{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:RGHNX25VA6LM3KLUVGXG4QM2CL","short_pith_number":"pith:RGHNX25V","canonical_record":{"source":{"id":"2503.09433","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-12T14:30:05Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cd737c875d59483d01e1fd214429d75d802383240885eefbfe0de9dcc712747e","abstract_canon_sha256":"97475def1a4cc57181e3e588e0c20642790b58516fe5f6c7d4f0461ec1b349bd"},"schema_version":"1.0"},"canonical_sha256":"898edbebb50796cda974a9ae6e419a12dceb687ab84f7d84d7ce382a83ee6d09","source":{"kind":"arxiv","id":"2503.09433","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.09433","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"arxiv_version","alias_value":"2503.09433v2","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.09433","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_12","alias_value":"RGHNX25VA6LM","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_16","alias_value":"RGHNX25VA6LM3KLU","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_8","alias_value":"RGHNX25V","created_at":"2026-07-05T10:41:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:RGHNX25VA6LM3KLUVGXG4QM2CL","target":"record","payload":{"canonical_record":{"source":{"id":"2503.09433","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-12T14:30:05Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"cd737c875d59483d01e1fd214429d75d802383240885eefbfe0de9dcc712747e","abstract_canon_sha256":"97475def1a4cc57181e3e588e0c20642790b58516fe5f6c7d4f0461ec1b349bd"},"schema_version":"1.0"},"canonical_sha256":"898edbebb50796cda974a9ae6e419a12dceb687ab84f7d84d7ce382a83ee6d09","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:41:53.348038Z","signature_b64":"Uhxbh0wD6NKqq168yCBzobEhsv3cV09iuYvsbNIGxPTAwRgDEW3X5YS4HexnjK4lgXnkT2d/3AhehDr600NxAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"898edbebb50796cda974a9ae6e419a12dceb687ab84f7d84d7ce382a83ee6d09","last_reissued_at":"2026-07-05T10:41:53.347403Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:41:53.347403Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.09433","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:41:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5uNVN7Xrfp0oWycZUfP6w/uotYLOhPFHn13jvgXzbFxYf9arPOb2kw2yj+opbzHYxeSZAojybj9iamIETd9iDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T21:17:02.790943Z"},"content_sha256":"f3df8489daecd9d50d9e6f854060c1e372dcbeba012dd5f6d4ed3e0baff53871","schema_version":"1.0","event_id":"sha256:f3df8489daecd9d50d9e6f854060c1e372dcbeba012dd5f6d4ed3e0baff53871"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:RGHNX25VA6LM3KLUVGXG4QM2CL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detection","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.SE"],"primary_cat":"cs.CR","authors_text":"Krisztofer Zolt\\'an Horv\\'at, Lucas C. Cordeiro, Mohamed Amine Ferrag, Norbert Tihanyi, Richard A. Dubniczky, Tam\\'as Bisztray","submitted_at":"2025-03-12T14:30:05Z","abstract_excerpt":"Identifying vulnerabilities in source code is crucial, especially in critical software components. Existing methods such as static analysis, dynamic analysis, formal verification, and recently Large Language Models are widely used to detect security flaws. This paper introduces CASTLE (CWE Automated Security Testing and Low-Level Evaluation), a benchmarking framework for evaluating the vulnerability detection capabilities of different methods. We assess 13 static analysis tools, 10 LLMs, and 2 formal verification tools using a hand-crafted dataset of 250 micro-benchmark programs covering 25 