{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:E7ME7VKBDGUIKPF3HOBLYZXAM7","short_pith_number":"pith:E7ME7VKB","canonical_record":{"source":{"id":"2205.12134","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2022-05-24T15:10:50Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"308452be1ab6086d9ec988b9833c13118200c563fc2a786b5ae232371445edb3","abstract_canon_sha256":"8fa3c81d2416e2fba32edd1adced87ad8715c0d5fb8e5fe1e6bc4dffb8f6aaab"},"schema_version":"1.0"},"canonical_sha256":"27d84fd54119a8853cbb3b82bc66e067fce2fb9e7cf6ce4eb69eecb63d6dd37f","source":{"kind":"arxiv","id":"2205.12134","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2205.12134","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"arxiv_version","alias_value":"2205.12134v3","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2205.12134","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_12","alias_value":"E7ME7VKBDGUI","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_16","alias_value":"E7ME7VKBDGUIKPF3","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_8","alias_value":"E7ME7VKB","created_at":"2026-07-05T05:25:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:E7ME7VKBDGUIKPF3HOBLYZXAM7","target":"record","payload":{"canonical_record":{"source":{"id":"2205.12134","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2022-05-24T15:10:50Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"308452be1ab6086d9ec988b9833c13118200c563fc2a786b5ae232371445edb3","abstract_canon_sha256":"8fa3c81d2416e2fba32edd1adced87ad8715c0d5fb8e5fe1e6bc4dffb8f6aaab"},"schema_version":"1.0"},"canonical_sha256":"27d84fd54119a8853cbb3b82bc66e067fce2fb9e7cf6ce4eb69eecb63d6dd37f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:25:49.272854Z","signature_b64":"IQLulNU8TBi/L24iEewig/Q1krchS0Vw2CWsSYil77c8/AgsFKM9eBnSv4b98FFR+ni/37ttkmfc2n5cThCBBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"27d84fd54119a8853cbb3b82bc66e067fce2fb9e7cf6ce4eb69eecb63d6dd37f","last_reissued_at":"2026-07-05T05:25:49.270227Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:25:49.270227Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2205.12134","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:25:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"P+CLOTkdybkP4mp3OsgRnGN5aSJbRGLL36n3s8rRmSv3MK6rGLQs7I5k7+vOtjixK0jd6k9v1jQ1FPO/XbxNCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T17:37:04.138789Z"},"content_sha256":"f553bfa711319e9f145385713f6335cc75b9c900c67b4b0cd4a869b3b7eb53af","schema_version":"1.0","event_id":"sha256:f553bfa711319e9f145385713f6335cc75b9c900c67b4b0cd4a869b3b7eb53af"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:E7ME7VKBDGUIKPF3HOBLYZXAM7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.LG","authors_text":"Cihang Xie, Qinghua Tao, Sizhe Chen, Xiaolin Huang, Yingwen Wu, Zhehao Huang","submitted_at":"2022-05-24T15:10:50Z","abstract_excerpt":"The score-based query attacks (SQAs) pose practical threats to deep neural networks by crafting adversarial perturbations within dozens of queries, only using the model's output scores. Nonetheless, we note that if the loss trend of the outputs is slightly perturbed, SQAs could be easily misled and thereby become much less effective. Following this idea, we propose a novel defense, namely Adversarial Attack on Attackers (AAA), to confound SQAs towards incorrect attack directions by slightly modifying the output logits. In this way, (1) SQAs are prevented regardless of the model's worst-case ro"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2205.12134","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2205.12134/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:25:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DdxMcewpcQZ4AZ94OYIUKeGbAlAckVnS+Qds3t8bp9v162b84axdHschC9vQ9ESueoNVX0f/FYE2I1rC9Lx/Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T17:37:04.139121Z"},"content_sha256":"476122973e26fee914a48d1501c3e8a0a48ef9dfbef078601605f463ecd66ad6","schema_version":"1.0","event_id":"sha256:476122973e26fee914a48d1501c3e8a0a48ef9dfbef078601605f463ecd66ad6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/bundle.json","state_url":