{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:ELSNB42WFBVEC4DK2GFJJZMKTQ","short_pith_number":"pith:ELSNB42W","canonical_record":{"source":{"id":"2503.03613","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-03-05T15:51:59Z","cross_cats_sorted":[],"title_canon_sha256":"9dcf4c6fc0a4bf05bfa1c6cbd0e47ccade8c454b1dbe37b1a713ef8385c84267","abstract_canon_sha256":"26d2fbe4ee28717fda1e481f375e97baec284fc6accd4906f707eb3dd4363bd3"},"schema_version":"1.0"},"canonical_sha256":"22e4d0f356286a41706ad18a94e58a9c11491a5bf9d185bc8eeeca8766a941d0","source":{"kind":"arxiv","id":"2503.03613","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.03613","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"arxiv_version","alias_value":"2503.03613v1","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.03613","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_12","alias_value":"ELSNB42WFBVE","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_16","alias_value":"ELSNB42WFBVEC4DK","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_8","alias_value":"ELSNB42W","created_at":"2026-07-05T10:24:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:ELSNB42WFBVEC4DK2GFJJZMKTQ","target":"record","payload":{"canonical_record":{"source":{"id":"2503.03613","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-03-05T15:51:59Z","cross_cats_sorted":[],"title_canon_sha256":"9dcf4c6fc0a4bf05bfa1c6cbd0e47ccade8c454b1dbe37b1a713ef8385c84267","abstract_canon_sha256":"26d2fbe4ee28717fda1e481f375e97baec284fc6accd4906f707eb3dd4363bd3"},"schema_version":"1.0"},"canonical_sha256":"22e4d0f356286a41706ad18a94e58a9c11491a5bf9d185bc8eeeca8766a941d0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:24:57.234830Z","signature_b64":"lY3j577MzqPbsmjIU9BYQs+rqSqx/+eFT9xudN0YM9bMhle1d4ev0MrSOOVrQpE3KlUh1m3Bn2CDf7oEhijkCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"22e4d0f356286a41706ad18a94e58a9c11491a5bf9d185bc8eeeca8766a941d0","last_reissued_at":"2026-07-05T10:24:57.233956Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:24:57.233956Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.03613","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:24:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CU2POnwfpkSlWWIHPjDUMQtn7NWy0kxqUt0OeKchbqOetLQ4jgqz6rGvBt46D3DF6/9/xSDj45ajEYsDnDn3Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:37:01.148381Z"},"content_sha256":"d4c5243acdd3ad3f5f46f3e0b844fcf25db3014c4de73a845d9344bda0b30ddd","schema_version":"1.0","event_id":"sha256:d4c5243acdd3ad3f5f46f3e0b844fcf25db3014c4de73a845d9344bda0b30ddd"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:ELSNB42WFBVEC4DK2GFJJZMKTQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CV","authors_text":"Nicu Sebe, Songlong Xing, Zhengyu Zhao","submitted_at":"2025-03-05T15:51:59Z","abstract_excerpt":"Despite its prevalent use in image-text matching tasks in a zero-shot manner, CLIP has been shown to be highly vulnerable to adversarial perturbations added onto images. Recent studies propose to finetune the vision encoder of CLIP with adversarial samples generated on the fly, and show improved robustness against adversarial attacks on a spectrum of downstream datasets, a property termed as zero-shot robustness. In this paper, we show that malicious perturbations that seek to maximise the classification loss lead to `falsely stable' images, and propose to leverage the pre-trained vision encod"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.03613","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.03613/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:24:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Wgl84GukVfypjxSou9ZJzfu1SBI8pWM4ScjwvH/r0nIAZpQAdrWxvB6nrTewZljvD6+cHjXG8nkIncbYodbFBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:37:01.149683Z"},"content_sha256":"f672b7e1964f7fd4515c9b146bb493e211ce16bfd920724caa46ae5d723e5dee","schema_version":"1.0","event_id":"sha256:f672b7e1964f7fd4515c9b146bb493e211ce16bfd920724caa46ae5d723e5dee"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/bundle.json","state_url":"https://pith.science/