{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:NJJZPSI5WNBAKLV4HSKTNPEU35","short_pith_number":"pith:NJJZPSI5","canonical_record":{"source":{"id":"2011.04065","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-11-08T20:04:43Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"86ad4801bb2f22fef2ba39c92de1cfebb3a130b8906653825ce59030f7b2993a","abstract_canon_sha256":"f28c4c43efd93d6af30e4753f4c49681570d27823c655d397500c5a6ffa3dc68"},"schema_version":"1.0"},"canonical_sha256":"6a5397c91db342052ebc3c9536bc94df69128c5c8686bd0620c7b55a994bc415","source":{"kind":"arxiv","id":"2011.04065","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2011.04065","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"arxiv_version","alias_value":"2011.04065v2","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2011.04065","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_12","alias_value":"NJJZPSI5WNBA","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_16","alias_value":"NJJZPSI5WNBAKLV4","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_8","alias_value":"NJJZPSI5","created_at":"2026-07-05T01:57:21Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:NJJZPSI5WNBAKLV4HSKTNPEU35","target":"record","payload":{"canonical_record":{"source":{"id":"2011.04065","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-11-08T20:04:43Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"86ad4801bb2f22fef2ba39c92de1cfebb3a130b8906653825ce59030f7b2993a","abstract_canon_sha256":"f28c4c43efd93d6af30e4753f4c49681570d27823c655d397500c5a6ffa3dc68"},"schema_version":"1.0"},"canonical_sha256":"6a5397c91db342052ebc3c9536bc94df69128c5c8686bd0620c7b55a994bc415","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T01:57:21.425513Z","signature_b64":"PknBNSl0ZOXB4ItiYXuu6azfk/8bUoQP2hjHDoKKEakLa1IhQBdkLWCCcu0ThGKuehQefneZilc72P79CFYqAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6a5397c91db342052ebc3c9536bc94df69128c5c8686bd0620c7b55a994bc415","last_reissued_at":"2026-07-05T01:57:21.425013Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T01:57:21.425013Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2011.04065","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:57:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"EH7bLaGjs8lTR99si0kr0wiY+7a2QJeQJU3b+ha09BkV1BcUbyRFRAW06ctl60DqX6Hfoi9B62n3zjXiBsc4CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T03:32:04.569113Z"},"content_sha256":"4f472e4eeb7ae9aa4a253c1288a9498708a8276c98c2b54792738eb35bef60ab","schema_version":"1.0","event_id":"sha256:4f472e4eeb7ae9aa4a253c1288a9498708a8276c98c2b54792738eb35bef60ab"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:NJJZPSI5WNBAKLV4HSKTNPEU35","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Bait and Switch: Online Training Data Poisoning of Autonomous Driving Systems","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.LG","authors_text":"Farshad Khorrami, Naman Patel, Prashanth Krishnamurthy, Siddharth Garg","submitted_at":"2020-11-08T20:04:43Z","abstract_excerpt":"We show that by controlling parts of a physical environment in which a pre-trained deep neural network (DNN) is being fine-tuned online, an adversary can launch subtle data poisoning attacks that degrade the performance of the system. While the attack can be applied in general to any perception task, we consider a DNN based traffic light classifier for an autonomous car that has been trained in one city and is being fine-tuned online in another city. We show that by injecting environmental perturbations that do not modify the traffic lights themselves or ground-truth labels, the adversary can "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2011.04065","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2011.04065/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T01:57:21Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"InhqsHnJdcgQw/N8Zety3ru9xY9DOA/mZTolf3hB/2/NiJbUqxvS9Hum2cCrrA7JhlVLCjeP5ie/XrkydIw6CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T03:32:04.570131Z"},"content_sha256":"46d8fdcb652e4ac34c7cb8369a964507db2cb2d2885af00e5aaaecf4fd07c226","schema_version":"1.0","event_id":"sha256:46d8fdcb652e4ac34c7cb8369a964507db2cb2d2885af00e5aaaecf4fd07c226"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/bundle.json