{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:CCQ24QPTHTJYOBO4VMBTNVHRWQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8"},"schema_version":"1.0","source":{"id":"2206.14371","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"arxiv_version","alias_value":"2206.14371v1","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2206.14371","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_12","alias_value":"CCQ24QPTHTJY","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_16","alias_value":"CCQ24QPTHTJYOBO4","created_at":"2026-07-05T04:36:03Z"},{"alias_kind":"pith_short_8","alias_value":"CCQ24QPT","created_at":"2026-07-05T04:36:03Z"}],"graph_snapshots":[{"event_id":"sha256:c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda","target":"graph","created_at":"2026-07-05T04:36:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2206.14371/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper, we present a novel insider attack called Matryoshka, which employs an irrelevant scheduled-to-publish DNN model as a carrier model for covert transmission of multiple secret models which memorize the functionality of private ML data stored in local data centers. Instead of treating the parameters of the carrier model as bit strings and applying conventional steganography, we devise a novel parameter sharing approach which exploits the learning capacity of the carrier model for information hiding. Matryoshka simultaneously achieves: (i) High Capacity -- With almost no utility los","authors_text":"Min Yang, Mi Zhang, Shengyao Zhang, Xudong Pan, Yifan Yan","cross_cats":["cs.AI","cs.CR","cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title":"Matryoshka: Stealing Functionality of Private ML Data by Hiding Models in Model"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2206.14371","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684","target":"record","created_at":"2026-07-05T04:36:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9057c1852d7a69c7311b0175e4e8b1a11d5397b040d13be9f0dc85b09fec1237","cross_cats_sorted":["cs.AI","cs.CR","cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"stat.ML","submitted_at":"2022-06-29T02:36:22Z","title_canon_sha256":"44b7f14d6938e218d3c5c2523acc534cd19a98ce2fd9914f3ae809c6bb17f1b8"},"schema_version":"1.0","source":{"id":"2206.14371","kind":"arxiv","version":1}},"canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"10a1ae41f33cd38705dcab0336d4f1b426eb83dbf43636d232172447cad71fc3","first_computed_at":"2026-07-05T04:36:03.595404Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:36:03.595404Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"iE0IkYCfGfKoNEzX7qbcrvzd3cwlhRlXD3xFVPAqgCsvPAWWhbjevq5+UCUmV3Z5QcJ0CzafOdCvSX/QGWBSDA==","signature_status":"signed_v1","signed_at":"2026-07-05T04:36:03.595853Z","signed_message":"canonical_sha256_bytes"},"source_id":"2206.14371","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4f6ab298073147e853b48338df1940b0a77da0a7818381caa1781bec92039684","sha256:c39255468dd2932fb950a8a4fe270410e67ce44ad169b2b66c42e0e63c933cda"],"state_sha256":"a154c43582b15acf53cad55bef05d0b3084dd8c43409a84ea9003452251d13f2"}