{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:JKM6ZORIXAGI4S3H2HY2KPWIFS","short_pith_number":"pith:JKM6ZORI","canonical_record":{"source":{"id":"2402.08695","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-12T20:14:46Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"4efe5bb5aac81c7946ac0f6c4c2b7ae777c0a95b880d52cf7405f333b4d6c099","abstract_canon_sha256":"1fe2cf18fb93640f1ebe971565979bb7e76a29240f1623d62b364d55361dc4ba"},"schema_version":"1.0"},"canonical_sha256":"4a99ecba28b80c8e4b67d1f1a53ec82c9ed630a7cd5958fc2b389fa3588ecb96","source":{"kind":"arxiv","id":"2402.08695","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.08695","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"arxiv_version","alias_value":"2402.08695v1","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.08695","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_12","alias_value":"JKM6ZORIXAGI","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_16","alias_value":"JKM6ZORIXAGI4S3H","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_8","alias_value":"JKM6ZORI","created_at":"2026-07-05T07:45:01Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:JKM6ZORIXAGI4S3H2HY2KPWIFS","target":"record","payload":{"canonical_record":{"source":{"id":"2402.08695","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-12T20:14:46Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"4efe5bb5aac81c7946ac0f6c4c2b7ae777c0a95b880d52cf7405f333b4d6c099","abstract_canon_sha256":"1fe2cf18fb93640f1ebe971565979bb7e76a29240f1623d62b364d55361dc4ba"},"schema_version":"1.0"},"canonical_sha256":"4a99ecba28b80c8e4b67d1f1a53ec82c9ed630a7cd5958fc2b389fa3588ecb96","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T07:45:01.047070Z","signature_b64":"AvN6MlxtnIxjkJwDFr64LJ545AtyBk9ryTKB9Ud/GSNjd1If2AJztBDPCL8mdlIITpic1s18GapXJ1l62lrBCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4a99ecba28b80c8e4b67d1f1a53ec82c9ed630a7cd5958fc2b389fa3588ecb96","last_reissued_at":"2026-07-05T07:45:01.046583Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T07:45:01.046583Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2402.08695","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:45:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1Vkgz3zKGenQeNxpTpVJv3gu8oTn0hlc1p39DQwSgjJdH715KtTTqdykFVdr771oZKwi/p4O8vYSbpuA6BgsBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T18:42:45.654948Z"},"content_sha256":"667113c96c9e3ecabb692d95214718fdf2d0d16a09dac9be1ea1fb3ece20e830","schema_version":"1.0","event_id":"sha256:667113c96c9e3ecabb692d95214718fdf2d0d16a09dac9be1ea1fb3ece20e830"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:JKM6ZORIXAGI4S3H2HY2KPWIFS","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Game of Trojans: Adaptive Adversaries Against Output-based Trojaned-Model Detectors","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Arezoo Rajabi, Bhaskar Ramasubramanian, Bo Li, Dinuka Sahabandu, Luyao Niu, Radha Poovendran, Xiaojun Xu","submitted_at":"2024-02-12T20:14:46Z","abstract_excerpt":"We propose and analyze an adaptive adversary that can retrain a Trojaned DNN and is also aware of SOTA output-based Trojaned model detectors. We show that such an adversary can ensure (1) high accuracy on both trigger-embedded and clean samples and (2) bypass detection. Our approach is based on an observation that the high dimensionality of the DNN parameters provides sufficient degrees of freedom to simultaneously achieve these objectives. We also enable SOTA detectors to be adaptive by allowing retraining to recalibrate their parameters, thus modeling a co-evolution of parameters of a Trojan"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.08695","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2402.08695/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T07:45:01Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4VkVyE3V2eUv3OL5g0aBa5nXlXn+n2jiS7rn5KA3DiwPOFWMBGZjlvrPqKqXKaheSjB1uCbcsT1jACb2KnLTDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-06T18:42:45.655341Z"},"content_sha256":"6b3cfe137e5861422fed4f08d7e72cd4edd620202aa9aad22d51f5ea323995bd","schema_version":"1.0","event_id":"sha256:6b3cfe137e5861422fed4f08d7e72cd4edd620202aa9aad22d51f5ea323995bd"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/bundle.json","