee7f30a0cabbe1a953d2dccfe50ab196dbc26d845bf7218f7e80245e"},"schema_version":"1.0","source":{"id":"2101.06969","kind":"arxiv","version":5}},"canonical_sha256":"d0ae4c5bd25540d1186240527a7fa94bb7088752c855b6b8878c0adc00907698","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d0ae4c5bd25540d1186240527a7fa94bb7088752c855b6b8878c0adc00907698","first_computed_at":"2026-07-05T07:02:45.821202Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:02:45.821202Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"OCUzDqKMGLRpJEl+PfHGlxXo8sNFuG5ImYwdRiMCU3cIiwH/9LC+9OMkiW0gYLRQrJvIk7JieXdHDm2zOeJNDg==","signature_status":"signed_v1","signed_at":"2026-07-05T07:02:45.821740Z","signed_message":"canonical_sha256_bytes"},"source_id":"2101.06969","source_kind":"arxiv","source_version":5}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:fdb70b8346c21e39a213e3380513c4136132beecde59fda7b6bc744fe8cf0ed1","sha256:65fbd7b14fe140eb1b7b95705db9c41f6cb4e2a1f2e94977e9238072fad6ce0f"],"state_sha256":"e78614540b4c98e63313dde7c80aed4c8ef03855f3b4f5acabc6a43982645e98"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/zC8oTQVh0BFVQwMzZK+JM3RK+xJUVY685iJgoirDCJTCWfsEO0wv/5u+juad8PeSWWFG6zzR6395gzKac5ECg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T10:05:49.390437Z","bundle_sha256":"ce9385d63f12626d01cdff1a39b2a1a16f2ff64f1207be2844ff53cff99015e1"}}