{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:JBNN4YGYCIYO6UC7FVWULOLAFV","short_pith_number":"pith:JBNN4YGY","canonical_record":{"source":{"id":"2303.09105","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2023-03-16T06:37:16Z","cross_cats_sorted":[],"title_canon_sha256":"013d7ad9ffd30660c1d3b073965ca199a846948ba62577275b277503d1e4c0d4","abstract_canon_sha256":"432c5a251fd5a591e71fd594a7046e35650161d12c789a6bba6c33425cff774f"},"schema_version":"1.0"},"canonical_sha256":"485ade60d81230ef505f2d6d45b9602d63004cde3356b7dc4c2f9ac66433de5f","source":{"kind":"arxiv","id":"2303.09105","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2303.09105","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"arxiv_version","alias_value":"2303.09105v2","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2303.09105","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_12","alias_value":"JBNN4YGYCIYO","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_16","alias_value":"JBNN4YGYCIYO6UC7","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_8","alias_value":"JBNN4YGY","created_at":"2026-07-05T07:51:26Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:JBNN4YGYCIYO6UC7FVWULOLAFV","target":"record","payload":{"canonical_record":{"source":{"id":"2303.09105","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2023-03-16T06:37:16Z","cross_cats_sorted":[],"title_canon_sha256":"013d7ad9ffd30660c1d3b073965ca199a846948ba62577275b277503d1e4c0d4","abstract_canon_sha256":"432c5a251fd5a591e71fd594a7046e35650161d12c789a6bba6c33425cff774f"},"schema_version":"1.0"},"canonical_sha256":"485ade60d81230ef505f2d6d45b9602d63004cde3356b7dc4c2f9ac66433de5f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:51:26.866348Z","signature_b64":"b4Q4GrDai8q7u6Y1IbLYBNicZPhJihUxmnqBk2sBrkbBR8fnf21wBWZPaVXqZr5CIdl0pCeT9+hfF8CWm1/EAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"485ade60d81230ef505f2d6d45b9602d63004cde3356b7dc4c2f9ac66433de5f","last_reissued_at":"2026-07-05T07:51:26.865924Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:51:26.865924Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2303.09105","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:51:26Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ABKUUjDx2LT2cz+1H5zPYMU/JCp9uQxunBZxVqev5zfNHmLyEWlPfUh8Cj6R6OyzSemiuQoLvewt4wGg0QvzCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T09:26:09.800583Z"},"content_sha256":"3719b851d1e95c4d27bbb394312bbbb28b620806e8973eee7457471a63b04b9d","schema_version":"1.0","event_id":"sha256:3719b851d1e95c4d27bbb394312bbbb28b620806e8973eee7457471a63b04b9d"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:JBNN4YGYCIYO6UC7FVWULOLAFV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Rethinking Model Ensemble in Transfer-based Adversarial Attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CV","authors_text":"Hang Su, Huanran Chen, Jun Zhu, Xiao Yang, Yichi Zhang, Yinpeng Dong","submitted_at":"2023-03-16T06:37:16Z","abstract_excerpt":"It is widely recognized that deep learning models lack robustness to adversarial examples. An intriguing property of adversarial examples is that they can transfer across different models, which enables black-box attacks without any knowledge of the victim model. An effective strategy to improve the transferability is attacking an ensemble of models. However, previous works simply average the outputs of different models, lacking an in-depth analysis on how and why model ensemble methods can strongly improve the transferability. In this paper, we rethink the ensemble in adversarial attacks and "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2303.09105","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2303.09105/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:51:26Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"NaGuCRGLgUlLih3sGQ2vbk0Ts9GSZ7d7E7JhfT05fjVsTzAejZBewlIHPF6ieIwNfZ8/1XTvijrakMqGy9egDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T09:26:09.801099Z"},"content_sha256":"d5e5dfa5a8b76b25bd95e94209b7e3f2f8901750e89e7dc0c097aecf05fa04e8","schema_version":"1.0","event_id":"sha256:d5e5dfa5a8b76b25bd95e94209b7e3f2f8901750e89e7dc0c097aecf05fa04e8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