{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:NLAONIGFAVSC2ZWFCHRUO3XXBI","short_pith_number":"pith:NLAONIGF","canonical_record":{"source":{"id":"2507.16661","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-22T14:54:57Z","cross_cats_sorted":[],"title_canon_sha256":"78d76ddecfe8b256b7faf33a5ded585d7a79cefba83a40e332c9431fadc5640d","abstract_canon_sha256":"362ddaf0fbea77e49638b1085541436bc08542223107b99290b6f9cadd467f79"},"schema_version":"1.0"},"canonical_sha256":"6ac0e6a0c505642d66c511e3476ef70a277c80841ad5723fbc6a84c9c6a47e23","source":{"kind":"arxiv","id":"2507.16661","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.16661","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"arxiv_version","alias_value":"2507.16661v1","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.16661","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_12","alias_value":"NLAONIGFAVSC","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_16","alias_value":"NLAONIGFAVSC2ZWF","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_8","alias_value":"NLAONIGF","created_at":"2026-07-05T11:41:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:NLAONIGFAVSC2ZWFCHRUO3XXBI","target":"record","payload":{"canonical_record":{"source":{"id":"2507.16661","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-22T14:54:57Z","cross_cats_sorted":[],"title_canon_sha256":"78d76ddecfe8b256b7faf33a5ded585d7a79cefba83a40e332c9431fadc5640d","abstract_canon_sha256":"362ddaf0fbea77e49638b1085541436bc08542223107b99290b6f9cadd467f79"},"schema_version":"1.0"},"canonical_sha256":"6ac0e6a0c505642d66c511e3476ef70a277c80841ad5723fbc6a84c9c6a47e23","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:41:28.712114Z","signature_b64":"7BrIp7szX6Lcm1N4C45DuRMq4qYGBIKMIXsk9VzSkk1Uub4fOEak6Zj0b3fus0p7+8iJFLitNKR/hMWvu3GzAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6ac0e6a0c505642d66c511e3476ef70a277c80841ad5723fbc6a84c9c6a47e23","last_reissued_at":"2026-07-05T11:41:28.711631Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:41:28.711631Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.16661","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:41:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9yGRVt6dvgAVgjBzeZ71Ls/+usEOD+y48cnsus5Z23QGx/iDz4AAe3f19pkoDVc/ZZAhJFSI+jxvd4zJB/jPBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T23:35:36.145262Z"},"content_sha256":"ff526d4e2e0fe252a1c2229e702c8eb0eb66446a8ca7b45193288b5cc404aaab","schema_version":"1.0","event_id":"sha256:ff526d4e2e0fe252a1c2229e702c8eb0eb66446a8ca7b45193288b5cc404aaab"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:NLAONIGFAVSC2ZWFCHRUO3XXBI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"VulCoCo: A Simple Yet Effective Method for Detecting Vulnerable Code Clones","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"David Lo, Eng Lieh Ouh, Ferdian Thung, Frank Liauw, Han Wei Ang, Lwin Khin Shar, Tan Bui, Thanh Phuc Nguyen, Ting Zhang, Yan Naing Tun, Yide Yin, Yikun Li, Yindu Su","submitted_at":"2025-07-22T14:54:57Z","abstract_excerpt":"Code reuse is common in modern software development, but it can also spread vulnerabilities when developers unknowingly copy risky code. The code fragments that preserve the logic of known vulnerabilities are known as vulnerable code clones (VCCs). Detecting those VCCs is a critical but challenging task. Existing VCC detection tools often rely on syntactic similarity or produce coarse vulnerability predictions without clear explanations, limiting their practical utility. In this paper, we propose VulCoCo, a lightweight and scalable approach that combines embedding-based retrieval with large