{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:HIDMQF7BMREILUERSZUEQTVEHG","short_pith_number":"pith:HIDMQF7B","canonical_record":{"source":{"id":"2506.11939","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-13T16:42:21Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2a9301ec8b176ed27294104095ae46b6a4918286bf012a90c000a1851d848b25","abstract_canon_sha256":"0691d7684b7a0cb17a9fdb856496f9efb9892ba182e2f5f61cd2de8b06dedf0c"},"schema_version":"1.0"},"canonical_sha256":"3a06c817e1644885d0919668484ea4398f6c23ffc6491bb8c686998d64af6df4","source":{"kind":"arxiv","id":"2506.11939","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.11939","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"arxiv_version","alias_value":"2506.11939v1","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.11939","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_12","alias_value":"HIDMQF7BMREI","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_16","alias_value":"HIDMQF7BMREILUER","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_8","alias_value":"HIDMQF7B","created_at":"2026-07-05T11:21:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:HIDMQF7BMREILUERSZUEQTVEHG","target":"record","payload":{"canonical_record":{"source":{"id":"2506.11939","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-13T16:42:21Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"2a9301ec8b176ed27294104095ae46b6a4918286bf012a90c000a1851d848b25","abstract_canon_sha256":"0691d7684b7a0cb17a9fdb856496f9efb9892ba182e2f5f61cd2de8b06dedf0c"},"schema_version":"1.0"},"canonical_sha256":"3a06c817e1644885d0919668484ea4398f6c23ffc6491bb8c686998d64af6df4","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:21:13.142215Z","signature_b64":"xm+GiZt0qFj7LcjAASKm3Kr07+gtA77FbkVeR83vl4+FE5fl3B/ZYiVZ1D4juehyCULw+qWWWDIELBLdfapgCA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3a06c817e1644885d0919668484ea4398f6c23ffc6491bb8c686998d64af6df4","last_reissued_at":"2026-07-05T11:21:13.141788Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:21:13.141788Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.11939","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:21:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8jhyhbYw2mbX1gEbBsBfNYTjU53qpNvrhYWMNN0zHTzdMcOFhpJrrazvPl5MrJ9jnOqBR2tW6C55ANpMdnEQDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T00:55:03.496594Z"},"content_sha256":"c882794309c770f185d1f2615efb7d4f5b3194ac799a7ff235c83a2c3e4bf0fa","schema_version":"1.0","event_id":"sha256:c882794309c770f185d1f2615efb7d4f5b3194ac799a7ff235c83a2c3e4bf0fa"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:HIDMQF7BMREILUERSZUEQTVEHG","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches","license":"http://creativecommons.org/licenses/by-sa/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Fabio Massacci, Ranindya Paramitha, Yuan Feng","submitted_at":"2025-06-13T16:42:21Z","abstract_excerpt":"Vulnerability datasets used for ML testing implicitly contain retrospective information. When tested on the field, one can only use the labels available at the time of training and testing (e.g. seen and assumed negatives). As vulnerabilities are discovered across calendar time, labels change and past performance is not necessarily aligned with future performance. Past works only considered the slices of the whole history (e.g. DiverseVUl) or individual differences between releases (e.g. Jimenez et al. ESEC/FSE 2019). Such approaches are either too optimistic in training (e.g. the whole histor"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.11939","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.11939/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:21:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eteedUh26iCsJR957vvXTe0PlTtfhiJhhdH/lNAWC2Tbk08uVCkesMu83JmchRQwvwJcnsVdywi16vP/0Z0oBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-19T00:55:03.497511Z"},"content_sha256":"93d95c966f25feffc9bfafaa62e19b2c53df43f79757191049b7e8474c40daf8","schema_version":"1.0","event_id":"sha256:93d95c966f25feffc9bfafaa62e19b2c53df43f79757191049b7e8474c40daf8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/HIDMQF7BMREILUERSZUEQTVEHG/bundle.json","state