{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:GPKOCX5ZUW7OVJVMQY4PPAN7WP","short_pith_number":"pith:GPKOCX5Z","canonical_record":{"source":{"id":"2003.10595","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-03-24T00:53:53Z","cross_cats_sorted":["cs.LG","stat.ML"],"title_canon_sha256":"8ff6f2036952553de5e959726ab492c341a0d8b876063b1221711dff4fa8dc71","abstract_canon_sha256":"351838b3de77a6cc7ef9fb062e11e5c551e5d1b25d1b7dc2539d9ef6930b3d21"},"schema_version":"1.0"},"canonical_sha256":"33d4e15fb9a5beeaa6ac8638f781bfb3f72797fdaadcfd78ee62aa796ef2ccde","source":{"kind":"arxiv","id":"2003.10595","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2003.10595","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"arxiv_version","alias_value":"2003.10595v2","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2003.10595","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_12","alias_value":"GPKOCX5ZUW7O","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_16","alias_value":"GPKOCX5ZUW7OVJVM","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_8","alias_value":"GPKOCX5Z","created_at":"2026-07-05T01:58:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:GPKOCX5ZUW7OVJVMQY4PPAN7WP","target":"record","payload":{"canonical_record":{"source":{"id":"2003.10595","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-03-24T00:53:53Z","cross_cats_sorted":["cs.LG","stat.ML"],"title_canon_sha256":"8ff6f2036952553de5e959726ab492c341a0d8b876063b1221711dff4fa8dc71","abstract_canon_sha256":"351838b3de77a6cc7ef9fb062e11e5c551e5d1b25d1b7dc2539d9ef6930b3d21"},"schema_version":"1.0"},"canonical_sha256":"33d4e15fb9a5beeaa6ac8638f781bfb3f72797fdaadcfd78ee62aa796ef2ccde","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T01:58:08.703493Z","signature_b64":"ig+Thpw08ojRTIi3xq/5PjX1aIrMpVhUThtAILtnXq6ECNGPciRvWJ5wkhbVvUYJ0TM7NZLf3Ll9KV82LK5YAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"33d4e15fb9a5beeaa6ac8638f781bfb3f72797fdaadcfd78ee62aa796ef2ccde","last_reissued_at":"2026-07-05T01:58:08.702832Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T01:58:08.702832Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2003.10595","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:58:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AhiT6PB6NbDcL6OTP3LlfrKkon25qeos2scFAM91EI1cPisl3Y39O6zXZFgOyx9XSqdXconUyed+qqs7Lk8BDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T09:54:46.556512Z"},"content_sha256":"d823bfc2898ba0651583c51c81e539d413e8360d414e1f85c36af97416ddc28d","schema_version":"1.0","event_id":"sha256:d823bfc2898ba0651583c51c81e539d413e8360d414e1f85c36af97416ddc28d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:GPKOCX5ZUW7OVJVMQY4PPAN7WP","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Systematic Evaluation of Privacy Risks of Machine Learning Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG","stat.ML"],"primary_cat":"cs.CR","authors_text":"Liwei Song, Prateek Mittal","submitted_at":"2020-03-24T00:53:53Z","abstract_excerpt":"Machine learning models are prone to memorizing sensitive data, making them vulnerable to membership inference attacks in which an adversary aims to guess if an input sample was used to train the model. In this paper, we show that prior work on membership inference attacks may severely underestimate the privacy risks by relying solely on training custom neural network classifiers to perform attacks and focusing only on the aggregate results over data samples, such as the attack accuracy. To overcome these limitations, we first propose to benchmark membership inference privacy risks by improvin"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2003.10595","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2003.10595/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:58:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3Va33yDj0GE6btCmZ/duW3tmGHRhOKJHe4EekiNf5yYjeZY0Idpgg3USht51J7ybeKJ7P4p336dWgeXQKHj+Bw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T09:54:46.557057Z"},"content_sha256":"de0badf39593808824ea3647485747b7c9d79eadbc38e877804434ed26690d47","schema_version":"1.0","event_id":"sha256:de0badf39593808824ea3647485747b7c9d79eadbc38e877804434ed26690d47"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