{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:F4WT5YRFDGPY7WYCG5VXVM6GZU","short_pith_number":"pith:F4WT5YRF","canonical_record":{"source":{"id":"1910.12366","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2019-10-27T22:09:13Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"9a6959c474f65f5c43442f83ea0d8cf56333e063168ba987186e943598e2a14e","abstract_canon_sha256":"d55f07393a50b1700809748c82a68a87319c46a27aa37a398902ee0ace5ff6a4"},"schema_version":"1.0"},"canonical_sha256":"2f2d3ee225199f8fdb02376b7ab3c6cd1aca9f2fe52488092d9b4f58a9b2a4ee","source":{"kind":"arxiv","id":"1910.12366","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1910.12366","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"arxiv_version","alias_value":"1910.12366v3","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1910.12366","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_12","alias_value":"F4WT5YRFDGPY","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_16","alias_value":"F4WT5YRFDGPY7WYC","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_8","alias_value":"F4WT5YRF","created_at":"2026-07-05T01:41:49Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:F4WT5YRFDGPY7WYCG5VXVM6GZU","target":"record","payload":{"canonical_record":{"source":{"id":"1910.12366","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2019-10-27T22:09:13Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"9a6959c474f65f5c43442f83ea0d8cf56333e063168ba987186e943598e2a14e","abstract_canon_sha256":"d55f07393a50b1700809748c82a68a87319c46a27aa37a398902ee0ace5ff6a4"},"schema_version":"1.0"},"canonical_sha256":"2f2d3ee225199f8fdb02376b7ab3c6cd1aca9f2fe52488092d9b4f58a9b2a4ee","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T01:41:49.402618Z","signature_b64":"QNMA/XdeuXtxpJl6bCDvRtsyo8OQsRNo3v1yHSX4GP24dOwq6sSYHeERyODgwudjwiF3CTifAdqPYbHDexyTDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2f2d3ee225199f8fdb02376b7ab3c6cd1aca9f2fe52488092d9b4f58a9b2a4ee","last_reissued_at":"2026-07-05T01:41:49.402147Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T01:41:49.402147Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1910.12366","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:41:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"zeuy7Q7fZOr9HAhCpak5hS/5WUhsPHw/yxwHU3uWyBXjSABpHvD8ZBfO/S0p+jkRCyFPSAITP5od1mCp4I0iDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T09:34:41.264370Z"},"content_sha256":"adff3e886b13da660053864e844150a39008b33a109b4f93d0f678c7a0807417","schema_version":"1.0","event_id":"sha256:adff3e886b13da660053864e844150a39008b33a109b4f93d0f678c7a0807417"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:F4WT5YRFDGPY7WYCG5VXVM6GZU","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Thieves on Sesame Street! Model Extraction of BERT-based APIs","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"cs.CL","authors_text":"Ankur P. Parikh, Gaurav Singh Tomar, Kalpesh Krishna, Mohit Iyyer, Nicolas Papernot","submitted_at":"2019-10-27T22:09:13Z","abstract_excerpt":"We study the problem of model extraction in natural language processing, in which an adversary with only query access to a victim model attempts to reconstruct a local copy of that model. Assuming that both the adversary and victim model fine-tune a large pretrained language model such as BERT (Devlin et al. 2019), we show that the adversary does not need any real training data to successfully mount the attack. In fact, the attacker need not even use grammatical or semantically meaningful queries: we show that random sequences of words coupled with task-specific heuristics form effective queri"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1910.12366","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1910.12366/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:41:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fc+vJttPK/V+NlWx9presKsVHGN0xXPCyRIz13waMXzlX7gYK9DL15sttiVFwSCS+m80NrNjlEKiD/Z64kX7Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T09:34:41.265286Z"},"content_sha256":"0824268e19dbec1632a1f19952b46521350a8ff4e4ee2c795113bea3eadbdf5a","schema_version":"1.0","event_id":"sha256:0824268e19dbec1632a1f19952b46521350a8ff4e4ee2c795113bea3eadbdf5a"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/bundle.json","state_url":"https://pith.science/