{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:Q3FUIXNZNPPWTXZW5SSRSTNO2M","short_pith_number":"pith:Q3FUIXNZ","canonical_record":{"source":{"id":"1905.05897","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"stat.ML","submitted_at":"2019-05-15T00:15:01Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"5888c1b7d19d0a4b32261f0c2c75bffa4ddb224f85f344c912bc26355c56261b","abstract_canon_sha256":"ebbad9014f43c8e44234b1c06bea2a5f558f51978014f5c8bc4b154520011bef"},"schema_version":"1.0"},"canonical_sha256":"86cb445db96bdf69df36eca5194daed334262da6ff365f2d04a45227d3345e66","source":{"kind":"arxiv","id":"1905.05897","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1905.05897","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"arxiv_version","alias_value":"1905.05897v2","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1905.05897","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"pith_short_12","alias_value":"Q3FUIXNZNPPW","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"Q3FUIXNZNPPWTXZW","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"Q3FUIXNZ","created_at":"2026-05-18T12:33:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:Q3FUIXNZNPPWTXZW5SSRSTNO2M","target":"record","payload":{"canonical_record":{"source":{"id":"1905.05897","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"stat.ML","submitted_at":"2019-05-15T00:15:01Z","cross_cats_sorted":["cs.CR","cs.LG"],"title_canon_sha256":"5888c1b7d19d0a4b32261f0c2c75bffa4ddb224f85f344c912bc26355c56261b","abstract_canon_sha256":"ebbad9014f43c8e44234b1c06bea2a5f558f51978014f5c8bc4b154520011bef"},"schema_version":"1.0"},"canonical_sha256":"86cb445db96bdf69df36eca5194daed334262da6ff365f2d04a45227d3345e66","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-17T23:46:02.873094Z","signature_b64":"v0deDwvEVa71E2YHraVOwI+DJMNWoOoLAI41+BS3U6wGGm8Q8TvfazQhi7mhLGzRwf0Sd9OcevfYFwcoUBspBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"86cb445db96bdf69df36eca5194daed334262da6ff365f2d04a45227d3345e66","last_reissued_at":"2026-05-17T23:46:02.872435Z","signature_status":"signed_v1","first_computed_at":"2026-05-17T23:46:02.872435Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1905.05897","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:46:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AxkYY9yy3PYgpt0J1sPelQZPBw5fkwt7m2R6z8IQsIOjAVaWeGoaVQdXW5+D4YWBEPY13Trll6hdt2ImUzoiAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-25T19:29:10.667784Z"},"content_sha256":"4ba934dc1f9666b694f42a267c4a7e4bb39a8a5714d310f1b495411c360e4270","schema_version":"1.0","event_id":"sha256:4ba934dc1f9666b694f42a267c4a7e4bb39a8a5714d310f1b495411c360e4270"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:Q3FUIXNZNPPWTXZW5SSRSTNO2M","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Transferable Clean-Label Poisoning Attacks on Deep Neural Nets","license":"http://creativecommons.org/publicdomain/zero/1.0/","headline":"","cross_cats":["cs.CR","cs.LG"],"primary_cat":"stat.ML","authors_text":"Ali Shafahi, Chen Zhu, Christoph Studer, Gavin Taylor, Hengduo Li, Tom Goldstein, W. Ronny Huang","submitted_at":"2019-05-15T00:15:01Z","abstract_excerpt":"Clean-label poisoning attacks inject innocuous looking (and \"correctly\" labeled) poison images into training data, causing a model to misclassify a targeted image after being trained on this data. We consider transferable poisoning attacks that succeed without access to the victim network's outputs, architecture, or (in some cases) training data. To achieve this, we propose a new \"polytope attack\" in which poison images are designed to surround the targeted image in feature space. We also demonstrate that using Dropout during poison creation helps to enhance transferability of this attack. We "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1905.05897","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-17T23:46:02Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SbDB2rM1Glt3hav79VAy3/2VIA9BYGBBMROrTft+szU/RMIzQOsI5D6s4e4Ezx0zX4xnGNd621LamM2ClMXRCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-25T19:29:10.668477Z"},"content_sha256":"1295a9e9c7315e79e83579d28e286853687550d17af122371ceb0fbbfb4d5bf6","schema_version":"1.0","event_id":"sha256:1295a9e9c7315e79e83579d28e286853687550d17af122371ceb0fbbfb4d5bf6"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/bundle.json","state_url":"https://pith.science/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-25T19:29:10Z","links":{"resolver":"https://pith.science/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M","bundle":"https://pith.science/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/bundle.json","state":"https://pith.science/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/state.json","well_known_bundle":"https://pith.science/.well-known/pith/Q3FUIXNZNPPWTXZW5SSRSTNO2M/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:Q3FUIXNZNPPWTXZW5SSRSTNO2M","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ebbad9014f43c8e44234b1c06bea2a5f558f51978014f5c8bc4b154520011bef","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"stat.ML","submitted_at":"2019-05-15T00:15:01Z","title_canon_sha256":"5888c1b7d19d0a4b32261f0c2c75bffa4ddb224f85f344c912bc26355c56261b"},"schema_version":"1.0","source":{"id":"1905.05897","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1905.05897","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"arxiv_version","alias_value":"1905.05897v2","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1905.05897","created_at":"2026-05-17T23:46:02Z"},{"alias_kind":"pith_short_12","alias_value":"Q3FUIXNZNPPW","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_16","alias_value":"Q3FUIXNZNPPWTXZW","created_at":"2026-05-18T12:33:24Z"},{"alias_kind":"pith_short_8","alias_value":"Q3FUIXNZ","created_at":"2026-05-18T12:33:24Z"}],"graph_snapshots":[{"event_id":"sha256:1295a9e9c7315e79e83579d28e286853687550d17af122371ceb0fbbfb4d5bf6","target":"graph","created_at":"2026-05-17T23:46:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Clean-label poisoning attacks inject innocuous looking (and \"correctly\" labeled) poison images into training data, causing a model to misclassify a targeted image after being trained on this data. We consider transferable poisoning attacks that succeed without access to the victim network's outputs, architecture, or (in some cases) training data. To achieve this, we propose a new \"polytope attack\" in which poison images are designed to surround the targeted image in feature space. We also demonstrate that using Dropout during poison creation helps to enhance transferability of this attack. We ","authors_text":"Ali Shafahi, Chen Zhu, Christoph Studer, Gavin Taylor, Hengduo Li, Tom Goldstein, W. Ronny Huang","cross_cats":["cs.CR","cs.LG"],"headline":"","license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"stat.ML","submitted_at":"2019-05-15T00:15:01Z","title":"Transferable Clean-Label Poisoning Attacks on Deep Neural Nets"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1905.05897","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4ba934dc1f9666b694f42a267c4a7e4bb39a8a5714d310f1b495411c360e4270","target":"record","created_at":"2026-05-17T23:46:02Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ebbad9014f43c8e44234b1c06bea2a5f558f51978014f5c8bc4b154520011bef","cross_cats_sorted":["cs.CR","cs.LG"],"license":"http://creativecommons.org/publicdomain/zero/1.0/","primary_cat":"stat.ML","submitted_at":"2019-05-15T00:15:01Z","title_canon_sha256":"5888c1b7d19d0a4b32261f0c2c75bffa4ddb224f85f344c912bc26355c56261b"},"schema_version":"1.0","source":{"id":"1905.05897","kind":"arxiv","version":2}},"canonical_sha256":"86cb445db96bdf69df36eca5194daed334262da6ff365f2d04a45227d3345e66","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"86cb445db96bdf69df36eca5194daed334262da6ff365f2d04a45227d3345e66","first_computed_at":"2026-05-17T23:46:02.872435Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:46:02.872435Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"v0deDwvEVa71E2YHraVOwI+DJMNWoOoLAI41+BS3U6wGGm8Q8TvfazQhi7mhLGzRwf0Sd9OcevfYFwcoUBspBQ==","signature_status":"signed_v1","signed_at":"2026-05-17T23:46:02.873094Z","signed_message":"canonical_sha256_bytes"},"source_id":"1905.05897","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4ba934dc1f9666b694f42a267c4a7e4bb39a8a5714d310f1b495411c360e4270","sha256:1295a9e9c7315e79e83579d28e286853687550d17af122371ceb0fbbfb4d5bf6"],"state_sha256":"a9f9fda58a79baf095209ce58f88ee619557da6629578e43b248cb76f523b696"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"f2BtJbiNdgTjd+JpzVR2FSNfZAuAZl2CNpXi4XGf2xJAShcmTV8WUiDMOQMipM5B8MYNgosratciL+o+jLVQAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-25T19:29:10.672566Z","bundle_sha256":"7cb880e0f280c07222a2cbe2f970b7ae559d2901b95d5bb761a8aa681aebbbad"}}