{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:R3XMRUKHMLMJTUGON3PV4YMHTJ","short_pith_number":"pith:R3XMRUKH","schema_version":"1.0","canonical_sha256":"8eeec8d14762d899d0ce6edf5e61879a46d5228f107a74c930c88d4a99bb960f","source":{"kind":"arxiv","id":"2509.07540","version":1},"attestation_state":"computed","paper":{"title":"PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Anh Tuan Nguyen, David Lo, Frank Liauw, Han Wei Ang, Huu Hung Nguyen, Ouh Eng Lieh, Shar Lwin Khin, Thanh Le-Cong, Ting Zhang, Yide Yin, Yikun Li","submitted_at":"2025-09-09T09:16:45Z","abstract_excerpt":"Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database (NVD) is the authoritative source for cataloging these vulnerabilities, it often lacks explicit links to the corresponding Vulnerability-Fixing Commits (VFCs). VFCs encode precise code changes, enabling vulnerability localization, patch analysis, and dataset construction. Automatically mapping NVD records to their true VFCs is therefore critical. Existing approaches have limitations as they rely on sparse, often noisy commit messages and fail to capture the deep semantics in the"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2509.07540","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.SE","submitted_at":"2025-09-09T09:16:45Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c61a3236da62a905b46524c8e62d8dea7875548085298987ec708fec0117a33b","abstract_canon_sha256":"e7d333f8c483f9f018fe48d6bfc6ba26f75875be7b258e4c78108f12729ab452"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:07:23.589173Z","signature_b64":"sXf2o+BObauAy29hFZfkIUMumfNJ68j0qsFrBgOoLSPOlR2DiKYwi5R7wxh15bTdJbgcmmOwl9TLdN38iG1iDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"8eeec8d14762d899d0ce6edf5e61879a46d5228f107a74c930c88d4a99bb960f","last_reissued_at":"2026-07-05T12:07:23.588658Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:07:23.588658Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Anh Tuan Nguyen, David Lo, Frank Liauw, Han Wei Ang, Huu Hung Nguyen, Ouh Eng Lieh, Shar Lwin Khin, Thanh Le-Cong, Ting Zhang, Yide Yin, Yikun Li","submitted_at":"2025-09-09T09:16:45Z","abstract_excerpt":"Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database (NVD) is the authoritative source for cataloging these vulnerabilities, it often lacks explicit links to the corresponding Vulnerability-Fixing Commits (VFCs). VFCs encode precise code changes, enabling vulnerability localization, patch analysis, and dataset construction. Automatically mapping NVD records to their true VFCs is therefore critical. Existing approaches have limitations as they rely on sparse, often noisy commit messages and fail to capture the deep semantics in the"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.07540","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.07540/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2509.07540","created_at":"2026-07-05T12:07:23.588722+00:00"},{"alias_kind":"arxiv_version","alias_value":"2509.07540v1","created_at":"2026-07-05T12:07:23.588722+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.07540","created_at":"2026-07-05T12:07:23.588722+00:00"},{"alias_kind":"pith_short_12","alias_value":"R3XMRUKHMLMJ","created_at":"2026-07-05T12:07:23.588722+00:00"},{"alias_kind":"pith_short_16","alias_value":"R3XMRUKHMLMJTUGO","created_at":"2026-07-05T12:07:23.588722+00:00"},{"alias_kind":"pith_short_8","alias_value":"R3XMRUKH","created_at":"2026-07-05T12:07:23.588722+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":1,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.22704","citing_title":"VeriPort: Automated and Verified Patch Backporting at Scale","ref_index":31,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ","json":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ.json","graph_json":"https://pith.science/api/pith-number/R3XMRUKHMLMJTUGON3PV4YMHTJ/graph.json","events_json":"https://pith.science/api/pith-number/R3XMRUKHMLMJTUGON3PV4YMHTJ/events.json","paper":"https://pith.science/paper/R3XMRUKH"},"agent_actions":{"view_html":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ","download_json":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ.json","view_paper":"https://pith.science/paper/R3XMRUKH","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2509.07540&json=true","fetch_graph":"https://pith.science/api/pith-number/R3XMRUKHMLMJTUGON3PV4YMHTJ/graph.json","fetch_events":"https://pith.science/api/pith-number/R3XMRUKHMLMJTUGON3PV4YMHTJ/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ/action/timestamp_anchor","attest_storage":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ/action/storage_attestation","attest_author":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ/action/author_attestation","sign_citation":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ/action/citation_signature","submit_replication":"https://pith.science/pith/R3XMRUKHMLMJTUGON3PV4YMHTJ/action/replication_record"}},"created_at":"2026-07-05T12:07:23.588722+00:00","updated_at":"2026-07-05T12:07:23.588722+00:00"}