{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:ESQ3ILQFUH5IYZM7QMLZZNS4ZW","short_pith_number":"pith:ESQ3ILQF","canonical_record":{"source":{"id":"1906.06046","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-14T06:46:32Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7ad07d773b43b917270b0a96b103d183d3849aad13844343dffd15d16f3aa35b","abstract_canon_sha256":"f89faacd582e5110b7a51038be21b1c516b95303aac9d98a24f55b20ee1265c6"},"schema_version":"1.0"},"canonical_sha256":"24a1b42e05a1fa8c659f83179cb65ccd8b799cd7884f6f9391912bad51766a7a","source":{"kind":"arxiv","id":"1906.06046","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1906.06046","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"arxiv_version","alias_value":"1906.06046v1","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1906.06046","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"pith_short_12","alias_value":"ESQ3ILQFUH5I","created_at":"2026-05-18T12:33:15Z"},{"alias_kind":"pith_short_16","alias_value":"ESQ3ILQFUH5IYZM7","created_at":"2026-05-18T12:33:15Z"},{"alias_kind":"pith_short_8","alias_value":"ESQ3ILQF","created_at":"2026-05-18T12:33:15Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:ESQ3ILQFUH5IYZM7QMLZZNS4ZW","target":"record","payload":{"canonical_record":{"source":{"id":"1906.06046","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-14T06:46:32Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"7ad07d773b43b917270b0a96b103d183d3849aad13844343dffd15d16f3aa35b","abstract_canon_sha256":"f89faacd582e5110b7a51038be21b1c516b95303aac9d98a24f55b20ee1265c6"},"schema_version":"1.0"},"canonical_sha256":"24a1b42e05a1fa8c659f83179cb65ccd8b799cd7884f6f9391912bad51766a7a","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:43:19.925582Z","signature_b64":"ZzyIS3KaZImqG7RwqE8Wp9Qc0ecMgOTyyE1a6eWzWshxNo9LQDJuglj2TPvr2A0PgsBww8rZGDid9CoSYhmjDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"24a1b42e05a1fa8c659f83179cb65ccd8b799cd7884f6f9391912bad51766a7a","last_reissued_at":"2026-05-17T23:43:19.924877Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:43:19.924877Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1906.06046","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:43:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"QsyE/l/iX+rxu2l+WMRmnK8u4nuaGZgNad642VTA/wc/XQG0K/mxEtwmFaJw/6GNDGcfMn+x/0pe8wGFvw5bDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-09T09:43:30.976066Z"},"content_sha256":"8892a5084be379c819d7f4efb07ad43948b700db7ce7f1d3b57a3ec5a1c01f1d","schema_version":"1.0","event_id":"sha256:8892a5084be379c819d7f4efb07ad43948b700db7ce7f1d3b57a3ec5a1c01f1d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:ESQ3ILQFUH5IYZM7QMLZZNS4ZW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Ee-Chien Chang, Hung Dang, Ziqi Yang","submitted_at":"2019-06-14T06:46:32Z","abstract_excerpt":"The rise of machine learning as a service and model sharing platforms has raised the need of traitor-tracing the models and proof of authorship. Watermarking technique is the main component of existing methods for protecting copyright of models. In this paper, we show that distillation, a widely used transformation technique, is a quite effective attack to remove watermark embedded by existing algorithms. The fragility is due to the fact that distillation does not retain the watermark embedded in the model that is redundant and independent to the main learning task. We design ingrain in respon"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1906.06046","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:43:19Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"12xi9gGcJAKwEewUCn+9ypeGmgY1Z1+zO6c0CzISbrLMRitFhkSZ5GcOZJ4P5OQBA4069Ymxu+qJRg8G8YVSCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-09T09:43:30.976425Z"},"content_sha256":"3fdd7adb601e877a8cfbb79420b22bc58ad6212172bf210e5397a8b11debded2","schema_version":"1.0","event_id":"sha256:3fdd7adb601e877a8cfbb79420b22bc58ad6212172bf210e5397a8b11debded2"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/bundle.json","state_url":