{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:LC4L5TSMT7PLC3XE47DY252QA7","short_pith_number":"pith:LC4L5TSM","canonical_record":{"source":{"id":"2406.09669","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-14T02:39:43Z","cross_cats_sorted":[],"title_canon_sha256":"4bb85e25c5d16b19da4e81e3d9afbba79359a5fdf9c7ac150cee6a290b7f2bdd","abstract_canon_sha256":"76c67b7d260794dd01a2d1448960c2261cc09a1478fa6cd2c3be0972f3b267d4"},"schema_version":"1.0"},"canonical_sha256":"58b8bece4c9fdeb16ee4e7c78d775007faae6f0ab565bd3778937ea81315faf3","source":{"kind":"arxiv","id":"2406.09669","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.09669","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"arxiv_version","alias_value":"2406.09669v1","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.09669","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_12","alias_value":"LC4L5TSMT7PL","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_16","alias_value":"LC4L5TSMT7PLC3XE","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_8","alias_value":"LC4L5TSM","created_at":"2026-07-05T08:31:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:LC4L5TSMT7PLC3XE47DY252QA7","target":"record","payload":{"canonical_record":{"source":{"id":"2406.09669","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-14T02:39:43Z","cross_cats_sorted":[],"title_canon_sha256":"4bb85e25c5d16b19da4e81e3d9afbba79359a5fdf9c7ac150cee6a290b7f2bdd","abstract_canon_sha256":"76c67b7d260794dd01a2d1448960c2261cc09a1478fa6cd2c3be0972f3b267d4"},"schema_version":"1.0"},"canonical_sha256":"58b8bece4c9fdeb16ee4e7c78d775007faae6f0ab565bd3778937ea81315faf3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:31:57.882414Z","signature_b64":"ePkMK9/VY6uLoB8UamrEz9C+dWa4DFLLkijXZD3a9WPoxm3TtVVtnjK7tsu69cLN2bh45dH2jZOISUdkZ47FDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"58b8bece4c9fdeb16ee4e7c78d775007faae6f0ab565bd3778937ea81315faf3","last_reissued_at":"2026-07-05T08:31:57.881906Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:31:57.881906Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2406.09669","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:31:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5p8F/FhyuCmnvYwF/lPpFl4ABNVTA3l1jAUyOZZwXJgjSClei9pWPzveWUhJkKMXArMwvYUObzmHTG7dZVqWBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T00:11:25.828965Z"},"content_sha256":"f8d9e6187e57e9314b0352cdd1fc2452e15ccf66dd23215f07a01f5bf02eb05c","schema_version":"1.0","event_id":"sha256:f8d9e6187e57e9314b0352cdd1fc2452e15ccf66dd23215f07a01f5bf02eb05c"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:LC4L5TSMT7PLC3XE47DY252QA7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Bochuan Cao, Changjiang Li, Fenglong Ma, Jinghui Chen, Ren Pang, Shouling Ji, Ting Wang","submitted_at":"2024-06-14T02:39:43Z","abstract_excerpt":"Thanks to their remarkable denoising capabilities, diffusion models are increasingly being employed as defensive tools to reinforce the security of other models, notably in purifying adversarial examples and certifying adversarial robustness. However, the security risks of these practices themselves remain largely unexplored, which is highly concerning. To bridge this gap, this work investigates the vulnerabilities of security-enhancing diffusion models. Specifically, we demonstrate that these models are highly susceptible to DIFF2, a simple yet effective backdoor attack, which substantially d"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.09669","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2406.09669/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:31:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4grXNmwXvq7AHFrNBEG3AJa/LibZo2ZbyjH7w9WFoj/H9+lJIE3i4wMjGqagwHkTbwrDLgHu2PiuSHeeu7vpCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-24T00:11:25.829340Z"},"content_sha256":"bc9b061792c73c7d22005257da53c99bfa32d738b5228070d9226417dd7acde1","schema_version":"1.0","event_id":"sha256:bc9b061792c73c7d22005257da53c99bfa32d738b5228070d9226417dd7acde1"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/LC4L5TSMT7PLC3XE47DY252QA7/bundle.json","state_url":"https://pith.science/pith/LC4L5TSMT7PLC3XE47DY252