{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:IJKHGFV5FY3Y7O7DUGQB7EL6PX","short_pith_number":"pith:IJKHGFV5","canonical_record":{"source":{"id":"2607.27030","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-29T15:25:07Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"d2ebf3fef3f9008a9ccfde905c1fccbc42159af9a27ebe3170a34e80694cf6d0","abstract_canon_sha256":"33b43f4da3b23ac37a0bb04ce77200dfc5e9e80038445383fa7cbcc5c147687c"},"schema_version":"1.0"},"canonical_sha256":"42547316bd2e378fbbe3a1a01f917e7df771a88959714f57ba54790c1a325eba","source":{"kind":"arxiv","id":"2607.27030","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.27030","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"arxiv_version","alias_value":"2607.27030v1","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.27030","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_12","alias_value":"IJKHGFV5FY3Y","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_16","alias_value":"IJKHGFV5FY3Y7O7D","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_8","alias_value":"IJKHGFV5","created_at":"2026-07-30T01:23:23Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:IJKHGFV5FY3Y7O7DUGQB7EL6PX","target":"record","payload":{"canonical_record":{"source":{"id":"2607.27030","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-29T15:25:07Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"d2ebf3fef3f9008a9ccfde905c1fccbc42159af9a27ebe3170a34e80694cf6d0","abstract_canon_sha256":"33b43f4da3b23ac37a0bb04ce77200dfc5e9e80038445383fa7cbcc5c147687c"},"schema_version":"1.0"},"canonical_sha256":"42547316bd2e378fbbe3a1a01f917e7df771a88959714f57ba54790c1a325eba","receipt":{"kind":"pith_receipt","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"42547316bd2e378fbbe3a1a01f917e7df771a88959714f57ba54790c1a325eba","last_reissued_at":"2026-07-30T01:23:23.752251Z","signature_status":"unsigned_v0","first_computed_at":"2026-07-30T01:23:23.752251Z"},"source_kind":"arxiv","source_id":"2607.27030","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-30T01:23:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xSN6i55xXUeRQqcYs9d3BscDxoUxP9A4ygX/0FBUqI/aoYbtOCXhj46tmhXuGwG0OkDIOM00zjrN56w5/2YDBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T15:13:23.024292Z"},"content_sha256":"5ee712421092eb06814b592a3f0437231849e6d2e2d6aae19823478ee226e91c","schema_version":"1.0","event_id":"sha256:5ee712421092eb06814b592a3f0437231849e6d2e2d6aae19823478ee226e91c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:IJKHGFV5FY3Y7O7DUGQB7EL6PX","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Adam Krivka, Dmitrijs Trizna, Elnaz Babayeva, Evelina Gabasova, Guido Vranken, Igor Morgenstern, Jakub Kubik, Jakub Zikl, Jan Tattermusch, Jiri Balhar, Joshua Rogers, Luigino Camastra, Marek Pavelka, Martin Votruba, Michal Bida, Michal Buran, Michal Janocko, Ondrej Kokes, Patrik Mada, Pavel Kohout, Petr Simecek, Petr Stastny, Stanislav Fort, Tomas Dulka, Tomas Klohna, Vaclav Cadek","submitted_at":"2026-07-29T15:25:07Z","abstract_excerpt":"LLM-based analyzers have begun finding real vulnerabilities in mature open-source projects: AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. We introduce HoF-Bench (named after AISLE's public Hall of Fame), a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits. Analyzers receive source and target-file scope but not CVE identifiers, descriptions, fixes, or expected mechanisms; a detector-blinded frontier-model judge credits only findings that identify the same code path, ro"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.27030","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.27030/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-30T01:23:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ekU50xZLDAtKTGzQ1SAlzhl08gOuQRWEh4JAalf1rxPCsqUQGPIQteMHfdc0Jgnpa3mwNDmZ0GMA9zFeidcUDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T15:13:23.025437Z"},"content_sha256":"acfb1bd0af51ba88b0f2da4a90b30aec0d92b4c4edf2c5ca349c780f1422df41","schema_version":"1.0","event_id":"sha256:acfb1bd0af51ba88b0f2da4a90b30aec0d92b4c4edf2c5ca349c780f1422df41"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/bundle.json","state_url":"https://pith.science/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T15:13:23Z","links":{"resolver":"https://pith.science/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX","bundle":"https://pith.science/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/bundle.json","state":"https://pith.science/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IJKHGFV5FY3Y7O7DUGQB7EL6PX/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:IJKHGFV5FY3Y7O7DUGQB7EL6PX","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"33b43f4da3b23ac37a0bb04ce77200dfc5e9e80038445383fa7cbcc5c147687c","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-29T15:25:07Z","title_canon_sha256":"d2ebf3fef3f9008a9ccfde905c1fccbc42159af9a27ebe3170a34e80694cf6d0"},"schema_version":"1.0","source":{"id":"2607.27030","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.27030","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"arxiv_version","alias_value":"2607.27030v1","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.27030","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_12","alias_value":"IJKHGFV5FY3Y","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_16","alias_value":"IJKHGFV5FY3Y7O7D","created_at":"2026-07-30T01:23:23Z"},{"alias_kind":"pith_short_8","alias_value":"IJKHGFV5","created_at":"2026-07-30T01:23:23Z"}],"graph_snapshots":[{"event_id":"sha256:acfb1bd0af51ba88b0f2da4a90b30aec0d92b4c4edf2c5ca349c780f1422df41","target":"graph","created_at":"2026-07-30T01:23:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.27030/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM-based analyzers have begun finding real vulnerabilities in mature open-source projects: AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. We introduce HoF-Bench (named after AISLE's public Hall of Fame), a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits. Analyzers receive source and target-file scope but not CVE identifiers, descriptions, fixes, or expected mechanisms; a detector-blinded frontier-model judge credits only findings that identify the same code path, ro","authors_text":"Adam Krivka, Dmitrijs Trizna, Elnaz Babayeva, Evelina Gabasova, Guido Vranken, Igor Morgenstern, Jakub Kubik, Jakub Zikl, Jan Tattermusch, Jiri Balhar, Joshua Rogers, Luigino Camastra, Marek Pavelka, Martin Votruba, Michal Bida, Michal Buran, Michal Janocko, Ondrej Kokes, Patrik Mada, Pavel Kohout, Petr Simecek, Petr Stastny, Stanislav Fort, Tomas Dulka, Tomas Klohna, Vaclav Cadek","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-29T15:25:07Z","title":"HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.27030","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5ee712421092eb06814b592a3f0437231849e6d2e2d6aae19823478ee226e91c","target":"record","created_at":"2026-07-30T01:23:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"33b43f4da3b23ac37a0bb04ce77200dfc5e9e80038445383fa7cbcc5c147687c","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-29T15:25:07Z","title_canon_sha256":"d2ebf3fef3f9008a9ccfde905c1fccbc42159af9a27ebe3170a34e80694cf6d0"},"schema_version":"1.0","source":{"id":"2607.27030","kind":"arxiv","version":1}},"canonical_sha256":"42547316bd2e378fbbe3a1a01f917e7df771a88959714f57ba54790c1a325eba","receipt":{"builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"42547316bd2e378fbbe3a1a01f917e7df771a88959714f57ba54790c1a325eba","first_computed_at":"2026-07-30T01:23:23.752251Z","kind":"pith_receipt","last_reissued_at":"2026-07-30T01:23:23.752251Z","receipt_version":"0.3","signature_status":"unsigned_v0"},"source_id":"2607.27030","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5ee712421092eb06814b592a3f0437231849e6d2e2d6aae19823478ee226e91c","sha256:acfb1bd0af51ba88b0f2da4a90b30aec0d92b4c4edf2c5ca349c780f1422df41"],"state_sha256":"729acaf121b062a684411317fa28d0a970534553ef742a9ff92cb500256114f1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"RAl7GIzIIm7vUKJ5mROXwlwSS1T+bdRj22gKpzVddmoqBtPs1Ow0D/i1Y8jnaDRLnBQDZHWI1BbYutXNNeybDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T15:13:23.035142Z","bundle_sha256":"74f66b1c83135493792aa2009889aa768baf40a3d1bbc1a15fc4a4616ded52a7"}}