{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:FJV63SE7JOWBCF2UQBAWWZ2OC7","short_pith_number":"pith:FJV63SE7","canonical_record":{"source":{"id":"2107.07240","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2021-07-15T10:47:13Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ee8fb3d87ac7fec73dad46c2a50e909a4519ede30a3e2fa62df59b51ae7bfd51","abstract_canon_sha256":"8bb2dc2144320b5c02f6675ee485e8a82842bd8c29a035770f6699dea52bf758"},"schema_version":"1.0"},"canonical_sha256":"2a6bedc89f4bac11175480416b674e17c951960afa860e2b440aa8b626b800e5","source":{"kind":"arxiv","id":"2107.07240","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2107.07240","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"arxiv_version","alias_value":"2107.07240v1","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2107.07240","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_12","alias_value":"FJV63SE7JOWB","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_16","alias_value":"FJV63SE7JOWBCF2U","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_8","alias_value":"FJV63SE7","created_at":"2026-07-05T02:58:12Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:FJV63SE7JOWBCF2UQBAWWZ2OC7","target":"record","payload":{"canonical_record":{"source":{"id":"2107.07240","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2021-07-15T10:47:13Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ee8fb3d87ac7fec73dad46c2a50e909a4519ede30a3e2fa62df59b51ae7bfd51","abstract_canon_sha256":"8bb2dc2144320b5c02f6675ee485e8a82842bd8c29a035770f6699dea52bf758"},"schema_version":"1.0"},"canonical_sha256":"2a6bedc89f4bac11175480416b674e17c951960afa860e2b440aa8b626b800e5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:58:12.254330Z","signature_b64":"rnL5s0Tn39jYaHUsz1Ryn9KZO+xAuFI9A6jVHI5C7xhHKLvGtvGkgC6BMJlHkuXPVJBBfQgbPgbPHAzWQ35VAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"2a6bedc89f4bac11175480416b674e17c951960afa860e2b440aa8b626b800e5","last_reissued_at":"2026-07-05T02:58:12.253961Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:58:12.253961Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2107.07240","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:58:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Z6ogOE12IH2kRw2SDp3tK3sv0puoEz0N0+xqyqjRZHUoMVKSezvHDSD3KKMQrEGd9i31rhankXUepbAKHyU6BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T17:26:16.818279Z"},"content_sha256":"9d5b1a59515169a4738f44ad7f54e5409a6cf4f043c819fbbd4babf508860d9c","schema_version":"1.0","event_id":"sha256:9d5b1a59515169a4738f44ad7f54e5409a6cf4f043c819fbbd4babf508860d9c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:FJV63SE7JOWBCF2UQBAWWZ2OC7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.LG","authors_text":"Chulin Xie, Jifeng Zhu, Xiangyu Qi, Yong Yang","submitted_at":"2021-07-15T10:47:13Z","abstract_excerpt":"We study the realistic potential of conducting backdoor attack against deep neural networks (DNNs) during deployment stage. Specifically, our goal is to design a deployment-stage backdoor attack algorithm that is both threatening and realistically implementable. To this end, we propose Subnet Replacement Attack (SRA), which is capable of embedding backdoor into DNNs by directly modifying a limited number of model parameters. Considering the realistic practicability, we abandon the strong white-box assumption widely adopted in existing studies, instead, our algorithm works in a gray-box setting"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2107.07240","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2107.07240/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:58:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YNIU86pjlfgZXjLRV0wSDpK1AwYlrBA9Z9wiwUBw4fVEoaW7+mdQ9k0Ht0c4MegK0U29U01wqBUVL1vHkWEWDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-15T17:26:16.818786Z"},"content_sha256":"6ffcf7382b2387ac6ffd17613f5c42df557dac76861f5284afd16fa0c2805542","schema_version":"1.0","event_id":"sha256:6ffcf7382b2387ac6ffd17613f5c42df557dac76861f5284afd16fa0c2805542"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/bundle.json","state_url":