{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:MJRZH5OFRBXSVW4U5FLT7KHEXU","short_pith_number":"pith:MJRZH5OF","canonical_record":{"source":{"id":"2405.14457","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-05-23T11:38:38Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"e588c2db54b3468c362e6d897df5f8fbd6418b1e89eec2a30d14342b5ef0e49c","abstract_canon_sha256":"3a32b672aa79e8fd1e319535ce49b3b0ae39585fca2e083d88378bd0af498cb2"},"schema_version":"1.0"},"canonical_sha256":"626393f5c5886f2adb94e9573fa8e4bd299855be1b9c8f7109e4b517345625ab","source":{"kind":"arxiv","id":"2405.14457","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.14457","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"arxiv_version","alias_value":"2405.14457v3","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.14457","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_12","alias_value":"MJRZH5OFRBXS","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_16","alias_value":"MJRZH5OFRBXSVW4U","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_8","alias_value":"MJRZH5OF","created_at":"2026-07-05T11:11:32Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:MJRZH5OFRBXSVW4U5FLT7KHEXU","target":"record","payload":{"canonical_record":{"source":{"id":"2405.14457","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-05-23T11:38:38Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"e588c2db54b3468c362e6d897df5f8fbd6418b1e89eec2a30d14342b5ef0e49c","abstract_canon_sha256":"3a32b672aa79e8fd1e319535ce49b3b0ae39585fca2e083d88378bd0af498cb2"},"schema_version":"1.0"},"canonical_sha256":"626393f5c5886f2adb94e9573fa8e4bd299855be1b9c8f7109e4b517345625ab","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:11:32.199408Z","signature_b64":"FAQoxI8XsMBlWvuyL4asrdurQcm+TvdzOu7JQUxTlHOKIHRE/vanUdo7XDBExdFc5kuefgNKaOBwHq7jd+XEDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"626393f5c5886f2adb94e9573fa8e4bd299855be1b9c8f7109e4b517345625ab","last_reissued_at":"2026-07-05T11:11:32.198889Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:11:32.198889Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2405.14457","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6xYfuJPXZ6cSoY9VkEWSt2F7L4lDrqua045COahhgm2f6AiOyj2ia6k56ZTfZKiHRA9l7F5HVdmyYBvhgYNdDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T03:26:21.533079Z"},"content_sha256":"0e96e4eceffd611ba608047278bdfea2db6f73a21391acbceefbe58cd607f2a4","schema_version":"1.0","event_id":"sha256:0e96e4eceffd611ba608047278bdfea2db6f73a21391acbceefbe58cd607f2a4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:MJRZH5OFRBXSVW4U5FLT7KHEXU","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.LG","authors_text":"Aur\\'elien Bellet, Nicolas Papernot, Tudor Cebere","submitted_at":"2024-05-23T11:38:38Z","abstract_excerpt":"Machine learning models can be trained with formal privacy guarantees via differentially private optimizers such as DP-SGD. In this work, we focus on a threat model where the adversary has access only to the final model, with no visibility into intermediate updates. In the literature, this hidden state threat model exhibits a significant gap between the lower bound from empirical privacy auditing and the theoretical upper bound provided by privacy accounting. To challenge this gap, we propose to audit this threat model with adversaries that craft a gradient sequence designed to maximize the pr"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.14457","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2405.14457/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:11:32Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qfmRqIlrRSqQCpS315LTRYjxDZ3O8aiNzKh6J8SETOYJO9GMFuiK7mzPq4YdLzANtGZW1QI51rCyUiGcRF7FDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T03:26:21.533964Z"},"content_sha256":"73b735ed460e10289d691a442edeb7b4dfb35ceedc505db2062b92e9eb79694b","schema_version":"1.0","event_id":"sha256:73b735ed460e10289d691a442edeb7b4dfb35ceedc505db2062b92e9eb79694b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/bundle.json","state_url":"https://pith.science/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