{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:74DLQLSZWWYGKAOO23UBOE2GMC","short_pith_number":"pith:74DLQLSZ","canonical_record":{"source":{"id":"2508.09652","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T09:35:51Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"fba0f093ae7e00997d40a39e686ce743e5f4b82fb35a96ae26fbe64bd58cb630","abstract_canon_sha256":"b0c4e6f9f1e161af3d6c57df596bfe26dae2b458025a1ef0fa4678d1d678575d"},"schema_version":"1.0"},"canonical_sha256":"ff06b82e59b5b06501ced6e817134660b3af1c9080c52ebcab5899a10f6ed6f6","source":{"kind":"arxiv","id":"2508.09652","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.09652","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"arxiv_version","alias_value":"2508.09652v1","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.09652","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_12","alias_value":"74DLQLSZWWYG","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_16","alias_value":"74DLQLSZWWYGKAOO","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_8","alias_value":"74DLQLSZ","created_at":"2026-07-05T11:53:19Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:74DLQLSZWWYGKAOO23UBOE2GMC","target":"record","payload":{"canonical_record":{"source":{"id":"2508.09652","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T09:35:51Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"fba0f093ae7e00997d40a39e686ce743e5f4b82fb35a96ae26fbe64bd58cb630","abstract_canon_sha256":"b0c4e6f9f1e161af3d6c57df596bfe26dae2b458025a1ef0fa4678d1d678575d"},"schema_version":"1.0"},"canonical_sha256":"ff06b82e59b5b06501ced6e817134660b3af1c9080c52ebcab5899a10f6ed6f6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:53:19.110979Z","signature_b64":"c+Q+NGP8raGABMJeJAiMhGadWrpiRb2olIl2OrjBe5MVtfVgNHW4v39+mbgfQCIlny2nK53qdvDdet+RyZ31Dw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ff06b82e59b5b06501ced6e817134660b3af1c9080c52ebcab5899a10f6ed6f6","last_reissued_at":"2026-07-05T11:53:19.110360Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:53:19.110360Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.09652","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"F+XBbCE6tL5NQ3wxeC3K7541WLPvEVmG7rljPqLwcB7o1K2gZcfjmxbW/SVhNFA2+wBMvAw09WyaRCy/DOsDBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T05:30:22.947408Z"},"content_sha256":"294944dea07b617209e99db95b33fee34807c1a934967b28c263ce584c2b3d41","schema_version":"1.0","event_id":"sha256:294944dea07b617209e99db95b33fee34807c1a934967b28c263ce584c2b3d41"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:74DLQLSZWWYGKAOO23UBOE2GMC","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection","license":"http://creativecommons.org/publicdomain/zero/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Andrea Ponte, Battista Biggio, Fabio Roli, Ivan Tesfai Ogbu, Luca Demetrio, Luca Oneto","submitted_at":"2025-08-13T09:35:51Z","abstract_excerpt":"Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples, carefully crafted programs designed to evade detection. Hence, in this work we investigate the influence that signature-based detection exerts on model training, when they are included inside the training pipeline. Specifically, we compare models trained on a comprehensive dataset with an AI system whose"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.09652","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.09652/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:53:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"q8+2K6GshwdowT6/TT/iLoCT5WH9XVLwdgBBQuBls0+N+I0YJGY1teZBa30+QnByd5R180vofW1ZHFXLYnFwBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T05:30:22.949225Z"},"content_sha256":"e0ebce300cf9ba825b19854a327fae9ab24082abf433fea33dba8969eabddd94","schema_version":"1.0","event_id":"sha256:e0ebce300cf9ba825b19854a327fae9ab24082abf433fea33dba8969eabddd94"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/74DLQLSZWWYGKAOO23UBOE2GMC/bundle.json","state_url":"https://pith.science/pith/74DLQLSZWWYGKAOO23UBOE2GMC/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/74DLQLSZWWYGKAOO23UBOE2GMC/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-13T05:30:22Z","links":{"resolver":"https://pith.science/pith/74DLQLSZWWYGKAOO23UBOE2GMC","bundle":"https://pith.science/pith/74DLQLSZWWYGKAOO23UBOE2GMC/bundle.json","state":"https://pith.science/pith/74DLQLSZWWYGKAOO23UBOE2GMC/state.json","well_known_bundle":"https://pith.science/.well-known/pith/74DLQLSZWWYGKAOO23UBOE2GMC/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:74DLQLSZWWYGKAOO23UBOE2GMC","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b0c4e6f9f1e161af3d6c57df596bfe26dae2b458025a1ef0fa4678d1d678575d","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T09:35:51Z","title_canon_sha256":"fba0f093ae7e00997d40a39e686ce743e5f4b82fb35a96ae26fbe64bd58cb630"},"schema_version":"1.0","source":{"id":"2508.09652","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.09652","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"arxiv_version","alias_value":"2508.09652v1","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.09652","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_12","alias_value":"74DLQLSZWWYG","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_16","alias_value":"74DLQLSZWWYGKAOO","created_at":"2026-07-05T11:53:19Z"},{"alias_kind":"pith_short_8","alias_value":"74DLQLSZ","created_at":"2026-07-05T11:53:19Z"}],"graph_snapshots":[{"event_id":"sha256:e0ebce300cf9ba825b19854a327fae9ab24082abf433fea33dba8969eabddd94","target":"graph","created_at":"2026-07-05T11:53:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.09652/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples, carefully crafted programs designed to evade detection. Hence, in this work we investigate the influence that signature-based detection exerts on model training, when they are included inside the training pipeline. Specifically, we compare models trained on a comprehensive dataset with an AI system whose","authors_text":"Andrea Ponte, Battista Biggio, Fabio Roli, Ivan Tesfai Ogbu, Luca Demetrio, Luca Oneto","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T09:35:51Z","title":"Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.09652","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:294944dea07b617209e99db95b33fee34807c1a934967b28c263ce584c2b3d41","target":"record","created_at":"2026-07-05T11:53:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b0c4e6f9f1e161af3d6c57df596bfe26dae2b458025a1ef0fa4678d1d678575d","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"cs.CR","submitted_at":"2025-08-13T09:35:51Z","title_canon_sha256":"fba0f093ae7e00997d40a39e686ce743e5f4b82fb35a96ae26fbe64bd58cb630"},"schema_version":"1.0","source":{"id":"2508.09652","kind":"arxiv","version":1}},"canonical_sha256":"ff06b82e59b5b06501ced6e817134660b3af1c9080c52ebcab5899a10f6ed6f6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ff06b82e59b5b06501ced6e817134660b3af1c9080c52ebcab5899a10f6ed6f6","first_computed_at":"2026-07-05T11:53:19.110360Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:53:19.110360Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"c+Q+NGP8raGABMJeJAiMhGadWrpiRb2olIl2OrjBe5MVtfVgNHW4v39+mbgfQCIlny2nK53qdvDdet+RyZ31Dw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:53:19.110979Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.09652","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:294944dea07b617209e99db95b33fee34807c1a934967b28c263ce584c2b3d41","sha256:e0ebce300cf9ba825b19854a327fae9ab24082abf433fea33dba8969eabddd94"],"state_sha256":"fcad55b6ac7066f5c7cd1e542719937df4acb133239bd68e8ab86cfbf837558c"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qLWsZxPIpApf6qSW9mEwiajI8fh15mvAQZepvNhkKm6jywJm8JINw9AB7GdCIBNBAxnoDPP8IOs19ka6uGAJBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-13T05:30:22.959045Z","bundle_sha256":"f6b3cfeb089f97eaf0aef6dc196a010bbea3e4f2b242d7d759792885aab82449"}}