QA7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/LC4L5TSMT7PLC3XE47DY252QA7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-24T00:11:25Z","links":{"resolver":"https://pith.science/pith/LC4L5TSMT7PLC3XE47DY252QA7","bundle":"https://pith.science/pith/LC4L5TSMT7PLC3XE47DY252QA7/bundle.json","state":"https://pith.science/pith/LC4L5TSMT7PLC3XE47DY252QA7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/LC4L5TSMT7PLC3XE47DY252QA7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:LC4L5TSMT7PLC3XE47DY252QA7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"76c67b7d260794dd01a2d1448960c2261cc09a1478fa6cd2c3be0972f3b267d4","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-14T02:39:43Z","title_canon_sha256":"4bb85e25c5d16b19da4e81e3d9afbba79359a5fdf9c7ac150cee6a290b7f2bdd"},"schema_version":"1.0","source":{"id":"2406.09669","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.09669","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"arxiv_version","alias_value":"2406.09669v1","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.09669","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_12","alias_value":"LC4L5TSMT7PL","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_16","alias_value":"LC4L5TSMT7PLC3XE","created_at":"2026-07-05T08:31:57Z"},{"alias_kind":"pith_short_8","alias_value":"LC4L5TSM","created_at":"2026-07-05T08:31:57Z"}],"graph_snapshots":[{"event_id":"sha256:bc9b061792c73c7d22005257da53c99bfa32d738b5228070d9226417dd7acde1","target":"graph","created_at":"2026-07-05T08:31:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2406.09669/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Thanks to their remarkable denoising capabilities, diffusion models are increasingly being employed as defensive tools to reinforce the security of other models, notably in purifying adversarial examples and certifying adversarial robustness. However, the security risks of these practices themselves remain largely unexplored, which is highly concerning. To bridge this gap, this work investigates the vulnerabilities of security-enhancing diffusion models. Specifically, we demonstrate that these models are highly susceptible to DIFF2, a simple yet effective backdoor attack, which substantially d","authors_text":"Bochuan Cao, Changjiang Li, Fenglong Ma, Jinghui Chen, Ren Pang, Shouling Ji, Ting Wang","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-14T02:39:43Z","title":"Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.09669","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f8d9e6187e57e9314b0352cdd1fc2452e15ccf66dd23215f07a01f5bf02eb05c","target":"record","created_at":"2026-07-05T08:31:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"76c67b7d260794dd01a2d1448960c2261cc09a1478fa6cd2c3be0972f3b267d4","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-14T02:39:43Z","title_canon_sha256":"4bb85e25c5d16b19da4e81e3d9afbba79359a5fdf9c7ac150cee6a290b7f2bdd"},"schema_version":"1.0","source":{"id":"2406.09669","kind":"arxiv","version":1}},"canonical_sha256":"58b8bece4c9fdeb16ee4e7c78d775007faae6f0ab565bd3778937ea81315faf3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"58b8bece4c9fdeb16ee4e7c78d775007faae6f0ab565bd3778937ea81315faf3","first_computed_at":"2026-07-05T08:31:57.881906Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:31:57.881906Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ePkMK9/VY6uLoB8UamrEz9C+dWa4DFLLkijXZD3a9WPoxm3TtVVtnjK7tsu69cLN2bh45dH2jZOISUdkZ47FDw==","signature_status":"signed_v1","signed_at":"2026-07-05T08:31:57.882414Z","signed_message":"canonical_sha256_bytes"},"source_id":"2406.09669","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f8d9e6187e57e9314b0352cdd1fc2452e15ccf66dd23215f07a01f5bf02eb05c","sha256:bc9b061792c73c7d22005257da53c99bfa32d738b5228070d9226417dd7acde1"],"state_sha256":"a489c7b265661d1b15090273a8f41cc2790a9543e09dc3c4816bf8c00e2d1076"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LrXoTxwH4EIW1k7zcGbGemrvOiJcYTjXuXj6pzqQJ6RiL2qKmJSUSRGPFi7ekxKeHXLH7uhRs7bO8/RyLlxiDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-24T00:11:25.833009Z","bundle_sha256":"345b810682a0380902df0aebf293ea437b4f4c72ab6748ebd1fa69afa1b89314"}}