"https://pith.science/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-15T17:26:16Z","links":{"resolver":"https://pith.science/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7","bundle":"https://pith.science/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/bundle.json","state":"https://pith.science/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/FJV63SE7JOWBCF2UQBAWWZ2OC7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:FJV63SE7JOWBCF2UQBAWWZ2OC7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8bb2dc2144320b5c02f6675ee485e8a82842bd8c29a035770f6699dea52bf758","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2021-07-15T10:47:13Z","title_canon_sha256":"ee8fb3d87ac7fec73dad46c2a50e909a4519ede30a3e2fa62df59b51ae7bfd51"},"schema_version":"1.0","source":{"id":"2107.07240","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2107.07240","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"arxiv_version","alias_value":"2107.07240v1","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2107.07240","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_12","alias_value":"FJV63SE7JOWB","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_16","alias_value":"FJV63SE7JOWBCF2U","created_at":"2026-07-05T02:58:12Z"},{"alias_kind":"pith_short_8","alias_value":"FJV63SE7","created_at":"2026-07-05T02:58:12Z"}],"graph_snapshots":[{"event_id":"sha256:6ffcf7382b2387ac6ffd17613f5c42df557dac76861f5284afd16fa0c2805542","target":"graph","created_at":"2026-07-05T02:58:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2107.07240/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We study the realistic potential of conducting backdoor attack against deep neural networks (DNNs) during deployment stage. Specifically, our goal is to design a deployment-stage backdoor attack algorithm that is both threatening and realistically implementable. To this end, we propose Subnet Replacement Attack (SRA), which is capable of embedding backdoor into DNNs by directly modifying a limited number of model parameters. Considering the realistic practicability, we abandon the strong white-box assumption widely adopted in existing studies, instead, our algorithm works in a gray-box setting","authors_text":"Chulin Xie, Jifeng Zhu, Xiangyu Qi, Yong Yang","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2021-07-15T10:47:13Z","title":"Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2107.07240","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9d5b1a59515169a4738f44ad7f54e5409a6cf4f043c819fbbd4babf508860d9c","target":"record","created_at":"2026-07-05T02:58:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8bb2dc2144320b5c02f6675ee485e8a82842bd8c29a035770f6699dea52bf758","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2021-07-15T10:47:13Z","title_canon_sha256":"ee8fb3d87ac7fec73dad46c2a50e909a4519ede30a3e2fa62df59b51ae7bfd51"},"schema_version":"1.0","source":{"id":"2107.07240","kind":"arxiv","version":1}},"canonical_sha256":"2a6bedc89f4bac11175480416b674e17c951960afa860e2b440aa8b626b800e5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"2a6bedc89f4bac11175480416b674e17c951960afa860e2b440aa8b626b800e5","first_computed_at":"2026-07-05T02:58:12.253961Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:58:12.253961Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"rnL5s0Tn39jYaHUsz1Ryn9KZO+xAuFI9A6jVHI5C7xhHKLvGtvGkgC6BMJlHkuXPVJBBfQgbPgbPHAzWQ35VAA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:58:12.254330Z","signed_message":"canonical_sha256_bytes"},"source_id":"2107.07240","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9d5b1a59515169a4738f44ad7f54e5409a6cf4f043c819fbbd4babf508860d9c","sha256:6ffcf7382b2387ac6ffd17613f5c42df557dac76861f5284afd16fa0c2805542"],"state_sha256":"78ca574e0698d8f4162f368a26e57d49587dcfe45ec9b59ce4c1352e9b104575"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"JuPw+/4LS9LF961mg8qBkuZpwjaU3RDeM1xkza6tVQYmNnVIzwAfMMbCgHujzQ0J3XVd2wfxeFlpq6Rm/i99Dw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-15T17:26:16.823468Z","bundle_sha256":"7c7a499428d8e529e0785dd442b18e869b71403b63308ceea456a93b25d99ce8"}}