"https://pith.science/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T17:37:04Z","links":{"resolver":"https://pith.science/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7","bundle":"https://pith.science/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/bundle.json","state":"https://pith.science/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/E7ME7VKBDGUIKPF3HOBLYZXAM7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:E7ME7VKBDGUIKPF3HOBLYZXAM7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8fa3c81d2416e2fba32edd1adced87ad8715c0d5fb8e5fe1e6bc4dffb8f6aaab","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2022-05-24T15:10:50Z","title_canon_sha256":"308452be1ab6086d9ec988b9833c13118200c563fc2a786b5ae232371445edb3"},"schema_version":"1.0","source":{"id":"2205.12134","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2205.12134","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"arxiv_version","alias_value":"2205.12134v3","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2205.12134","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_12","alias_value":"E7ME7VKBDGUI","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_16","alias_value":"E7ME7VKBDGUIKPF3","created_at":"2026-07-05T05:25:49Z"},{"alias_kind":"pith_short_8","alias_value":"E7ME7VKB","created_at":"2026-07-05T05:25:49Z"}],"graph_snapshots":[{"event_id":"sha256:476122973e26fee914a48d1501c3e8a0a48ef9dfbef078601605f463ecd66ad6","target":"graph","created_at":"2026-07-05T05:25:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2205.12134/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The score-based query attacks (SQAs) pose practical threats to deep neural networks by crafting adversarial perturbations within dozens of queries, only using the model's output scores. Nonetheless, we note that if the loss trend of the outputs is slightly perturbed, SQAs could be easily misled and thereby become much less effective. Following this idea, we propose a novel defense, namely Adversarial Attack on Attackers (AAA), to confound SQAs towards incorrect attack directions by slightly modifying the output logits. In this way, (1) SQAs are prevented regardless of the model's worst-case ro","authors_text":"Cihang Xie, Qinghua Tao, Sizhe Chen, Xiaolin Huang, Yingwen Wu, Zhehao Huang","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2022-05-24T15:10:50Z","title":"Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2205.12134","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f553bfa711319e9f145385713f6335cc75b9c900c67b4b0cd4a869b3b7eb53af","target":"record","created_at":"2026-07-05T05:25:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8fa3c81d2416e2fba32edd1adced87ad8715c0d5fb8e5fe1e6bc4dffb8f6aaab","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2022-05-24T15:10:50Z","title_canon_sha256":"308452be1ab6086d9ec988b9833c13118200c563fc2a786b5ae232371445edb3"},"schema_version":"1.0","source":{"id":"2205.12134","kind":"arxiv","version":3}},"canonical_sha256":"27d84fd54119a8853cbb3b82bc66e067fce2fb9e7cf6ce4eb69eecb63d6dd37f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"27d84fd54119a8853cbb3b82bc66e067fce2fb9e7cf6ce4eb69eecb63d6dd37f","first_computed_at":"2026-07-05T05:25:49.270227Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T05:25:49.270227Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"IQLulNU8TBi/L24iEewig/Q1krchS0Vw2CWsSYil77c8/AgsFKM9eBnSv4b98FFR+ni/37ttkmfc2n5cThCBBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T05:25:49.272854Z","signed_message":"canonical_sha256_bytes"},"source_id":"2205.12134","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f553bfa711319e9f145385713f6335cc75b9c900c67b4b0cd4a869b3b7eb53af","sha256:476122973e26fee914a48d1501c3e8a0a48ef9dfbef078601605f463ecd66ad6"],"state_sha256":"143af2e9ca00733c6875c9079b231944ce75e027cacd6f504cd8749175a9d715"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"iFAia+KQ2ND7KrahUeqIcBG464ApQvxo9BT90PFWpMXRmo76ab8xXrF+hjF435eAU7QHIKexBH9cIVhjEfL7BQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T17:37:04.143018Z","bundle_sha256":"f6fcb788d8aa1ea4c13d2e9b3a931df7b55511a5fa7b34a67b07c6c59e4ee541"}}