/bundle.json","state_url":"https://pith.science/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T09:54:46Z","links":{"resolver":"https://pith.science/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP","bundle":"https://pith.science/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/bundle.json","state":"https://pith.science/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GPKOCX5ZUW7OVJVMQY4PPAN7WP/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:GPKOCX5ZUW7OVJVMQY4PPAN7WP","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"351838b3de77a6cc7ef9fb062e11e5c551e5d1b25d1b7dc2539d9ef6930b3d21","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-03-24T00:53:53Z","title_canon_sha256":"8ff6f2036952553de5e959726ab492c341a0d8b876063b1221711dff4fa8dc71"},"schema_version":"1.0","source":{"id":"2003.10595","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2003.10595","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"arxiv_version","alias_value":"2003.10595v2","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2003.10595","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_12","alias_value":"GPKOCX5ZUW7O","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_16","alias_value":"GPKOCX5ZUW7OVJVM","created_at":"2026-07-05T01:58:08Z"},{"alias_kind":"pith_short_8","alias_value":"GPKOCX5Z","created_at":"2026-07-05T01:58:08Z"}],"graph_snapshots":[{"event_id":"sha256:de0badf39593808824ea3647485747b7c9d79eadbc38e877804434ed26690d47","target":"graph","created_at":"2026-07-05T01:58:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2003.10595/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Machine learning models are prone to memorizing sensitive data, making them vulnerable to membership inference attacks in which an adversary aims to guess if an input sample was used to train the model. In this paper, we show that prior work on membership inference attacks may severely underestimate the privacy risks by relying solely on training custom neural network classifiers to perform attacks and focusing only on the aggregate results over data samples, such as the attack accuracy. To overcome these limitations, we first propose to benchmark membership inference privacy risks by improvin","authors_text":"Liwei Song, Prateek Mittal","cross_cats":["cs.LG","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-03-24T00:53:53Z","title":"Systematic Evaluation of Privacy Risks of Machine Learning Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2003.10595","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d823bfc2898ba0651583c51c81e539d413e8360d414e1f85c36af97416ddc28d","target":"record","created_at":"2026-07-05T01:58:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"351838b3de77a6cc7ef9fb062e11e5c551e5d1b25d1b7dc2539d9ef6930b3d21","cross_cats_sorted":["cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-03-24T00:53:53Z","title_canon_sha256":"8ff6f2036952553de5e959726ab492c341a0d8b876063b1221711dff4fa8dc71"},"schema_version":"1.0","source":{"id":"2003.10595","kind":"arxiv","version":2}},"canonical_sha256":"33d4e15fb9a5beeaa6ac8638f781bfb3f72797fdaadcfd78ee62aa796ef2ccde","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"33d4e15fb9a5beeaa6ac8638f781bfb3f72797fdaadcfd78ee62aa796ef2ccde","first_computed_at":"2026-07-05T01:58:08.702832Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:58:08.702832Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ig+Thpw08ojRTIi3xq/5PjX1aIrMpVhUThtAILtnXq6ECNGPciRvWJ5wkhbVvUYJ0TM7NZLf3Ll9KV82LK5YAw==","signature_status":"signed_v1","signed_at":"2026-07-05T01:58:08.703493Z","signed_message":"canonical_sha256_bytes"},"source_id":"2003.10595","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d823bfc2898ba0651583c51c81e539d413e8360d414e1f85c36af97416ddc28d","sha256:de0badf39593808824ea3647485747b7c9d79eadbc38e877804434ed26690d47"],"state_sha256":"714c139e76b5164c2dc2418b2eed6c99a0ec1c71d46dc3ba487e323301985dd1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"VltCz9t81Hg4k0mQ+6ZqwTa++zqRduC13V+4EpAAs3+F6RGRIdYxuYf/XPmfBRLYmmMNbsZRkkcR6xpNvEDaAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T09:54:46.560776Z","bundle_sha256":"59a8029c2b0de473ba2e9400be458498a99606d9c23f2e1d7b2c745f78e2d6f5"}}