{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:3PNSK3MMMECOWRBB676PFEAILQ","short_pith_number":"pith:3PNSK3MM","canonical_record":{"source":{"id":"2208.13720","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T17:01:01Z","cross_cats_sorted":["cs.DC"],"title_canon_sha256":"805b1dc134e5e9c177fc0cd8625013e60015ab7c1ae48ebc413afb6a7b4b3c0a","abstract_canon_sha256":"721f50e240d3765aed11edf47946fe254ab375342df6df6581d151502ea4764b"},"schema_version":"1.0"},"canonical_sha256":"dbdb256d8c6104eb4421f7fcf290085c3575288394e354ddb61a073cd78992b2","source":{"kind":"arxiv","id":"2208.13720","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.13720","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"arxiv_version","alias_value":"2208.13720v1","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.13720","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_12","alias_value":"3PNSK3MMMECO","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_16","alias_value":"3PNSK3MMMECOWRBB","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_8","alias_value":"3PNSK3MM","created_at":"2026-07-05T04:52:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:3PNSK3MMMECOWRBB676PFEAILQ","target":"record","payload":{"canonical_record":{"source":{"id":"2208.13720","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T17:01:01Z","cross_cats_sorted":["cs.DC"],"title_canon_sha256":"805b1dc134e5e9c177fc0cd8625013e60015ab7c1ae48ebc413afb6a7b4b3c0a","abstract_canon_sha256":"721f50e240d3765aed11edf47946fe254ab375342df6df6581d151502ea4764b"},"schema_version":"1.0"},"canonical_sha256":"dbdb256d8c6104eb4421f7fcf290085c3575288394e354ddb61a073cd78992b2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:52:20.376912Z","signature_b64":"qsI+VZGkUv9TFcd+02DFbtlYprnMKZ+W9HpWnYAl1d4D78RLsMbGTqs72Xf9PjJZo74P16R26ggXP0mutuAQBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"dbdb256d8c6104eb4421f7fcf290085c3575288394e354ddb61a073cd78992b2","last_reissued_at":"2026-07-05T04:52:20.376489Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:52:20.376489Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2208.13720","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:52:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"33MSUOePOJh0wVEddBZJgVjnFRatQfw6pn1P/8pFDBRjTmBE0BYwlhIitamBt/EspjMkD45Q2227CNRNW91fBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T06:23:27.620658Z"},"content_sha256":"6953137d8ee6ba37677c2683607123801e4f1b01699191896185eaafd018d7ad","schema_version":"1.0","event_id":"sha256:6953137d8ee6ba37677c2683607123801e4f1b01699191896185eaafd018d7ad"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:3PNSK3MMMECOWRBB676PFEAILQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Demystifying Arch-hints for Model Extraction: An Attack in Unified Memory System","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.DC"],"primary_cat":"cs.CR","authors_text":"Danfeng Zhang, Xiaoming Zeng, Xing Hu, Xulong Tang, Yang Hu, Zhendong Wang","submitted_at":"2022-08-29T17:01:01Z","abstract_excerpt":"The deep neural network (DNN) models are deemed confidential due to their unique value in expensive training efforts, privacy-sensitive training data, and proprietary network characteristics. Consequently, the model value raises incentive for adversary to steal the model for profits, such as the representative model extraction attack. Emerging attack can leverage timing-sensitive architecture-level events (i.e., Arch-hints) disclosed in hardware platforms to extract DNN model layer information accurately. In this paper, we take the first step to uncover the root cause of such Arch-hints and su"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.13720","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2208.13720/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:52:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RAuoyrrMy4FhSxqwKGp1TCoJz0Uyp07JBdck8cCB1ReL26yoMOwYb0lr20saITLsKyFVb8xOry+8H+Xj1FXTBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T06:23:27.621521Z"},"content_sha256":"5b1ba36ea47f2dce4be917f5cd926a1cb3f12ad2c23fed86111bdc7b90b0c6a0","schema_version":"1.0","event_id":"sha256:5b1ba36ea47f2dce4be917f5cd926a1cb3f12ad2c23fed86111bdc7b90b0c6a0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/3PNSK3MMMECOWRBB676PFEAILQ/bundle.json","state_url":"https://pith.science/pith/3PNSK3MMMECOWRBB676PFEAILQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/3PNSK3MMMECOWRBB676PFEAILQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-14T06:23:27Z","links":{"resolver":"https://pith.science/pith/3PNSK3MMMECOWRBB676PFEAILQ","bundle":"https://pith.science/pith/3PNSK3MMMECOWRBB676PFEAILQ/bundle.json","state":"https://pith.science/pith/3PNSK3MMMECOWRBB676PFEAILQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/3PNSK3MMMECOWRBB676PFEAILQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:3PNSK3MMMECOWRBB676PFEAILQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"721f50e240d3765aed11edf47946fe254ab375342df6df6581d151502ea4764b","cross_cats_sorted":["cs.DC"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T17:01:01Z","title_canon_sha256":"805b1dc134e5e9c177fc0cd8625013e60015ab7c1ae48ebc413afb6a7b4b3c0a"},"schema_version":"1.0","source":{"id":"2208.13720","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.13720","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"arxiv_version","alias_value":"2208.13720v1","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.13720","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_12","alias_value":"3PNSK3MMMECO","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_16","alias_value":"3PNSK3MMMECOWRBB","created_at":"2026-07-05T04:52:20Z"},{"alias_kind":"pith_short_8","alias_value":"3PNSK3MM","created_at":"2026-07-05T04:52:20Z"}],"graph_snapshots":[{"event_id":"sha256:5b1ba36ea47f2dce4be917f5cd926a1cb3f12ad2c23fed86111bdc7b90b0c6a0","target":"graph","created_at":"2026-07-05T04:52:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2208.13720/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The deep neural network (DNN) models are deemed confidential due to their unique value in expensive training efforts, privacy-sensitive training data, and proprietary network characteristics. Consequently, the model value raises incentive for adversary to steal the model for profits, such as the representative model extraction attack. Emerging attack can leverage timing-sensitive architecture-level events (i.e., Arch-hints) disclosed in hardware platforms to extract DNN model layer information accurately. In this paper, we take the first step to uncover the root cause of such Arch-hints and su","authors_text":"Danfeng Zhang, Xiaoming Zeng, Xing Hu, Xulong Tang, Yang Hu, Zhendong Wang","cross_cats":["cs.DC"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T17:01:01Z","title":"Demystifying Arch-hints for Model Extraction: An Attack in Unified Memory System"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.13720","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6953137d8ee6ba37677c2683607123801e4f1b01699191896185eaafd018d7ad","target":"record","created_at":"2026-07-05T04:52:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"721f50e240d3765aed11edf47946fe254ab375342df6df6581d151502ea4764b","cross_cats_sorted":["cs.DC"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-08-29T17:01:01Z","title_canon_sha256":"805b1dc134e5e9c177fc0cd8625013e60015ab7c1ae48ebc413afb6a7b4b3c0a"},"schema_version":"1.0","source":{"id":"2208.13720","kind":"arxiv","version":1}},"canonical_sha256":"dbdb256d8c6104eb4421f7fcf290085c3575288394e354ddb61a073cd78992b2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"dbdb256d8c6104eb4421f7fcf290085c3575288394e354ddb61a073cd78992b2","first_computed_at":"2026-07-05T04:52:20.376489Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:52:20.376489Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"qsI+VZGkUv9TFcd+02DFbtlYprnMKZ+W9HpWnYAl1d4D78RLsMbGTqs72Xf9PjJZo74P16R26ggXP0mutuAQBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T04:52:20.376912Z","signed_message":"canonical_sha256_bytes"},"source_id":"2208.13720","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6953137d8ee6ba37677c2683607123801e4f1b01699191896185eaafd018d7ad","sha256:5b1ba36ea47f2dce4be917f5cd926a1cb3f12ad2c23fed86111bdc7b90b0c6a0"],"state_sha256":"23a360bcc2cbb421b7bf7dae8e0b73b82880468ab82af30c3ad0afc127dcc283"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"quvzdCh67hoDXTMFX1HoATNNTV+ka7RNvb/LUVAv6adhc7sq4l2ECqr2909LMq8ohCGOkq/3wsk5cU1EMynMBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-14T06:23:27.631253Z","bundle_sha256":"a4db4374e4c01122b5d7cacdd1a27a32db37d9d2b7db860fb2a16bd535c0578d"}}