","state_url":"https://pith.science/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T03:32:04Z","links":{"resolver":"https://pith.science/pith/NJJZPSI5WNBAKLV4HSKTNPEU35","bundle":"https://pith.science/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/bundle.json","state":"https://pith.science/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NJJZPSI5WNBAKLV4HSKTNPEU35/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:NJJZPSI5WNBAKLV4HSKTNPEU35","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f28c4c43efd93d6af30e4753f4c49681570d27823c655d397500c5a6ffa3dc68","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-11-08T20:04:43Z","title_canon_sha256":"86ad4801bb2f22fef2ba39c92de1cfebb3a130b8906653825ce59030f7b2993a"},"schema_version":"1.0","source":{"id":"2011.04065","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2011.04065","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"arxiv_version","alias_value":"2011.04065v2","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2011.04065","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_12","alias_value":"NJJZPSI5WNBA","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_16","alias_value":"NJJZPSI5WNBAKLV4","created_at":"2026-07-05T01:57:21Z"},{"alias_kind":"pith_short_8","alias_value":"NJJZPSI5","created_at":"2026-07-05T01:57:21Z"}],"graph_snapshots":[{"event_id":"sha256:46d8fdcb652e4ac34c7cb8369a964507db2cb2d2885af00e5aaaecf4fd07c226","target":"graph","created_at":"2026-07-05T01:57:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2011.04065/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"We show that by controlling parts of a physical environment in which a pre-trained deep neural network (DNN) is being fine-tuned online, an adversary can launch subtle data poisoning attacks that degrade the performance of the system. While the attack can be applied in general to any perception task, we consider a DNN based traffic light classifier for an autonomous car that has been trained in one city and is being fine-tuned online in another city. We show that by injecting environmental perturbations that do not modify the traffic lights themselves or ground-truth labels, the adversary can ","authors_text":"Farshad Khorrami, Naman Patel, Prashanth Krishnamurthy, Siddharth Garg","cross_cats":["cs.CR"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-11-08T20:04:43Z","title":"Bait and Switch: Online Training Data Poisoning of Autonomous Driving Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2011.04065","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4f472e4eeb7ae9aa4a253c1288a9498708a8276c98c2b54792738eb35bef60ab","target":"record","created_at":"2026-07-05T01:57:21Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f28c4c43efd93d6af30e4753f4c49681570d27823c655d397500c5a6ffa3dc68","cross_cats_sorted":["cs.CR"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.LG","submitted_at":"2020-11-08T20:04:43Z","title_canon_sha256":"86ad4801bb2f22fef2ba39c92de1cfebb3a130b8906653825ce59030f7b2993a"},"schema_version":"1.0","source":{"id":"2011.04065","kind":"arxiv","version":2}},"canonical_sha256":"6a5397c91db342052ebc3c9536bc94df69128c5c8686bd0620c7b55a994bc415","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6a5397c91db342052ebc3c9536bc94df69128c5c8686bd0620c7b55a994bc415","first_computed_at":"2026-07-05T01:57:21.425013Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T01:57:21.425013Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"PknBNSl0ZOXB4ItiYXuu6azfk/8bUoQP2hjHDoKKEakLa1IhQBdkLWCCcu0ThGKuehQefneZilc72P79CFYqAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T01:57:21.425513Z","signed_message":"canonical_sha256_bytes"},"source_id":"2011.04065","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4f472e4eeb7ae9aa4a253c1288a9498708a8276c98c2b54792738eb35bef60ab","sha256:46d8fdcb652e4ac34c7cb8369a964507db2cb2d2885af00e5aaaecf4fd07c226"],"state_sha256":"8f2809a99b566926f40e4dc75b266dcee655d071700268fcba643671224e3f50"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pNyOQfHcEYUXPD74BePnyLc24kkoQyMnp6RXD8SE17cij23gRwx/brC8+DYJQPYVpshzqvd6lFSXhvWQtGkzCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T03:32:04.575013Z","bundle_sha256":"1e57156e9414e70a3b94dd9342587d68a97142d8dc675c6147b7860d3b8ee2bb"}}