co"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.09433","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.09433/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:41:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LwBMkg/5rBi0HfIDizzsjxHmZz1WSiHRhz+WtdyBzKc/TZHHu8DYdFFof07aINoEEQZMzLiCmCbSK0ohy1AUDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T21:17:02.791441Z"},"content_sha256":"93a4f6e36598196c9267b7fda421cff576f58527b83440454fd49aff47551e1b","schema_version":"1.0","event_id":"sha256:93a4f6e36598196c9267b7fda421cff576f58527b83440454fd49aff47551e1b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/bundle.json","state_url":"https://pith.science/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T21:17:02Z","links":{"resolver":"https://pith.science/pith/RGHNX25VA6LM3KLUVGXG4QM2CL","bundle":"https://pith.science/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/bundle.json","state":"https://pith.science/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/RGHNX25VA6LM3KLUVGXG4QM2CL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:RGHNX25VA6LM3KLUVGXG4QM2CL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"97475def1a4cc57181e3e588e0c20642790b58516fe5f6c7d4f0461ec1b349bd","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-12T14:30:05Z","title_canon_sha256":"cd737c875d59483d01e1fd214429d75d802383240885eefbfe0de9dcc712747e"},"schema_version":"1.0","source":{"id":"2503.09433","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.09433","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"arxiv_version","alias_value":"2503.09433v2","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.09433","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_12","alias_value":"RGHNX25VA6LM","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_16","alias_value":"RGHNX25VA6LM3KLU","created_at":"2026-07-05T10:41:53Z"},{"alias_kind":"pith_short_8","alias_value":"RGHNX25V","created_at":"2026-07-05T10:41:53Z"}],"graph_snapshots":[{"event_id":"sha256:93a4f6e36598196c9267b7fda421cff576f58527b83440454fd49aff47551e1b","target":"graph","created_at":"2026-07-05T10:41:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.09433/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Identifying vulnerabilities in source code is crucial, especially in critical software components. Existing methods such as static analysis, dynamic analysis, formal verification, and recently Large Language Models are widely used to detect security flaws. This paper introduces CASTLE (CWE Automated Security Testing and Low-Level Evaluation), a benchmarking framework for evaluating the vulnerability detection capabilities of different methods. We assess 13 static analysis tools, 10 LLMs, and 2 formal verification tools using a hand-crafted dataset of 250 micro-benchmark programs covering 25 co","authors_text":"Krisztofer Zolt\\'an Horv\\'at, Lucas C. Cordeiro, Mohamed Amine Ferrag, Norbert Tihanyi, Richard A. Dubniczky, Tam\\'as Bisztray","cross_cats":["cs.AI","cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-12T14:30:05Z","title":"CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.09433","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:f3df8489daecd9d50d9e6f854060c1e372dcbeba012dd5f6d4ed3e0baff53871","target":"record","created_at":"2026-07-05T10:41:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"97475def1a4cc57181e3e588e0c20642790b58516fe5f6c7d4f0461ec1b349bd","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-12T14:30:05Z","title_canon_sha256":"cd737c875d59483d01e1fd214429d75d802383240885eefbfe0de9dcc712747e"},"schema_version":"1.0","source":{"id":"2503.09433","kind":"arxiv","version":2}},"canonical_sha256":"898edbebb50796cda974a9ae6e419a12dceb687ab84f7d84d7ce382a83ee6d09","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"898edbebb50796cda974a9ae6e419a12dceb687ab84f7d84d7ce382a83ee6d09","first_computed_at":"2026-07-05T10:41:53.347403Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:41:53.347403Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Uhxbh0wD6NKqq168yCBzobEhsv3cV09iuYvsbNIGxPTAwRgDEW3X5YS4HexnjK4lgXnkT2d/3AhehDr600NxAw==","signature_status":"signed_v1","signed_at":"2026-07-05T10:41:53.348038Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.09433","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:f3df8489daecd9d50d9e6f854060c1e372dcbeba012dd5f6d4ed3e0baff53871","sha256:93a4f6e36598196c9267b7fda421cff576f58527b83440454fd49aff47551e1b"],"state_sha256":"e58cdff508949805447d4a89f59c27718cd7aca777f39eadd31c8d4d1494dc4d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5qWpuNcPXCFCQNgenIoDi4MQI3K/6HBwpB/83yp4uK7JYHBiInPUlMl/HZpKK0qdnkfFo+i8pe5xBfOqvJDODw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T21:17:02.795508Z","bundle_sha256":"685ceb54e23af6898eef77b41dd7051afb25073f8d6e50f41fef4c154c788572"}}