{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:CCQ24QPTHTJYOBO4VMBTNVHRWQ","short_pith_number":"pith:CCQ24QPT","canonical_record":{"source":{"id":"2206.14371","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8","abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237"},"schema_version":"1.0"},"canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","source":{"kind":"arxiv","id":"2206.14371","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"arxiv_version","alias_value":"2206.14371v1","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_12","alias_value":"CCQ24QPTHTJY","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_16","alias_value":"CCQ24QPTHTJYOBO4","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_8","alias_value":"CCQ24QPT","created_at":"2026-07-05T04:36:03Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:CCQ24QPTHTJYOBO4VMBTNVHRWQ","target":"record","payload":{"canonical_record":{"source":{"id":"2206.14371","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8","abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237"},"schema_version":"1.0"},"canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:36:03.595853Z","signature_b64":"iE0IkYCfGfKoNEzX7qbcrvzd3cwlhRlXD3xFVPAqgCsvPAWWhbjevq5+UCUmV3Z5QcJ0CzafOdCvSX/QGWBSDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","last_reissued_at":"2026-07-05T04:36:03.595404Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:36:03.595404Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2206.14371","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:36:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"bQhEAVjNgAFim8eK+FnQ6g0x3kSWCJGbsRZmDzUSdnbd1ONE5TN+5zuCiZ/jfZECo0LwrLFaThK5dZ7Vc+ODAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T01:30:13.584944Z"},"content_sha256":"4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684","schema_version":"1.0","event_id":"sha256:4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:CCQ24QPTHTJYOBO4VMBTNVHRWQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Matryoshka: Stealing Functionality of Private ML Data by Hiding Models in Model","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.AI","cs.CR","cs.LG"],"primary_cat":"stat.ML","authors_text":"Min Yang, Mi Zhang, Shengyao Zhang, Xudong Pan, Yifan Yan","submitted_at":"2022-06-29T02:36:22Z","abstract_excerpt":"In this paper, we present a novel insider attack called Matryoshka, which employs an irrelevant scheduled-to-publish DNN model as a carrier model for covert transmission of multiple secret models which memorize the functionality of private ML data stored in local data centers. Instead of treating the parameters of the carrier model as bit strings and applying conventional steganography, we devise a novel parameter sharing approach which exploits the learning capacity of the carrier model for information hiding. Matryoshka simultaneously achieves: (i) High Capacity -- With almost no utility los"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2206.14371","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2206.14371/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:36:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZeP8YUSKmrmCsIMzb40LQIVkSiLQDJVXB1yKSa3z5ZpD21W9upq8AwXqbPZh6CqeZkbR0XBRFH0JVsy75aqZCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T01:30:13.586829Z"},"content_sha256":"c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda","schema_version":"1.0","event_id":"sha256:c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/bundle.json","state_url":"https://pith.science/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-11T01:30:13Z","links":{"resolver":"https://pith.science/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ","bundle":"https://pith.science/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/bundle.json","state":"https://pith.science/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CCQ24QPTHTJYOBO4VMBTNVHRWQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:CCQ24QPTHTJYOBO4VMBTNVHRWQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8"},"schema_version":"1.0","source":{"id":"2206.14371","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"arxiv_version","alias_value":"2206.14371v1","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_12","alias_value":"CCQ24QPTHTJY","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_16","alias_value":"CCQ24QPTHTJYOBO4","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_8","alias_value":"CCQ24QPT","created_at":"2026-07-05T04:36:03Z"}],"graph_snapshots":[{"event_id":"sha256:c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda","target":"graph","created_at":"2026-07-05T04:36:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2206.14371/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper, we present a novel insider attack called Matryoshka, which employs an irrelevant scheduled-to-publish DNN model as a carrier model for covert transmission of multiple secret models which memorize the functionality of private ML data stored in local data centers. Instead of treating the parameters of the carrier model as bit strings and applying conventional steganography, we devise a novel parameter sharing approach which exploits the learning capacity of the carrier model for information hiding. Matryoshka simultaneously achieves: (i) High Capacity -- With almost no utility los","authors_text":"Min Yang, Mi Zhang, Shengyao Zhang, Xudong Pan, Yifan Yan","cross_cats":["cs.AI","cs.CR","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title":"Matryoshka: Stealing Functionality of Private ML Data by Hiding Models in Model"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2206.14371","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684","target":"record","created_at":"2026-07-05T04:36:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8"},"schema_version":"1.0","source":{"id":"2206.14371","kind":"arxiv","version":1}},"canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","first_computed_at":"2026-07-05T04:36:03.595404Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:36:03.595404Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"iE0IkYCfGfKoNEzX7qbcrvzd3cwlhRlXD3xFVPAqgCsvPAWWhbjevq5+UCUmV3Z5QcJ0CzafOdCvSX/QGWBSDA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:36:03.595853Z","signed_message":"canonical_sha256_bytes"},"source_id":"2206.14371","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684","sha256:c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda"],"state_sha256":"a154c43582b15acf53cad55bef05d0b3084dd8c43409a84ea9003452251d13f2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qBmfiUOlvnDZQ2KcNsrEiSPdguT4XPTAOJ9V4p3NkmC6Z1ZWRI+xeCmmZ5DAgAD/MVx7KeqrfYl0SZTZs23wAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-11T01:30:13.594622Z","bundle_sha256":"6020b444df26097e09f435b19c7d74af77985ee4333322b1c1d524d7a03b2930"}}