{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:OU4QH754Z7PJNWNSVL6FTDRZGU","short_pith_number":"pith:OU4QH754","canonical_record":{"source":{"id":"2201.04845","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-13T09:19:25Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"f5316b4f3863bf0ab3a43a02cff4541bd671412772e37bf3a81b46d170b57c42","abstract_canon_sha256":"b93fb731723edb3c8f77d60bd85cc82bb456470d9e80fd568390f1d4a4ff554f"},"schema_version":"1.0"},"canonical_sha256":"753903ffbccfde96d9b2aafc598e393517d6d4f577f41804ac6e1be92141a882","source":{"kind":"arxiv","id":"2201.04845","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2201.04845","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"arxiv_version","alias_value":"2201.04845v2","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2201.04845","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_12","alias_value":"OU4QH754Z7PJ","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_16","alias_value":"OU4QH754Z7PJNWNS","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_8","alias_value":"OU4QH754","created_at":"2026-07-05T04:17:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:OU4QH754Z7PJNWNSVL6FTDRZGU","target":"record","payload":{"canonical_record":{"source":{"id":"2201.04845","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-13T09:19:25Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"f5316b4f3863bf0ab3a43a02cff4541bd671412772e37bf3a81b46d170b57c42","abstract_canon_sha256":"b93fb731723edb3c8f77d60bd85cc82bb456470d9e80fd568390f1d4a4ff554f"},"schema_version":"1.0"},"canonical_sha256":"753903ffbccfde96d9b2aafc598e393517d6d4f577f41804ac6e1be92141a882","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:17:20.105022Z","signature_b64":"F3lMxLYElaAthBd8rZxoXThhXtwDLxoCRAaHbXr6AzDBuHPvJ66uO9MtSSYryA1prWw3fEY917QtzkOuZbuYCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"753903ffbccfde96d9b2aafc598e393517d6d4f577f41804ac6e1be92141a882","last_reissued_at":"2026-07-05T04:17:20.104631Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:17:20.104631Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2201.04845","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:17:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"u50k2PROy/l+XxQgSQxVzrVtFLmuKN4LpUTfee5vx30CJQud5D1lbJVzZH5mqPgOIk/BHo9QyCUmpnVg6mPdDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-08T13:56:46.147670Z"},"content_sha256":"b74f6293bc4f5f87895144f84ee646b28d674a7e38db7101cdecfae820684056","schema_version":"1.0","event_id":"sha256:b74f6293bc4f5f87895144f84ee646b28d674a7e38db7101cdecfae820684056"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:OU4QH754Z7PJNWNSVL6FTDRZGU","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Reconstructing Training Data with Informed Adversaries","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Borja Balle, Giovanni Cherubin, Jamie Hayes","submitted_at":"2022-01-13T09:19:25Z","abstract_excerpt":"Given access to a machine learning model, can an adversary reconstruct the model's training data? This work studies this question from the lens of a powerful informed adversary who knows all the training data points except one. By instantiating concrete attacks, we show it is feasible to reconstruct the remaining data point in this stringent threat model. For convex models (e.g. logistic regression), reconstruction attacks are simple and can be derived in closed-form. For more general models (e.g. neural networks), we propose an attack strategy based on training a reconstructor network that re"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2201.04845","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2201.04845/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:17:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fHcuJQdu4l0fvIczgHaiMZaAMLzRUdVy5lDUCmJ9beGJnJHF7yxpinHiBdPaVYnYWmpNq3orBWRwx8BbCP/WCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-08T13:56:46.148068Z"},"content_sha256":"5cbca0b3d63fdde8328c5614d79c47f11d17359675140257d446191cddbf23cc","schema_version":"1.0","event_id":"sha256:5cbca0b3d63fdde8328c5614d79c47f11d17359675140257d446191cddbf23cc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