T03:26:21Z","links":{"resolver":"https://pith.science/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU","bundle":"https://pith.science/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/bundle.json","state":"https://pith.science/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/state.json","well_known_bundle":"https://pith.science/.well-known/pith/MJRZH5OFRBXSVW4U5FLT7KHEXU/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:MJRZH5OFRBXSVW4U5FLT7KHEXU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3a32b672aa79e8fd1e319535ce49b3b0ae39585fca2e083d88378bd0af498cb2","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-05-23T11:38:38Z","title_canon_sha256":"e588c2db54b3468c362e6d897df5f8fbd6418b1e89eec2a30d14342b5ef0e49c"},"schema_version":"1.0","source":{"id":"2405.14457","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2405.14457","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"arxiv_version","alias_value":"2405.14457v3","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2405.14457","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_12","alias_value":"MJRZH5OFRBXS","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_16","alias_value":"MJRZH5OFRBXSVW4U","created_at":"2026-07-05T11:11:32Z"},{"alias_kind":"pith_short_8","alias_value":"MJRZH5OF","created_at":"2026-07-05T11:11:32Z"}],"graph_snapshots":[{"event_id":"sha256:73b735ed460e10289d691a442edeb7b4dfb35ceedc505db2062b92e9eb79694b","target":"graph","created_at":"2026-07-05T11:11:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2405.14457/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Machine learning models can be trained with formal privacy guarantees via differentially private optimizers such as DP-SGD. In this work, we focus on a threat model where the adversary has access only to the final model, with no visibility into intermediate updates. In the literature, this hidden state threat model exhibits a significant gap between the lower bound from empirical privacy auditing and the theoretical upper bound provided by privacy accounting. To challenge this gap, we propose to audit this threat model with adversaries that craft a gradient sequence designed to maximize the pr","authors_text":"Aur\\'elien Bellet, Nicolas Papernot, Tudor Cebere","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-05-23T11:38:38Z","title":"Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2405.14457","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0e96e4eceffd611ba608047278bdfea2db6f73a21391acbceefbe58cd607f2a4","target":"record","created_at":"2026-07-05T11:11:32Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3a32b672aa79e8fd1e319535ce49b3b0ae39585fca2e083d88378bd0af498cb2","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.LG","submitted_at":"2024-05-23T11:38:38Z","title_canon_sha256":"e588c2db54b3468c362e6d897df5f8fbd6418b1e89eec2a30d14342b5ef0e49c"},"schema_version":"1.0","source":{"id":"2405.14457","kind":"arxiv","version":3}},"canonical_sha256":"626393f5c5886f2adb94e9573fa8e4bd299855be1b9c8f7109e4b517345625ab","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"626393f5c5886f2adb94e9573fa8e4bd299855be1b9c8f7109e4b517345625ab","first_computed_at":"2026-07-05T11:11:32.198889Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:11:32.198889Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"FAQoxI8XsMBlWvuyL4asrdurQcm+TvdzOu7JQUxTlHOKIHRE/vanUdo7XDBExdFc5kuefgNKaOBwHq7jd+XEDg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:11:32.199408Z","signed_message":"canonical_sha256_bytes"},"source_id":"2405.14457","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0e96e4eceffd611ba608047278bdfea2db6f73a21391acbceefbe58cd607f2a4","sha256:73b735ed460e10289d691a442edeb7b4dfb35ceedc505db2062b92e9eb79694b"],"state_sha256":"dbc4000a14848d08aac1b84cb0a9e71a7854c15a21ecdebf2815bba47453044f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BfWFKkOWzXmkuqhkknRTeoPbxrPtNuOB7o9tpwJkLPlER5H4l5xaSjQHnxqSBVNFyECqI8C7Csa78bIu0PirBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T03:26:21.541971Z","bundle_sha256":"53e117f038adfb033a526d07ec818622caec0fecd0720c64446d51176764e957"}}