{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:4M5Q5URURSPGVAE76EZHVOIM2E","short_pith_number":"pith:4M5Q5URU","canonical_record":{"source":{"id":"2607.17503","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-20T03:18:15Z","cross_cats_sorted":[],"title_canon_sha256":"209f4b67960f180765364a331e7fae9a23caaccff1b8a472f24d71bf2e19faa3","abstract_canon_sha256":"b9f6b0e10072173e755288ea219f64e6d2f0ed1e6215a844051d19486a569e2f"},"schema_version":"1.0"},"canonical_sha256":"e33b0ed2348c9e6a809ff1327ab90cd118cbcdf76b42da08226bc52693ab4e02","source":{"kind":"arxiv","id":"2607.17503","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.17503","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"arxiv_version","alias_value":"2607.17503v1","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.17503","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_12","alias_value":"4M5Q5URURSPG","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_16","alias_value":"4M5Q5URURSPGVAE7","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_8","alias_value":"4M5Q5URU","created_at":"2026-07-21T01:21:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:4M5Q5URURSPGVAE76EZHVOIM2E","target":"record","payload":{"canonical_record":{"source":{"id":"2607.17503","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-20T03:18:15Z","cross_cats_sorted":[],"title_canon_sha256":"209f4b67960f180765364a331e7fae9a23caaccff1b8a472f24d71bf2e19faa3","abstract_canon_sha256":"b9f6b0e10072173e755288ea219f64e6d2f0ed1e6215a844051d19486a569e2f"},"schema_version":"1.0"},"canonical_sha256":"e33b0ed2348c9e6a809ff1327ab90cd118cbcdf76b42da08226bc52693ab4e02","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-21T01:21:49.007415Z","signature_b64":"gNPqqu17LPuVwCn6ag91At4EidAkcfV0RF8bnBxtA/rI9BvrxFKJO7LsGGgR8zprhXv5/npVSbwiXl5B2p26BA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e33b0ed2348c9e6a809ff1327ab90cd118cbcdf76b42da08226bc52693ab4e02","last_reissued_at":"2026-07-21T01:21:49.006523Z","signature_status":"signed_v1","first_computed_at":"2026-07-21T01:21:49.006523Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.17503","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-21T01:21:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fpQbhz3D00F7lsdbd/IQgiVbE17kUWmxpFrhaWwv3PWiIVFjiaY9Tq0JeVFXFYSN+Mjo2xUX5pOD5ivfyyS0CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T08:44:37.100855Z"},"content_sha256":"6efed677a58b8494a5c9435c739a193f0495c8cac4c0230fe4f691655c589456","schema_version":"1.0","event_id":"sha256:6efed677a58b8494a5c9435c739a193f0495c8cac4c0230fe4f691655c589456"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:4M5Q5URURSPGVAE76EZHVOIM2E","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Dhruv Pradhan, Ezekiel Soremekun, Sarang Nambiar","submitted_at":"2026-07-20T03:18:15Z","abstract_excerpt":"Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.17503","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.17503/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-21T01:21:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"23pZs41ZabtEX9+Mg/1vUG8BCZz/nNAwfTDrIWDXHNyk/UKJGMStRYjCG/yxoJKh5QNlyN6sGK9E+oL51qyiDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T08:44:37.102015Z"},"content_sha256":"8acd55c7131a0fa84124f4d1bd1b76ecde8b1ffb6acf5c1d446df91720c15987","schema_version":"1.0","event_id":"sha256:8acd55c7131a0fa84124f4d1bd1b76ecde8b1ffb6acf5c1d446df91720c15987"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4M5Q5URURSPGVAE76EZHVOIM2E/bundle.json","state_url":"https://pith.science/pith/4M5Q5URURSPGVAE76EZHVOIM2E/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4M5Q5URURSPGVAE76EZHVOIM2E/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T08:44:37Z","links":{"resolver":"https://pith.science/pith/4M5Q5URURSPGVAE76EZHVOIM2E","bundle":"https://pith.science/pith/4M5Q5URURSPGVAE76EZHVOIM2E/bundle.json","state":"https://pith.science