_url":"https://pith.science/pith/HIDMQF7BMREILUERSZUEQTVEHG/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/HIDMQF7BMREILUERSZUEQTVEHG/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-19T00:55:03Z","links":{"resolver":"https://pith.science/pith/HIDMQF7BMREILUERSZUEQTVEHG","bundle":"https://pith.science/pith/HIDMQF7BMREILUERSZUEQTVEHG/bundle.json","state":"https://pith.science/pith/HIDMQF7BMREILUERSZUEQTVEHG/state.json","well_known_bundle":"https://pith.science/.well-known/pith/HIDMQF7BMREILUERSZUEQTVEHG/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:HIDMQF7BMREILUERSZUEQTVEHG","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"0691d7684b7a0cb17a9fdb856496f9efb9892ba182e2f5f61cd2de8b06dedf0c","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-13T16:42:21Z","title_canon_sha256":"2a9301ec8b176ed27294104095ae46b6a4918286bf012a90c000a1851d848b25"},"schema_version":"1.0","source":{"id":"2506.11939","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.11939","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"arxiv_version","alias_value":"2506.11939v1","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.11939","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_12","alias_value":"HIDMQF7BMREI","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_16","alias_value":"HIDMQF7BMREILUER","created_at":"2026-07-05T11:21:13Z"},{"alias_kind":"pith_short_8","alias_value":"HIDMQF7B","created_at":"2026-07-05T11:21:13Z"}],"graph_snapshots":[{"event_id":"sha256:93d95c966f25feffc9bfafaa62e19b2c53df43f79757191049b7e8474c40daf8","target":"graph","created_at":"2026-07-05T11:21:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.11939/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Vulnerability datasets used for ML testing implicitly contain retrospective information. When tested on the field, one can only use the labels available at the time of training and testing (e.g. seen and assumed negatives). As vulnerabilities are discovered across calendar time, labels change and past performance is not necessarily aligned with future performance. Past works only considered the slices of the whole history (e.g. DiverseVUl) or individual differences between releases (e.g. Jimenez et al. ESEC/FSE 2019). Such approaches are either too optimistic in training (e.g. the whole histor","authors_text":"Fabio Massacci, Ranindya Paramitha, Yuan Feng","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-13T16:42:21Z","title":"Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.11939","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:c882794309c770f185d1f2615efb7d4f5b3194ac799a7ff235c83a2c3e4bf0fa","target":"record","created_at":"2026-07-05T11:21:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"0691d7684b7a0cb17a9fdb856496f9efb9892ba182e2f5f61cd2de8b06dedf0c","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-13T16:42:21Z","title_canon_sha256":"2a9301ec8b176ed27294104095ae46b6a4918286bf012a90c000a1851d848b25"},"schema_version":"1.0","source":{"id":"2506.11939","kind":"arxiv","version":1}},"canonical_sha256":"3a06c817e1644885d0919668484ea4398f6c23ffc6491bb8c686998d64af6df4","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3a06c817e1644885d0919668484ea4398f6c23ffc6491bb8c686998d64af6df4","first_computed_at":"2026-07-05T11:21:13.141788Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:21:13.141788Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"xm+GiZt0qFj7LcjAASKm3Kr07+gtA77FbkVeR83vl4+FE5fl3B/ZYiVZ1D4juehyCULw+qWWWDIELBLdfapgCA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:21:13.142215Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.11939","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:c882794309c770f185d1f2615efb7d4f5b3194ac799a7ff235c83a2c3e4bf0fa","sha256:93d95c966f25feffc9bfafaa62e19b2c53df43f79757191049b7e8474c40daf8"],"state_sha256":"84be74ae1f6ce881d4ecde8eaa65f7b92073b65ead313af86e65672d04d8f091"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"626T7UCG5JIYIDH3ETLk3eGaLc4xK9KyZgvN2vAMlSUej4+7ITp2NRLnCaQ+s5sYMaJOQtIAJ+HMgFXyXJQEAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-19T00:55:03.503592Z","bundle_sha256":"8f7c89dfdf47ca8fb94189e3741d918d4f9ccf8c4a1831a0df9caf0e5cf6c448"}}