state_url":"https://pith.science/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-06T18:42:45Z","links":{"resolver":"https://pith.science/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS","bundle":"https://pith.science/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/bundle.json","state":"https://pith.science/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JKM6ZORIXAGI4S3H2HY2KPWIFS/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:JKM6ZORIXAGI4S3H2HY2KPWIFS","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1fe2cf18fb93640f1ebe971565979bb7e76a29240f1623d62b364d55361dc4ba","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-12T20:14:46Z","title_canon_sha256":"4efe5bb5aac81c7946ac0f6c4c2b7ae777c0a95b880d52cf7405f333b4d6c099"},"schema_version":"1.0","source":{"id":"2402.08695","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2402.08695","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"arxiv_version","alias_value":"2402.08695v1","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2402.08695","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_12","alias_value":"JKM6ZORIXAGI","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_16","alias_value":"JKM6ZORIXAGI4S3H","created_at":"2026-07-05T07:45:01Z"},{"alias_kind":"pith_short_8","alias_value":"JKM6ZORI","created_at":"2026-07-05T07:45:01Z"}],"graph_snapshots":[{"event_id":"sha256:6b3cfe137e5861422fed4f08d7e72cd4edd620202aa9aad22d51f5ea323995bd","target":"graph","created_at":"2026-07-05T07:45:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2402.08695/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We propose and analyze an adaptive adversary that can retrain a Trojaned DNN and is also aware of SOTA output-based Trojaned model detectors. We show that such an adversary can ensure (1) high accuracy on both trigger-embedded and clean samples and (2) bypass detection. Our approach is based on an observation that the high dimensionality of the DNN parameters provides sufficient degrees of freedom to simultaneously achieve these objectives. We also enable SOTA detectors to be adaptive by allowing retraining to recalibrate their parameters, thus modeling a co-evolution of parameters of a Trojan","authors_text":"Arezoo Rajabi, Bhaskar Ramasubramanian, Bo Li, Dinuka Sahabandu, Luyao Niu, Radha Poovendran, Xiaojun Xu","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-12T20:14:46Z","title":"Game of Trojans: Adaptive Adversaries Against Output-based Trojaned-Model Detectors"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2402.08695","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:667113c96c9e3ecabb692d95214718fdf2d0d16a09dac9be1ea1fb3ece20e830","target":"record","created_at":"2026-07-05T07:45:01Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1fe2cf18fb93640f1ebe971565979bb7e76a29240f1623d62b364d55361dc4ba","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2024-02-12T20:14:46Z","title_canon_sha256":"4efe5bb5aac81c7946ac0f6c4c2b7ae777c0a95b880d52cf7405f333b4d6c099"},"schema_version":"1.0","source":{"id":"2402.08695","kind":"arxiv","version":1}},"canonical_sha256":"4a99ecba28b80c8e4b67d1f1a53ec82c9ed630a7cd5958fc2b389fa3588ecb96","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4a99ecba28b80c8e4b67d1f1a53ec82c9ed630a7cd5958fc2b389fa3588ecb96","first_computed_at":"2026-07-05T07:45:01.046583Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T07:45:01.046583Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"AvN6MlxtnIxjkJwDFr64LJ545AtyBk9ryTKB9Ud/GSNjd1If2AJztBDPCL8mdlIITpic1s18GapXJ1l62lrBCw==","signature_status":"signed_v1","signed_at":"2026-07-05T07:45:01.047070Z","signed_message":"canonical_sha256_bytes"},"source_id":"2402.08695","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:667113c96c9e3ecabb692d95214718fdf2d0d16a09dac9be1ea1fb3ece20e830","sha256:6b3cfe137e5861422fed4f08d7e72cd4edd620202aa9aad22d51f5ea323995bd"],"state_sha256":"db40cc67bc7f82f205dc9701037f9d5138544dc60a5eeeb4387a6a3a7f41e7d1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"i3OiyBMoDry3cbs6j5/YrgWCqhLYOn2BpD3pfM9Y9XIorxNgQ+pY3Xg+Rrq0kN2vsfzIN4pCdRNM6zQPBastAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-06T18:42:45.657381Z","bundle_sha256":"dd482fbc731f4ba7118c324f6a6fc9e908536574c2b05a8b16671c4d74f475d9"}}