{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:CWOO7Q5TV2YKDROEUZXNABHCTI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d2f4b5c0d8289c158503a05ad43a944116b6bb109d0f226c6165aad1a1502e63","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-10T14:14:22Z","title_canon_sha256":"16eb581c2b85d06a878e1cadfebd904bf71f4a3ffcfe0468d8e6024cb03fb840"},"schema_version":"1.0","source":{"id":"2009.04872","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2009.04872","created_at":"2026-07-05T01:34:30Z"},{"alias_kind":"arxiv_version","alias_value":"2009.04872v1","created_at":"2026-07-05T01:34:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2009.04872","created_at":"2026-07-05T01:34:30Z"},{"alias_kind":"pith_short_12","alias_value":"CWOO7Q5TV2YK","created_at":"2026-07-05T01:34:30Z"},{"alias_kind":"pith_short_16","alias_value":"CWOO7Q5TV2YKDROE","created_at":"2026-07-05T01:34:30Z"},{"alias_kind":"pith_short_8","alias_value":"CWOO7Q5T","created_at":"2026-07-05T01:34:30Z"}],"graph_snapshots":[{"event_id":"sha256:3a56ec43cd32bf0ece4d761624c03765f69689085412d264b29050a9e5f39630","target":"graph","created_at":"2026-07-05T01:34:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2009.04872/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"While being deployed in many critical applications as core components, machine learning (ML) models are vulnerable to various security and privacy attacks. One major privacy attack in this domain is membership inference, where an adversary aims to determine whether a target data sample is part of the training set of a target ML model. So far, most of the current membership inference attacks are evaluated against ML models trained from scratch. However, real-world ML models are typically trained following the transfer learning paradigm, where a model owner takes a pretrained model learned from ","authors_text":"Michael Backes, Yang Zhang, Yang Zou, Zhikun Zhang","cross_cats":["cs.LG","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-10T14:14:22Z","title":"Privacy Analysis of Deep Learning in the Wild: Membership Inference Attacks against Transfer Learning"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2009.04872","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4dd53d1a70b0b524154e3e2cde02a17dc7267f5152bddcfa8d8ceaa6b679cece","target":"record","created_at":"2026-07-05T01:34:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d2f4b5c0d8289c158503a05ad43a944116b6bb109d0f226c6165aad1a1502e63","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-09-10T14:14:22Z","title_canon_sha256":"16eb581c2b85d06a878e1cadfebd904bf71f4a3ffcfe0468d8e6024cb03fb840"},"schema_version":"1.0","source":{"id":"2009.04872","kind":"arxiv","version":1}},"canonical_sha256":"159cefc3b3aeb0a1c5c4a66ed004e29a116bd6c6f46daf356a81e800d01944e6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"159cefc3b3aeb0a1c5c4a66ed004e29a116bd6c6f46daf356a81e800d01944e6","first_computed_at":"2026-07-05T01:34:30.712142Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:34:30.712142Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"niRhbcDqLSH5SQC1p7SDCpmqDbDHQO71gsF6Ntpc8Jg8znw3UQc22uqT5iL8mmdA+vJe8IcAyCcmMiZ/Pg/8DA==","signature_status":"signed_v1","signed_at":"2026-07-05T01:34:30.712629Z","signed_message":"canonical_sha256_bytes"},"source_id":"2009.04872","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4dd53d1a70b0b524154e3e2cde02a17dc7267f5152bddcfa8d8ceaa6b679cece","sha256:3a56ec43cd32bf0ece4d761624c03765f69689085412d264b29050a9e5f39630"],"state_sha256":"ac0e1d92c005092288576a611caa84631f37d3aa030d6b5e1d321ef6886002b6"}