"https://pith.science/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-09T09:43:30Z","links":{"resolver":"https://pith.science/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW","bundle":"https://pith.science/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/bundle.json","state":"https://pith.science/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ESQ3ILQFUH5IYZM7QMLZZNS4ZW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:ESQ3ILQFUH5IYZM7QMLZZNS4ZW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f89faacd582e5110b7a51038be21b1c516b95303aac9d98a24f55b20ee1265c6","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-14T06:46:32Z","title_canon_sha256":"7ad07d773b43b917270b0a96b103d183d3849aad13844343dffd15d16f3aa35b"},"schema_version":"1.0","source":{"id":"1906.06046","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1906.06046","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"arxiv_version","alias_value":"1906.06046v1","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1906.06046","created_at":"2026-05-17T23:43:19Z"},{"alias_kind":"pith_short_12","alias_value":"ESQ3ILQFUH5I","created_at":"2026-05-18T12:33:15Z"},{"alias_kind":"pith_short_16","alias_value":"ESQ3ILQFUH5IYZM7","created_at":"2026-05-18T12:33:15Z"},{"alias_kind":"pith_short_8","alias_value":"ESQ3ILQF","created_at":"2026-05-18T12:33:15Z"}],"graph_snapshots":[{"event_id":"sha256:3fdd7adb601e877a8cfbb79420b22bc58ad6212172bf210e5397a8b11debded2","target":"graph","created_at":"2026-05-17T23:43:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"The rise of machine learning as a service and model sharing platforms has raised the need of traitor-tracing the models and proof of authorship. Watermarking technique is the main component of existing methods for protecting copyright of models. In this paper, we show that distillation, a widely used transformation technique, is a quite effective attack to remove watermark embedded by existing algorithms. The fragility is due to the fact that distillation does not retain the watermark embedded in the model that is redundant and independent to the main learning task. We design ingrain in respon","authors_text":"Ee-Chien Chang, Hung Dang, Ziqi Yang","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-14T06:46:32Z","title":"Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1906.06046","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8892a5084be379c819d7f4efb07ad43948b700db7ce7f1d3b57a3ec5a1c01f1d","target":"record","created_at":"2026-05-17T23:43:19Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f89faacd582e5110b7a51038be21b1c516b95303aac9d98a24f55b20ee1265c6","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-06-14T06:46:32Z","title_canon_sha256":"7ad07d773b43b917270b0a96b103d183d3849aad13844343dffd15d16f3aa35b"},"schema_version":"1.0","source":{"id":"1906.06046","kind":"arxiv","version":1}},"canonical_sha256":"24a1b42e05a1fa8c659f83179cb65ccd8b799cd7884f6f9391912bad51766a7a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"24a1b42e05a1fa8c659f83179cb65ccd8b799cd7884f6f9391912bad51766a7a","first_computed_at":"2026-05-17T23:43:19.924877Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:43:19.924877Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ZzyIS3KaZImqG7RwqE8Wp9Qc0ecMgOTyyE1a6eWzWshxNo9LQDJuglj2TPvr2A0PgsBww8rZGDid9CoSYhmjDw==","signature_status":"signed_v1","signed_at":"2026-05-17T23:43:19.925582Z","signed_message":"canonical_sha256_bytes"},"source_id":"1906.06046","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8892a5084be379c819d7f4efb07ad43948b700db7ce7f1d3b57a3ec5a1c01f1d","sha256:3fdd7adb601e877a8cfbb79420b22bc58ad6212172bf210e5397a8b11debded2"],"state_sha256":"85bc7ebc41908708cfd3bd16361c81cc329d00543c2ec15b7d4e48d5ea6a415d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RDAEPNg5i9Eta/tmlcQ+buhYiPPW+5lFZSSL1+QjyBni7Yw9MF/zePm//0hClPgvpIfTciTjjF3ypFenIP9ICw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-09T09:43:30.978263Z","bundle_sha256":"d2b0439dc265afec421d9ed0f7a91673b94aaf5652702cc3209f46a84d95d749"}}