{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2018:2RMBILUMRVUEHZWDHBOMJWI6M3","short_pith_number":"pith:2RMBILUM","canonical_record":{"source":{"id":"1805.09190","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2018-05-23T14:16:22Z","cross_cats_sorted":[],"title_canon_sha256":"a090fe807048f0b7b127b333a376e6d898f53ba5bdd5235aa08ca5b1eee8f4fc","abstract_canon_sha256":"abec3dba73cce5b2b22a80462ea4f7ce080105bcbed0161e1b28fbb3ecac22fd"},"schema_version":"1.0"},"canonical_sha256":"d458142e8c8d6843e6c3385cc4d91e66cedabc137937d4061737340f242a5655","source":{"kind":"arxiv","id":"1805.09190","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1805.09190","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"arxiv_version","alias_value":"1805.09190v3","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1805.09190","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"pith_short_12","alias_value":"2RMBILUMRVUE","created_at":"2026-05-18T12:32:02Z"},{"alias_kind":"pith_short_16","alias_value":"2RMBILUMRVUEHZWD","created_at":"2026-05-18T12:32:02Z"},{"alias_kind":"pith_short_8","alias_value":"2RMBILUM","created_at":"2026-05-18T12:32:02Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2018:2RMBILUMRVUEHZWDHBOMJWI6M3","target":"record","payload":{"canonical_record":{"source":{"id":"1805.09190","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2018-05-23T14:16:22Z","cross_cats_sorted":[],"title_canon_sha256":"a090fe807048f0b7b127b333a376e6d898f53ba5bdd5235aa08ca5b1eee8f4fc","abstract_canon_sha256":"abec3dba73cce5b2b22a80462ea4f7ce080105bcbed0161e1b28fbb3ecac22fd"},"schema_version":"1.0"},"canonical_sha256":"d458142e8c8d6843e6c3385cc4d91e66cedabc137937d4061737340f242a5655","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:05:19.240644Z","signature_b64":"fhdzRmJf6I+FeTjmPU8UGfuwjCG3pRY8WWKDYZI3a69Pyjfufemv9XOWJHQuT2xoQOUa/P7BxwDHQ7KsSLp+AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"d458142e8c8d6843e6c3385cc4d91e66cedabc137937d4061737340f242a5655","last_reissued_at":"2026-05-18T00:05:19.240134Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:05:19.240134Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1805.09190","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:05:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RjPuoJ99YEUuoCLI6H6hptwHRSCT0H/zz+118gJuOi6ZF8m4dy1ovJII4DraMRxrIU4RuiORGjlf0EWZMwPfCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T10:11:01.856958Z"},"content_sha256":"d441c043de5638f2d75cf4f492d2163aedf6fae2df7a3b9144749eeeff450d7e","schema_version":"1.0","event_id":"sha256:d441c043de5638f2d75cf4f492d2163aedf6fae2df7a3b9144749eeeff450d7e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2018:2RMBILUMRVUEHZWDHBOMJWI6M3","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Towards the first adversarially robust neural network model on MNIST","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CV","authors_text":"Jonas Rauber, Lukas Schott, Matthias Bethge, Wieland Brendel","submitted_at":"2018-05-23T14:16:22Z","abstract_excerpt":"Despite much effort, deep neural networks remain highly susceptible to tiny input perturbations and even for MNIST, one of the most common toy datasets in computer vision, no neural network model exists for which adversarial perturbations are large and make semantic sense to humans. We show that even the widely recognized and by far most successful defense by Madry et al. (1) overfits on the L-infinity metric (it's highly susceptible to L2 and L0 perturbations), (2) classifies unrecognizable images with high certainty, (3) performs not much better than simple input binarization and (4) feature"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1805.09190","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:05:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"q7nETksnlkdbYtPmblcjqS7yRziEflkQ4xwegea12IZmmyMxnwDLXU/1oGXi19PQ9ZthUojwN3YSs9DQM4OBBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T10:11:01.857407Z"},"content_sha256":"de0ab99fffdb2a8d5b1d3ca4f7db050d9874ccfa7b7dfc90ad4dd09ea94c2579","schema_version":"1.0","event_id":"sha256:de0ab99fffdb2a8d5b1d3ca4f7db050d9874ccfa7b7dfc90ad4dd09ea94c2579"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/bundle.json","state_url":"https://pith.science/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T10:11:01Z","links":{"resolver":"https://pith.science/pith/2RMBILUMRVUEHZWDHBOMJWI6M3","bundle":"https://pith.science/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/bundle.json","state":"https://pith.science/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/state.json","well_known_bundle":"https://pith.science/.well-known/pith/2RMBILUMRVUEHZWDHBOMJWI6M3/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2018:2RMBILUMRVUEHZWDHBOMJWI6M3","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"abec3dba73cce5b2b22a80462ea4f7ce080105bcbed0161e1b28fbb3ecac22fd","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2018-05-23T14:16:22Z","title_canon_sha256":"a090fe807048f0b7b127b333a376e6d898f53ba5bdd5235aa08ca5b1eee8f4fc"},"schema_version":"1.0","source":{"id":"1805.09190","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1805.09190","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"arxiv_version","alias_value":"1805.09190v3","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1805.09190","created_at":"2026-05-18T00:05:19Z"},{"alias_kind":"pith_short_12","alias_value":"2RMBILUMRVUE","created_at":"2026-05-18T12:32:02Z"},{"alias_kind":"pith_short_16","alias_value":"2RMBILUMRVUEHZWD","created_at":"2026-05-18T12:32:02Z"},{"alias_kind":"pith_short_8","alias_value":"2RMBILUM","created_at":"2026-05-18T12:32:02Z"}],"graph_snapshots":[{"event_id":"sha256:de0ab99fffdb2a8d5b1d3ca4f7db050d9874ccfa7b7dfc90ad4dd09ea94c2579","target":"graph","created_at":"2026-05-18T00:05:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Despite much effort, deep neural networks remain highly susceptible to tiny input perturbations and even for MNIST, one of the most common toy datasets in computer vision, no neural network model exists for which adversarial perturbations are large and make semantic sense to humans. We show that even the widely recognized and by far most successful defense by Madry et al. (1) overfits on the L-infinity metric (it's highly susceptible to L2 and L0 perturbations), (2) classifies unrecognizable images with high certainty, (3) performs not much better than simple input binarization and (4) feature","authors_text":"Jonas Rauber, Lukas Schott, Matthias Bethge, Wieland Brendel","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2018-05-23T14:16:22Z","title":"Towards the first adversarially robust neural network model on MNIST"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1805.09190","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d441c043de5638f2d75cf4f492d2163aedf6fae2df7a3b9144749eeeff450d7e","target":"record","created_at":"2026-05-18T00:05:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"abec3dba73cce5b2b22a80462ea4f7ce080105bcbed0161e1b28fbb3ecac22fd","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2018-05-23T14:16:22Z","title_canon_sha256":"a090fe807048f0b7b127b333a376e6d898f53ba5bdd5235aa08ca5b1eee8f4fc"},"schema_version":"1.0","source":{"id":"1805.09190","kind":"arxiv","version":3}},"canonical_sha256":"d458142e8c8d6843e6c3385cc4d91e66cedabc137937d4061737340f242a5655","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d458142e8c8d6843e6c3385cc4d91e66cedabc137937d4061737340f242a5655","first_computed_at":"2026-05-18T00:05:19.240134Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:05:19.240134Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"fhdzRmJf6I+FeTjmPU8UGfuwjCG3pRY8WWKDYZI3a69Pyjfufemv9XOWJHQuT2xoQOUa/P7BxwDHQ7KsSLp+AA==","signature_status":"signed_v1","signed_at":"2026-05-18T00:05:19.240644Z","signed_message":"canonical_sha256_bytes"},"source_id":"1805.09190","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d441c043de5638f2d75cf4f492d2163aedf6fae2df7a3b9144749eeeff450d7e","sha256:de0ab99fffdb2a8d5b1d3ca4f7db050d9874ccfa7b7dfc90ad4dd09ea94c2579"],"state_sha256":"3286400e54311967158080c1f5b00a400d7e5411f2c5bb73064b4459a358a3b1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UKq7fneIxP00Es8KifhQXATMci+AnRD7yonGQbp++ze03trrLTvHQSBstK8qL8hozgrjT95YNdDfkh72wUfkAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T10:11:01.861284Z","bundle_sha256":"e0ad47b1397e029d2e4b250edea623aaf57571cfcd0b1156ea327edde0e352f3"}}