{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:KQOBMBWMV67JWM64DLXZ7DZJBB","short_pith_number":"pith:KQOBMBWM","canonical_record":{"source":{"id":"2506.10502","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-12T09:02:38Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"4f7e8993d03049ab5c087cd24606ed675226120e77da1c11808f30d0aa03deb6","abstract_canon_sha256":"ab96ac2abaf6727d2a4fb4b3a8ca3621252459613dbfd7b79997e150757c1925"},"schema_version":"1.0"},"canonical_sha256":"541c1606ccafbe9b33dc1aef9f8f29086b295736cd958bb153aded6b25ad0d60","source":{"kind":"arxiv","id":"2506.10502","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.10502","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"arxiv_version","alias_value":"2506.10502v1","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.10502","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_12","alias_value":"KQOBMBWMV67J","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_16","alias_value":"KQOBMBWMV67JWM64","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_8","alias_value":"KQOBMBWM","created_at":"2026-07-05T11:20:25Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:KQOBMBWMV67JWM64DLXZ7DZJBB","target":"record","payload":{"canonical_record":{"source":{"id":"2506.10502","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-12T09:02:38Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"4f7e8993d03049ab5c087cd24606ed675226120e77da1c11808f30d0aa03deb6","abstract_canon_sha256":"ab96ac2abaf6727d2a4fb4b3a8ca3621252459613dbfd7b79997e150757c1925"},"schema_version":"1.0"},"canonical_sha256":"541c1606ccafbe9b33dc1aef9f8f29086b295736cd958bb153aded6b25ad0d60","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:20:25.026141Z","signature_b64":"QKiLwLWSwiK2ix7FPsRYmjTm6ZtPASG2Glh+LYv1b5GQn3sDvVECa3B/wHnUInNpbrrBjtl6jdTPB/bqDdJGCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"541c1606ccafbe9b33dc1aef9f8f29086b295736cd958bb153aded6b25ad0d60","last_reissued_at":"2026-07-05T11:20:25.025681Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:20:25.025681Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.10502","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3LUIPMan8gt8nEzBZPyI1zv11jnmzji3m97lwKwfKQawJ+voetGazo022t3ew5X/xx26+4uT2GZ6olqF7akPAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T10:14:29.356256Z"},"content_sha256":"3c71112906289e020b89d53a3edb4ab5838dbac9a92cb72073cc6e4d1c83cce1","schema_version":"1.0","event_id":"sha256:3c71112906289e020b89d53a3edb4ab5838dbac9a92cb72073cc6e4d1c83cce1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:KQOBMBWMV67JWM64DLXZ7DZJBB","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Junhua Lin, Marc Juarez (University of Edinburgh)","submitted_at":"2025-06-12T09:02:38Z","abstract_excerpt":"We present a novel attack specifically designed against Tree-Ring, a watermarking technique for diffusion models known for its high imperceptibility and robustness against removal attacks. Unlike previous removal attacks, which rely on strong assumptions about attacker capabilities, our attack only requires access to the variational autoencoder that was used to train the target diffusion model, a component that is often publicly available. By leveraging this variational autoencoder, the attacker can approximate the model's intermediate latent space, enabling more effective surrogate-based atta"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.10502","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.10502/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:20:25Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KOZ/xiGpE6dQg5PrIPIIby1orzfVZv4l6BwsJDt2bRlg21uV5+yatJOUcEWcUGXdPOYhyyCB4xT9SzYOBL45Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T10:14:29.356756Z"},"content_sha256":"6843558433067a94b7e2f3b08b1629be5c488c0d011ab0597f54cc62134198b7","schema_version":"1.0","event_id":"sha256:6843558433067a94b7e2f3b08b1629be5c488c0d011ab0597f54cc62134198b7"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/bundle.json","state_url":"https://pith.science/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T10:14:29Z","links":{"resolver":"https://pith.science/pith/KQOBMBWMV67JWM64DLXZ7DZJBB","bundle":"https://pith.science/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/bundle.json","state":"https://pith.science/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KQOBMBWMV67JWM64DLXZ7DZJBB/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:KQOBMBWMV67JWM64DLXZ7DZJBB","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ab96ac2abaf6727d2a4fb4b3a8ca3621252459613dbfd7b79997e150757c1925","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-12T09:02:38Z","title_canon_sha256":"4f7e8993d03049ab5c087cd24606ed675226120e77da1c11808f30d0aa03deb6"},"schema_version":"1.0","source":{"id":"2506.10502","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.10502","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"arxiv_version","alias_value":"2506.10502v1","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.10502","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_12","alias_value":"KQOBMBWMV67J","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_16","alias_value":"KQOBMBWMV67JWM64","created_at":"2026-07-05T11:20:25Z"},{"alias_kind":"pith_short_8","alias_value":"KQOBMBWM","created_at":"2026-07-05T11:20:25Z"}],"graph_snapshots":[{"event_id":"sha256:6843558433067a94b7e2f3b08b1629be5c488c0d011ab0597f54cc62134198b7","target":"graph","created_at":"2026-07-05T11:20:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.10502/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We present a novel attack specifically designed against Tree-Ring, a watermarking technique for diffusion models known for its high imperceptibility and robustness against removal attacks. Unlike previous removal attacks, which rely on strong assumptions about attacker capabilities, our attack only requires access to the variational autoencoder that was used to train the target diffusion model, a component that is often publicly available. By leveraging this variational autoencoder, the attacker can approximate the model's intermediate latent space, enabling more effective surrogate-based atta","authors_text":"Junhua Lin, Marc Juarez (University of Edinburgh)","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-12T09:02:38Z","title":"A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.10502","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3c71112906289e020b89d53a3edb4ab5838dbac9a92cb72073cc6e4d1c83cce1","target":"record","created_at":"2026-07-05T11:20:25Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ab96ac2abaf6727d2a4fb4b3a8ca3621252459613dbfd7b79997e150757c1925","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-12T09:02:38Z","title_canon_sha256":"4f7e8993d03049ab5c087cd24606ed675226120e77da1c11808f30d0aa03deb6"},"schema_version":"1.0","source":{"id":"2506.10502","kind":"arxiv","version":1}},"canonical_sha256":"541c1606ccafbe9b33dc1aef9f8f29086b295736cd958bb153aded6b25ad0d60","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"541c1606ccafbe9b33dc1aef9f8f29086b295736cd958bb153aded6b25ad0d60","first_computed_at":"2026-07-05T11:20:25.025681Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:20:25.025681Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"QKiLwLWSwiK2ix7FPsRYmjTm6ZtPASG2Glh+LYv1b5GQn3sDvVECa3B/wHnUInNpbrrBjtl6jdTPB/bqDdJGCw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:20:25.026141Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.10502","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3c71112906289e020b89d53a3edb4ab5838dbac9a92cb72073cc6e4d1c83cce1","sha256:6843558433067a94b7e2f3b08b1629be5c488c0d011ab0597f54cc62134198b7"],"state_sha256":"dbf4805a5f46431a24c83dce2baa83e31090431ac126eeb4d9de245237b2ab54"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KWAlKVIlkbA6FBuORZdGyvblQUcyUqB6r785VILAL4Y0aoXKpV0FN74z9goSUZSe9tHVjZ65NGrPVpqseQHuCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T10:14:29.360489Z","bundle_sha256":"3f2ed86018a342f5024d667b6e59cb0110762c0bde09c5c677cedbb72b8b61c4"}}