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T09:34:41Z","links":{"resolver":"https://pith.science/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU","bundle":"https://pith.science/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/bundle.json","state":"https://pith.science/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/state.json","well_known_bundle":"https://pith.science/.well-known/pith/F4WT5YRFDGPY7WYCG5VXVM6GZU/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:F4WT5YRFDGPY7WYCG5VXVM6GZU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d55f07393a50b1700809748c82a68a87319c46a27aa37a398902ee0ace5ff6a4","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2019-10-27T22:09:13Z","title_canon_sha256":"9a6959c474f65f5c43442f83ea0d8cf56333e063168ba987186e943598e2a14e"},"schema_version":"1.0","source":{"id":"1910.12366","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1910.12366","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"arxiv_version","alias_value":"1910.12366v3","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1910.12366","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_12","alias_value":"F4WT5YRFDGPY","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_16","alias_value":"F4WT5YRFDGPY7WYC","created_at":"2026-07-05T01:41:49Z"},{"alias_kind":"pith_short_8","alias_value":"F4WT5YRF","created_at":"2026-07-05T01:41:49Z"}],"graph_snapshots":[{"event_id":"sha256:0824268e19dbec1632a1f19952b46521350a8ff4e4ee2c795113bea3eadbdf5a","target":"graph","created_at":"2026-07-05T01:41:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1910.12366/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We study the problem of model extraction in natural language processing, in which an adversary with only query access to a victim model attempts to reconstruct a local copy of that model. Assuming that both the adversary and victim model fine-tune a large pretrained language model such as BERT (Devlin et al. 2019), we show that the adversary does not need any real training data to successfully mount the attack. In fact, the attacker need not even use grammatical or semantically meaningful queries: we show that random sequences of words coupled with task-specific heuristics form effective queri","authors_text":"Ankur P. Parikh, Gaurav Singh Tomar, Kalpesh Krishna, Mohit Iyyer, Nicolas Papernot","cross_cats":["cs.CR","cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2019-10-27T22:09:13Z","title":"Thieves on Sesame Street! Model Extraction of BERT-based APIs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1910.12366","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:adff3e886b13da660053864e844150a39008b33a109b4f93d0f678c7a0807417","target":"record","created_at":"2026-07-05T01:41:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d55f07393a50b1700809748c82a68a87319c46a27aa37a398902ee0ace5ff6a4","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CL","submitted_at":"2019-10-27T22:09:13Z","title_canon_sha256":"9a6959c474f65f5c43442f83ea0d8cf56333e063168ba987186e943598e2a14e"},"schema_version":"1.0","source":{"id":"1910.12366","kind":"arxiv","version":3}},"canonical_sha256":"2f2d3ee225199f8fdb02376b7ab3c6cd1aca9f2fe52488092d9b4f58a9b2a4ee","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2f2d3ee225199f8fdb02376b7ab3c6cd1aca9f2fe52488092d9b4f58a9b2a4ee","first_computed_at":"2026-07-05T01:41:49.402147Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:41:49.402147Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"QNMA/XdeuXtxpJl6bCDvRtsyo8OQsRNo3v1yHSX4GP24dOwq6sSYHeERyODgwudjwiF3CTifAdqPYbHDexyTDg==","signature_status":"signed_v1","signed_at":"2026-07-05T01:41:49.402618Z","signed_message":"canonical_sha256_bytes"},"source_id":"1910.12366","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:adff3e886b13da660053864e844150a39008b33a109b4f93d0f678c7a0807417","sha256:0824268e19dbec1632a1f19952b46521350a8ff4e4ee2c795113bea3eadbdf5a"],"state_sha256":"c991648521cb09360352453c711d2a4ac35431009ea6db1ca8acfe6cbb3f0a2d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ohSsAFqz+f/jwbOJKmDq6rRfbxii4z6XaP6raC/1V+s5nE1QTgFRg3WDctuE8xiOphCKgyraG0XHlycrBuMUDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T09:34:41.283756Z","bundle_sha256":"1c22b271a60503d213da85d9554ae6daa5039cc3e6711f6646f5bcb73ab1cdad"}}