{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:M65JF4TWJRAV3STJPICPJTPAVR","short_pith_number":"pith:M65JF4TW","canonical_record":{"source":{"id":"2012.07805","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","cross_cats_sorted":["cs.CL","cs.LG"],"title_canon_sha256":"9f2e4630852505ec21d8a2da7e456b5247ae5d8559b23f0e72eb4d433a54f453","abstract_canon_sha256":"23b0b60f13ad5e93511bcf76527d49ba0b554d4ecc2dedfe7d9db34a4524be98"},"schema_version":"1.0"},"canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","source":{"kind":"arxiv","id":"2012.07805","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2012.07805","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"arxiv_version","alias_value":"2012.07805v2","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2012.07805","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_12","alias_value":"M65JF4TWJRAV","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_16","alias_value":"M65JF4TWJRAV3STJ","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_8","alias_value":"M65JF4TW","created_at":"2026-07-05T02:49:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:M65JF4TWJRAV3STJPICPJTPAVR","target":"record","payload":{"canonical_record":{"source":{"id":"2012.07805","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","cross_cats_sorted":["cs.CL","cs.LG"],"title_canon_sha256":"9f2e4630852505ec21d8a2da7e456b5247ae5d8559b23f0e72eb4d433a54f453","abstract_canon_sha256":"23b0b60f13ad5e93511bcf76527d49ba0b554d4ecc2dedfe7d9db34a4524be98"},"schema_version":"1.0"},"canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:49:21.931490Z","signature_b64":"mhVOt9AkEHlBSlvtQMWv3KmKE6WjDpMMOl6YrhHD0lNBx1Ir7ZCq2dXcjKKJ07pbAScEEGqvsSx7Xup5oZ+LDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","last_reissued_at":"2026-07-05T02:49:21.931027Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:49:21.931027Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2012.07805","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:49:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"CLBEccMBw7T/CscvxDmYAWmn0PX9IM7hD9uCEV1LaSfyp1CM21bSvhs0BW1XqTCsBWUNhJWCO0ysrN0x6RuOBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T23:28:14.566544Z"},"content_sha256":"85e9cf9850286b5cf5de1d57980ad8f8fdccc6f7e63723e940a1fffa9a989d49","schema_version":"1.0","event_id":"sha256:85e9cf9850286b5cf5de1d57980ad8f8fdccc6f7e63723e940a1fffa9a989d49"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:M65JF4TWJRAV3STJPICPJTPAVR","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Extracting Training Data from Large Language Models","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CL","cs.LG"],"primary_cat":"cs.CR","authors_text":"Adam Roberts, Alina Oprea, Ariel Herbert-Voss, Colin Raffel, Dawn Song, Eric Wallace, Florian Tramer, Katherine Lee, Matthew Jagielski, Nicholas Carlini, Tom Brown, Ulfar Erlingsson","submitted_at":"2020-12-14T18:39:09Z","abstract_excerpt":"It has become common to publish large (billion parameter) language models that have been trained on private datasets. This paper demonstrates that in such settings, an adversary can perform a training data extraction attack to recover individual training examples by querying the language model.\n  We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data. These extracted examples include (public) personally identifiable information (names, phone numbers, and email add"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2012.07805","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2012.07805/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:49:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kPJCuBJ7hqIyKC0fZAkMv6K7qOnoT+JUQfAfMdZ2ygaymGY85MCIqHR+9iZzLZDNwY17JCIVDtz+dgFn+zhBDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T23:28:14.567043Z"},"content_sha256":"4c941cfbdd710ec00225d80775093f8ff6b27c92dfcb623f23de07f87c5e901b","schema_version":"1.0","event_id":"sha256:4c941cfbdd710ec00225d80775093f8ff6b27c92dfcb623f23de07f87c5e901b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/bundle.json","state_url":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/M65JF4TWJRAV3STJPICPJTPAVR/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T23:28:14Z","links":{"resolver":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR","bundle":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/bundle.json","state":"https://pith.science/pith/M65JF4TWJRAV3STJPICPJTPAVR/state.json","well_known_bundle":"https://pith.science/.well-known/pith/M65JF4TWJRAV3STJPICPJTPAVR/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:M65JF4TWJRAV3STJPICPJTPAVR","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"23b0b60f13ad5e93511bcf76527d49ba0b554d4ecc2dedfe7d9db34a4524be98","cross_cats_sorted":["cs.CL","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","title_canon_sha256":"9f2e4630852505ec21d8a2da7e456b5247ae5d8559b23f0e72eb4d433a54f453"},"schema_version":"1.0","source":{"id":"2012.07805","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2012.07805","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"arxiv_version","alias_value":"2012.07805v2","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2012.07805","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_12","alias_value":"M65JF4TWJRAV","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_16","alias_value":"M65JF4TWJRAV3STJ","created_at":"2026-07-05T02:49:21Z"},{"alias_kind":"pith_short_8","alias_value":"M65JF4TW","created_at":"2026-07-05T02:49:21Z"}],"graph_snapshots":[{"event_id":"sha256:4c941cfbdd710ec00225d80775093f8ff6b27c92dfcb623f23de07f87c5e901b","target":"graph","created_at":"2026-07-05T02:49:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2012.07805/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"It has become common to publish large (billion parameter) language models that have been trained on private datasets. This paper demonstrates that in such settings, an adversary can perform a training data extraction attack to recover individual training examples by querying the language model.\n  We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data. These extracted examples include (public) personally identifiable information (names, phone numbers, and email add","authors_text":"Adam Roberts, Alina Oprea, Ariel Herbert-Voss, Colin Raffel, Dawn Song, Eric Wallace, Florian Tramer, Katherine Lee, Matthew Jagielski, Nicholas Carlini, Tom Brown, Ulfar Erlingsson","cross_cats":["cs.CL","cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","title":"Extracting Training Data from Large Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2012.07805","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:85e9cf9850286b5cf5de1d57980ad8f8fdccc6f7e63723e940a1fffa9a989d49","target":"record","created_at":"2026-07-05T02:49:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"23b0b60f13ad5e93511bcf76527d49ba0b554d4ecc2dedfe7d9db34a4524be98","cross_cats_sorted":["cs.CL","cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2020-12-14T18:39:09Z","title_canon_sha256":"9f2e4630852505ec21d8a2da7e456b5247ae5d8559b23f0e72eb4d433a54f453"},"schema_version":"1.0","source":{"id":"2012.07805","kind":"arxiv","version":2}},"canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"67ba92f2764c415dca697a04f4cde0ac6dcac43b3ac418dad339adf83982029c","first_computed_at":"2026-07-05T02:49:21.931027Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:49:21.931027Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"mhVOt9AkEHlBSlvtQMWv3KmKE6WjDpMMOl6YrhHD0lNBx1Ir7ZCq2dXcjKKJ07pbAScEEGqvsSx7Xup5oZ+LDg==","signature_status":"signed_v1","signed_at":"2026-07-05T02:49:21.931490Z","signed_message":"canonical_sha256_bytes"},"source_id":"2012.07805","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:85e9cf9850286b5cf5de1d57980ad8f8fdccc6f7e63723e940a1fffa9a989d49","sha256:4c941cfbdd710ec00225d80775093f8ff6b27c92dfcb623f23de07f87c5e901b"],"state_sha256":"57f452f7f3a2ae80456c856b81de49220d7739e85142252a28afc9e6d8dc1737"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZWdYh6PReu0j9gnZ5ohguFSyMexMhpVDwWgxcB82EsQvPei+MM7pIp/a+PiEYlUNcKfqMSqEmzRT/ziL0olyDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T23:28:14.572125Z","bundle_sha256":"04ffed677e8ab9c54690c910fabcae92a970a4ca6e9714221cca74fa96bb2419"}}