/pith/4M5Q5URURSPGVAE76EZHVOIM2E/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4M5Q5URURSPGVAE76EZHVOIM2E/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:4M5Q5URURSPGVAE76EZHVOIM2E","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b9f6b0e10072173e755288ea219f64e6d2f0ed1e6215a844051d19486a569e2f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-20T03:18:15Z","title_canon_sha256":"209f4b67960f180765364a331e7fae9a23caaccff1b8a472f24d71bf2e19faa3"},"schema_version":"1.0","source":{"id":"2607.17503","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.17503","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"arxiv_version","alias_value":"2607.17503v1","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.17503","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_12","alias_value":"4M5Q5URURSPG","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_16","alias_value":"4M5Q5URURSPGVAE7","created_at":"2026-07-21T01:21:49Z"},{"alias_kind":"pith_short_8","alias_value":"4M5Q5URU","created_at":"2026-07-21T01:21:49Z"}],"graph_snapshots":[{"event_id":"sha256:8acd55c7131a0fa84124f4d1bd1b76ecde8b1ffb6acf5c1d446df91720c15987","target":"graph","created_at":"2026-07-21T01:21:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.17503/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Model hosting hubs (e.g., Hugging Face) are vulnerable to supply chain attacks that enable remote code execution on trusted user environments. Attackers often distribute malicious Pre-trained ML models (PTMs) via model hubs. In this paper, we present novel attacks against PTMs and model hubs called SHADOWPICKLE. SHADOWPICKLE includes three (3) stealthy pickle deserialization attacks that enable malicious behaviors and evade state-of-the-art (SOTA) model scanners. These attacks leverage the external module import mechanism of the Pickle Virtual Machine (VM) to execute malicious payloads during ","authors_text":"Dhruv Pradhan, Ezekiel Soremekun, Sarang Nambiar","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-20T03:18:15Z","title":"ShadowPickle: Evading Machine Learning Model Scanners via Stealthy Pickle Deserialization Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.17503","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6efed677a58b8494a5c9435c739a193f0495c8cac4c0230fe4f691655c589456","target":"record","created_at":"2026-07-21T01:21:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b9f6b0e10072173e755288ea219f64e6d2f0ed1e6215a844051d19486a569e2f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-20T03:18:15Z","title_canon_sha256":"209f4b67960f180765364a331e7fae9a23caaccff1b8a472f24d71bf2e19faa3"},"schema_version":"1.0","source":{"id":"2607.17503","kind":"arxiv","version":1}},"canonical_sha256":"e33b0ed2348c9e6a809ff1327ab90cd118cbcdf76b42da08226bc52693ab4e02","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e33b0ed2348c9e6a809ff1327ab90cd118cbcdf76b42da08226bc52693ab4e02","first_computed_at":"2026-07-21T01:21:49.006523Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-21T01:21:49.006523Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"gNPqqu17LPuVwCn6ag91At4EidAkcfV0RF8bnBxtA/rI9BvrxFKJO7LsGGgR8zprhXv5/npVSbwiXl5B2p26BA==","signature_status":"signed_v1","signed_at":"2026-07-21T01:21:49.007415Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.17503","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6efed677a58b8494a5c9435c739a193f0495c8cac4c0230fe4f691655c589456","sha256:8acd55c7131a0fa84124f4d1bd1b76ecde8b1ffb6acf5c1d446df91720c15987"],"state_sha256":"6ab04a4b3cafdf1323e2489394781d113ed1e61eeee4c5c3cccaa706b6c668c1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NgBVudO+eHaift33JEZfY4NrPylNxcJgSaAoVu15gmXVtmZRQxGI9uKq0eu7q/UFbpG9cYGUPIduCVHGn7WHCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T08:44:37.110384Z","bundle_sha256":"bb273b9b6beedea9d3bedc6829ff0883fce360843016e6cdab21b9de244e81b7"}}