/bundle.json","state_url":"https://pith.science/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-08T13:56:46Z","links":{"resolver":"https://pith.science/pith/OU4QH754Z7PJNWNSVL6FTDRZGU","bundle":"https://pith.science/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/bundle.json","state":"https://pith.science/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OU4QH754Z7PJNWNSVL6FTDRZGU/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:OU4QH754Z7PJNWNSVL6FTDRZGU","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"b93fb731723edb3c8f77d60bd85cc82bb456470d9e80fd568390f1d4a4ff554f","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-13T09:19:25Z","title_canon_sha256":"f5316b4f3863bf0ab3a43a02cff4541bd671412772e37bf3a81b46d170b57c42"},"schema_version":"1.0","source":{"id":"2201.04845","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2201.04845","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"arxiv_version","alias_value":"2201.04845v2","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2201.04845","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_12","alias_value":"OU4QH754Z7PJ","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_16","alias_value":"OU4QH754Z7PJNWNS","created_at":"2026-07-05T04:17:20Z"},{"alias_kind":"pith_short_8","alias_value":"OU4QH754","created_at":"2026-07-05T04:17:20Z"}],"graph_snapshots":[{"event_id":"sha256:5cbca0b3d63fdde8328c5614d79c47f11d17359675140257d446191cddbf23cc","target":"graph","created_at":"2026-07-05T04:17:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2201.04845/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Given access to a machine learning model, can an adversary reconstruct the model's training data? This work studies this question from the lens of a powerful informed adversary who knows all the training data points except one. By instantiating concrete attacks, we show it is feasible to reconstruct the remaining data point in this stringent threat model. For convex models (e.g. logistic regression), reconstruction attacks are simple and can be derived in closed-form. For more general models (e.g. neural networks), we propose an attack strategy based on training a reconstructor network that re","authors_text":"Borja Balle, Giovanni Cherubin, Jamie Hayes","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-13T09:19:25Z","title":"Reconstructing Training Data with Informed Adversaries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2201.04845","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b74f6293bc4f5f87895144f84ee646b28d674a7e38db7101cdecfae820684056","target":"record","created_at":"2026-07-05T04:17:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"b93fb731723edb3c8f77d60bd85cc82bb456470d9e80fd568390f1d4a4ff554f","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-13T09:19:25Z","title_canon_sha256":"f5316b4f3863bf0ab3a43a02cff4541bd671412772e37bf3a81b46d170b57c42"},"schema_version":"1.0","source":{"id":"2201.04845","kind":"arxiv","version":2}},"canonical_sha256":"753903ffbccfde96d9b2aafc598e393517d6d4f577f41804ac6e1be92141a882","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"753903ffbccfde96d9b2aafc598e393517d6d4f577f41804ac6e1be92141a882","first_computed_at":"2026-07-05T04:17:20.104631Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:17:20.104631Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"F3lMxLYElaAthBd8rZxoXThhXtwDLxoCRAaHbXr6AzDBuHPvJ66uO9MtSSYryA1prWw3fEY917QtzkOuZbuYCg==","signature_status":"signed_v1","signed_at":"2026-07-05T04:17:20.105022Z","signed_message":"canonical_sha256_bytes"},"source_id":"2201.04845","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b74f6293bc4f5f87895144f84ee646b28d674a7e38db7101cdecfae820684056","sha256:5cbca0b3d63fdde8328c5614d79c47f11d17359675140257d446191cddbf23cc"],"state_sha256":"f8d67fc8eb883521091ed1a5c9207520c1d8b2d05c2d450780db1ef59eb52435"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BWynCJ96ZxkQARvRr554tS45S3nNLAGY+nvPMEQy1Aizpq/AYCbUt1abh+BVK6sJVtKNDAe3fCOC5H8ATNIsBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-08T13:56:46.150228Z","bundle_sha256":"ecf1bdb4be2ce14c05ab99398fddf941671d74ed03bd9bdbb373dfe6db90e1a2"}}