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T10:37:01Z","links":{"resolver":"https://pith.science/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ","bundle":"https://pith.science/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/bundle.json","state":"https://pith.science/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ELSNB42WFBVEC4DK2GFJJZMKTQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:ELSNB42WFBVEC4DK2GFJJZMKTQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"26d2fbe4ee28717fda1e481f375e97baec284fc6accd4906f707eb3dd4363bd3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-03-05T15:51:59Z","title_canon_sha256":"9dcf4c6fc0a4bf05bfa1c6cbd0e47ccade8c454b1dbe37b1a713ef8385c84267"},"schema_version":"1.0","source":{"id":"2503.03613","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.03613","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"arxiv_version","alias_value":"2503.03613v1","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.03613","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_12","alias_value":"ELSNB42WFBVE","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_16","alias_value":"ELSNB42WFBVEC4DK","created_at":"2026-07-05T10:24:57Z"},{"alias_kind":"pith_short_8","alias_value":"ELSNB42W","created_at":"2026-07-05T10:24:57Z"}],"graph_snapshots":[{"event_id":"sha256:f672b7e1964f7fd4515c9b146bb493e211ce16bfd920724caa46ae5d723e5dee","target":"graph","created_at":"2026-07-05T10:24:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.03613/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Despite its prevalent use in image-text matching tasks in a zero-shot manner, CLIP has been shown to be highly vulnerable to adversarial perturbations added onto images. Recent studies propose to finetune the vision encoder of CLIP with adversarial samples generated on the fly, and show improved robustness against adversarial attacks on a spectrum of downstream datasets, a property termed as zero-shot robustness. In this paper, we show that malicious perturbations that seek to maximise the classification loss lead to `falsely stable' images, and propose to leverage the pre-trained vision encod","authors_text":"Nicu Sebe, Songlong Xing, Zhengyu Zhao","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-03-05T15:51:59Z","title":"CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIP"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.03613","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d4c5243acdd3ad3f5f46f3e0b844fcf25db3014c4de73a845d9344bda0b30ddd","target":"record","created_at":"2026-07-05T10:24:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"26d2fbe4ee28717fda1e481f375e97baec284fc6accd4906f707eb3dd4363bd3","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-03-05T15:51:59Z","title_canon_sha256":"9dcf4c6fc0a4bf05bfa1c6cbd0e47ccade8c454b1dbe37b1a713ef8385c84267"},"schema_version":"1.0","source":{"id":"2503.03613","kind":"arxiv","version":1}},"canonical_sha256":"22e4d0f356286a41706ad18a94e58a9c11491a5bf9d185bc8eeeca8766a941d0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"22e4d0f356286a41706ad18a94e58a9c11491a5bf9d185bc8eeeca8766a941d0","first_computed_at":"2026-07-05T10:24:57.233956Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:24:57.233956Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"lY3j577MzqPbsmjIU9BYQs+rqSqx/+eFT9xudN0YM9bMhle1d4ev0MrSOOVrQpE3KlUh1m3Bn2CDf7oEhijkCw==","signature_status":"signed_v1","signed_at":"2026-07-05T10:24:57.234830Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.03613","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d4c5243acdd3ad3f5f46f3e0b844fcf25db3014c4de73a845d9344bda0b30ddd","sha256:f672b7e1964f7fd4515c9b146bb493e211ce16bfd920724caa46ae5d723e5dee"],"state_sha256":"3fc5f32703464df8105b36b07f023e571cf0760919b85fd58d1d085e2a2f42b2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"81qQoTS8EYJ/ducSE60ur2KQUHdW42jQ7bHga4CGYwVxt03KFJIObs9imAQ0JFAHSB+wLhWoMNy8IjTE3AQqDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T10:37:01.164309Z","bundle_sha256":"68e8dcb143d0bcfbe55da70f5a711e0ef79f68884d7ba7f203b57cdd52f3e02d"}}