la"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.16661","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.16661/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:41:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0jMtiuKUmCdLxd28jKryhqXo0ZBVQhaheDsCBoChL5pLUSHzcbgOjTrur6EmyOYehqcu8w+xsbkp1YRMkEyEDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T23:35:36.145802Z"},"content_sha256":"dce755cfbb10d6ebca4d2a7bcfeecc6369c4cea03d130d0c90ba911a3ea5ccab","schema_version":"1.0","event_id":"sha256:dce755cfbb10d6ebca4d2a7bcfeecc6369c4cea03d130d0c90ba911a3ea5ccab"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/bundle.json","state_url":"https://pith.science/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T23:35:36Z","links":{"resolver":"https://pith.science/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI","bundle":"https://pith.science/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/bundle.json","state":"https://pith.science/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NLAONIGFAVSC2ZWFCHRUO3XXBI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:NLAONIGFAVSC2ZWFCHRUO3XXBI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"362ddaf0fbea77e49638b1085541436bc08542223107b99290b6f9cadd467f79","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-22T14:54:57Z","title_canon_sha256":"78d76ddecfe8b256b7faf33a5ded585d7a79cefba83a40e332c9431fadc5640d"},"schema_version":"1.0","source":{"id":"2507.16661","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.16661","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"arxiv_version","alias_value":"2507.16661v1","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.16661","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_12","alias_value":"NLAONIGFAVSC","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_16","alias_value":"NLAONIGFAVSC2ZWF","created_at":"2026-07-05T11:41:28Z"},{"alias_kind":"pith_short_8","alias_value":"NLAONIGF","created_at":"2026-07-05T11:41:28Z"}],"graph_snapshots":[{"event_id":"sha256:dce755cfbb10d6ebca4d2a7bcfeecc6369c4cea03d130d0c90ba911a3ea5ccab","target":"graph","created_at":"2026-07-05T11:41:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.16661/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Code reuse is common in modern software development, but it can also spread vulnerabilities when developers unknowingly copy risky code. The code fragments that preserve the logic of known vulnerabilities are known as vulnerable code clones (VCCs). Detecting those VCCs is a critical but challenging task. Existing VCC detection tools often rely on syntactic similarity or produce coarse vulnerability predictions without clear explanations, limiting their practical utility. In this paper, we propose VulCoCo, a lightweight and scalable approach that combines embedding-based retrieval with large la","authors_text":"David Lo, Eng Lieh Ouh, Ferdian Thung, Frank Liauw, Han Wei Ang, Lwin Khin Shar, Tan Bui, Thanh Phuc Nguyen, Ting Zhang, Yan Naing Tun, Yide Yin, Yikun Li, Yindu Su","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-22T14:54:57Z","title":"VulCoCo: A Simple Yet Effective Method for Detecting Vulnerable Code Clones"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.16661","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ff526d4e2e0fe252a1c2229e702c8eb0eb66446a8ca7b45193288b5cc404aaab","target":"record","created_at":"2026-07-05T11:41:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"362ddaf0fbea77e49638b1085541436bc08542223107b99290b6f9cadd467f79","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-07-22T14:54:57Z","title_canon_sha256":"78d76ddecfe8b256b7faf33a5ded585d7a79cefba83a40e332c9431fadc5640d"},"schema_version":"1.0","source":{"id":"2507.16661","kind":"arxiv","version":1}},"canonical_sha256":"6ac0e6a0c505642d66c511e3476ef70a277c80841ad5723fbc6a84c9c6a47e23","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6ac0e6a0c505642d66c511e3476ef70a277c80841ad5723fbc6a84c9c6a47e23","first_computed_at":"2026-07-05T11:41:28.711631Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:41:28.711631Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"7BrIp7szX6Lcm1N4C45DuRMq4qYGBIKMIXsk9VzSkk1Uub4fOEak6Zj0b3fus0p7+8iJFLitNKR/hMWvu3GzAw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:41:28.712114Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.16661","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ff526d4e2e0fe252a1c2229e702c8eb0eb66446a8ca7b45193288b5cc404aaab","sha256:dce755cfbb10d6ebca4d2a7bcfeecc6369c4cea03d130d0c90ba911a3ea5ccab"],"state_sha256":"338089f04f53450a267a164e05cc3c426ba2ad130de6420c7bc64117d33dc804"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"eRzGXgEaLR/i2z9A6Vvn1jDePpjoiecZ+Ujbdi13sQgyMFQVVa7IvkgzIIB/UU4xY/eM9SXHbKocmMdPTs8ZDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T23:35:36.149241Z","bundle_sha256":"8f836c69ec087714cbba15a3ee15f3452ce140823387d27fa3aa88929e1b1e72"}}