{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:H7SJD3TEZQOTMYHI6AHVNQXTP7","short_pith_number":"pith:H7SJD3TE","canonical_record":{"source":{"id":"2208.14127","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-08-30T10:23:23Z","cross_cats_sorted":[],"title_canon_sha256":"0cc4a795cd65674bf28478cdaa47f6d33c50df5b994611a35a9e72606bdce833","abstract_canon_sha256":"43469c34cb7f0947cd2c686c695bbd64f16f35fa258b28988977a6f5a0c6175b"},"schema_version":"1.0"},"canonical_sha256":"3fe491ee64cc1d3660e8f00f56c2f37fc6bcd9bb7ed41b59dd763a3e609d6554","source":{"kind":"arxiv","id":"2208.14127","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.14127","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"arxiv_version","alias_value":"2208.14127v1","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.14127","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_12","alias_value":"H7SJD3TEZQOT","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_16","alias_value":"H7SJD3TEZQOTMYHI","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_8","alias_value":"H7SJD3TE","created_at":"2026-07-05T04:53:08Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:H7SJD3TEZQOTMYHI6AHVNQXTP7","target":"record","payload":{"canonical_record":{"source":{"id":"2208.14127","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-08-30T10:23:23Z","cross_cats_sorted":[],"title_canon_sha256":"0cc4a795cd65674bf28478cdaa47f6d33c50df5b994611a35a9e72606bdce833","abstract_canon_sha256":"43469c34cb7f0947cd2c686c695bbd64f16f35fa258b28988977a6f5a0c6175b"},"schema_version":"1.0"},"canonical_sha256":"3fe491ee64cc1d3660e8f00f56c2f37fc6bcd9bb7ed41b59dd763a3e609d6554","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:53:08.994737Z","signature_b64":"LR69qEN2EpqmLTlyuMLYPOfaALmDEkDzHAMt4eLdDlvKObAqaNNXehv4Xr24U+dfJnakJ0m4mMZrOHZZdgVoBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3fe491ee64cc1d3660e8f00f56c2f37fc6bcd9bb7ed41b59dd763a3e609d6554","last_reissued_at":"2026-07-05T04:53:08.994392Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:53:08.994392Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2208.14127","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:53:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6Fbf8bgzfZnJ02XHU5W7Yjv9Ix08CPTfmUFO4q6hWcqYC95EFDESWM2AVwURsaBOJCqIBFb/WEIAY4xqvRp7Dg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T08:19:42.499939Z"},"content_sha256":"f7567f2449762c51f85806bc2ea430f22ebcff6be68948c0638929f66f7fd5b5","schema_version":"1.0","event_id":"sha256:f7567f2449762c51f85806bc2ea430f22ebcff6be68948c0638929f66f7fd5b5"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:H7SJD3TEZQOTMYHI6AHVNQXTP7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Solving the Capsulation Attack against Backdoor-based Deep Neural Network Watermarks by Reversing Triggers","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Fangqi Li, Shilin Wang, Yun Zhu","submitted_at":"2022-08-30T10:23:23Z","abstract_excerpt":"Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulatio"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.14127","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2208.14127/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:53:08Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/P/1+hExEiElchT//+7tmEPKRt/JFahx3RVXOgxZAlV7QVmwEU83M+cYSCgwiKVBsMcmEqOWuK51j8V1bQ9cCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-14T08:19:42.500735Z"},"content_sha256":"cabed1d503a81b697536a2f349d063b361d6d96fa85d59f11c311a6943036af7","schema_version":"1.0","event_id":"sha256:cabed1d503a81b697536a2f349d063b361d6d96fa85d59f11c311a6943036af7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/bundle.json","state_url":"https://pith.science/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-14T08:19:42Z","links":{"resolver":"https://pith.science/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7","bundle":"https://pith.science/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/bundle.json","state":"https://pith.science/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/H7SJD3TEZQOTMYHI6AHVNQXTP7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:H7SJD3TEZQOTMYHI6AHVNQXTP7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"43469c34cb7f0947cd2c686c695bbd64f16f35fa258b28988977a6f5a0c6175b","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-08-30T10:23:23Z","title_canon_sha256":"0cc4a795cd65674bf28478cdaa47f6d33c50df5b994611a35a9e72606bdce833"},"schema_version":"1.0","source":{"id":"2208.14127","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2208.14127","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"arxiv_version","alias_value":"2208.14127v1","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2208.14127","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_12","alias_value":"H7SJD3TEZQOT","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_16","alias_value":"H7SJD3TEZQOTMYHI","created_at":"2026-07-05T04:53:08Z"},{"alias_kind":"pith_short_8","alias_value":"H7SJD3TE","created_at":"2026-07-05T04:53:08Z"}],"graph_snapshots":[{"event_id":"sha256:cabed1d503a81b697536a2f349d063b361d6d96fa85d59f11c311a6943036af7","target":"graph","created_at":"2026-07-05T04:53:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2208.14127/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulatio","authors_text":"Fangqi Li, Shilin Wang, Yun Zhu","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-08-30T10:23:23Z","title":"Solving the Capsulation Attack against Backdoor-based Deep Neural Network Watermarks by Reversing Triggers"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2208.14127","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f7567f2449762c51f85806bc2ea430f22ebcff6be68948c0638929f66f7fd5b5","target":"record","created_at":"2026-07-05T04:53:08Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"43469c34cb7f0947cd2c686c695bbd64f16f35fa258b28988977a6f5a0c6175b","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-08-30T10:23:23Z","title_canon_sha256":"0cc4a795cd65674bf28478cdaa47f6d33c50df5b994611a35a9e72606bdce833"},"schema_version":"1.0","source":{"id":"2208.14127","kind":"arxiv","version":1}},"canonical_sha256":"3fe491ee64cc1d3660e8f00f56c2f37fc6bcd9bb7ed41b59dd763a3e609d6554","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3fe491ee64cc1d3660e8f00f56c2f37fc6bcd9bb7ed41b59dd763a3e609d6554","first_computed_at":"2026-07-05T04:53:08.994392Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:53:08.994392Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"LR69qEN2EpqmLTlyuMLYPOfaALmDEkDzHAMt4eLdDlvKObAqaNNXehv4Xr24U+dfJnakJ0m4mMZrOHZZdgVoBw==","signature_status":"signed_v1","signed_at":"2026-07-05T04:53:08.994737Z","signed_message":"canonical_sha256_bytes"},"source_id":"2208.14127","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f7567f2449762c51f85806bc2ea430f22ebcff6be68948c0638929f66f7fd5b5","sha256:cabed1d503a81b697536a2f349d063b361d6d96fa85d59f11c311a6943036af7"],"state_sha256":"93a2628ea49a3627cc029368514104787ee0ddf4d17bd34fb0fc3ed080bdda78"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Q+nExxZSrYLjF6eD7c/eLYCeP7xsYgD0vKNxxoAGDx9oPAiA0XPzK+DGMpOewhqz8fY2dQ4A/Xg5cjafwZlBDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-14T08:19:42.507187Z","bundle_sha256":"510aa0a7b5e973ce9ea23e3d4dc24c1c67a52ab8b07ce58b74e2148aedd160a5"}}