/bundle.json","state_url":"https://pith.science/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T09:26:09Z","links":{"resolver":"https://pith.science/pith/JBNN4YGYCIYO6UC7FVWULOLAFV","bundle":"https://pith.science/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/bundle.json","state":"https://pith.science/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JBNN4YGYCIYO6UC7FVWULOLAFV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:JBNN4YGYCIYO6UC7FVWULOLAFV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"432c5a251fd5a591e71fd594a7046e35650161d12c789a6bba6c33425cff774f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2023-03-16T06:37:16Z","title_canon_sha256":"013d7ad9ffd30660c1d3b073965ca199a846948ba62577275b277503d1e4c0d4"},"schema_version":"1.0","source":{"id":"2303.09105","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2303.09105","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"arxiv_version","alias_value":"2303.09105v2","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2303.09105","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_12","alias_value":"JBNN4YGYCIYO","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_16","alias_value":"JBNN4YGYCIYO6UC7","created_at":"2026-07-05T07:51:26Z"},{"alias_kind":"pith_short_8","alias_value":"JBNN4YGY","created_at":"2026-07-05T07:51:26Z"}],"graph_snapshots":[{"event_id":"sha256:d5e5dfa5a8b76b25bd95e94209b7e3f2f8901750e89e7dc0c097aecf05fa04e8","target":"graph","created_at":"2026-07-05T07:51:26Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2303.09105/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"It is widely recognized that deep learning models lack robustness to adversarial examples. An intriguing property of adversarial examples is that they can transfer across different models, which enables black-box attacks without any knowledge of the victim model. An effective strategy to improve the transferability is attacking an ensemble of models. However, previous works simply average the outputs of different models, lacking an in-depth analysis on how and why model ensemble methods can strongly improve the transferability. In this paper, we rethink the ensemble in adversarial attacks and ","authors_text":"Hang Su, Huanran Chen, Jun Zhu, Xiao Yang, Yichi Zhang, Yinpeng Dong","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2023-03-16T06:37:16Z","title":"Rethinking Model Ensemble in Transfer-based Adversarial Attacks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2303.09105","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3719b851d1e95c4d27bbb394312bbbb28b620806e8973eee7457471a63b04b9d","target":"record","created_at":"2026-07-05T07:51:26Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"432c5a251fd5a591e71fd594a7046e35650161d12c789a6bba6c33425cff774f","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2023-03-16T06:37:16Z","title_canon_sha256":"013d7ad9ffd30660c1d3b073965ca199a846948ba62577275b277503d1e4c0d4"},"schema_version":"1.0","source":{"id":"2303.09105","kind":"arxiv","version":2}},"canonical_sha256":"485ade60d81230ef505f2d6d45b9602d63004cde3356b7dc4c2f9ac66433de5f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"485ade60d81230ef505f2d6d45b9602d63004cde3356b7dc4c2f9ac66433de5f","first_computed_at":"2026-07-05T07:51:26.865924Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:51:26.865924Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"b4Q4GrDai8q7u6Y1IbLYBNicZPhJihUxmnqBk2sBrkbBR8fnf21wBWZPaVXqZr5CIdl0pCeT9+hfF8CWm1/EAg==","signature_status":"signed_v1","signed_at":"2026-07-05T07:51:26.866348Z","signed_message":"canonical_sha256_bytes"},"source_id":"2303.09105","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3719b851d1e95c4d27bbb394312bbbb28b620806e8973eee7457471a63b04b9d","sha256:d5e5dfa5a8b76b25bd95e94209b7e3f2f8901750e89e7dc0c097aecf05fa04e8"],"state_sha256":"613a5893a58d0681e792553d9fda5a1b285bb2fbceb4a1c22bbe8bb5d71f9c9f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"o0MyrA5wG2qlF41JXwjxGagMLP6tUj6DAhFbh5i1ortsZQ5W4B/IbWvGirCWeOWO8/3DXiOoefeq7LJRd+23DQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T09:26:09.805775Z","bundle_sha256":"567fb9702f924875c243f3017cafc3c4c14057f558a6c1dbb046a5c76b004fd8"}}