{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:SLXIZ7BB7DBK5T26LONUK3LWUT","short_pith_number":"pith:SLXIZ7BB","canonical_record":{"source":{"id":"2506.06597","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-07T00:10:03Z","cross_cats_sorted":[],"title_canon_sha256":"8f4fc77f6205831cfb5d53384a0a3be94c4ee7d71ba74da5ccf9df436e0f3dfe","abstract_canon_sha256":"5a29885349c8e440de051283140e5a20d3647bdcef3ce4e7888fccae5dd9fab5"},"schema_version":"1.0"},"canonical_sha256":"92ee8cfc21f8c2aecf5e5b9b456d76a4ed52c2a12cfc4e78c4abb43b327884ef","source":{"kind":"arxiv","id":"2506.06597","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.06597","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"arxiv_version","alias_value":"2506.06597v2","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.06597","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_12","alias_value":"SLXIZ7BB7DBK","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_16","alias_value":"SLXIZ7BB7DBK5T26","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_8","alias_value":"SLXIZ7BB","created_at":"2026-06-30T01:17:23Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:SLXIZ7BB7DBK5T26LONUK3LWUT","target":"record","payload":{"canonical_record":{"source":{"id":"2506.06597","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-07T00:10:03Z","cross_cats_sorted":[],"title_canon_sha256":"8f4fc77f6205831cfb5d53384a0a3be94c4ee7d71ba74da5ccf9df436e0f3dfe","abstract_canon_sha256":"5a29885349c8e440de051283140e5a20d3647bdcef3ce4e7888fccae5dd9fab5"},"schema_version":"1.0"},"canonical_sha256":"92ee8cfc21f8c2aecf5e5b9b456d76a4ed52c2a12cfc4e78c4abb43b327884ef","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-30T01:17:23.637774Z","signature_b64":"UdGunuYS8olTP2G72XCSgOv/QSdvu+AkhFqjIT2RAhonY6750nqrHbCgGkoHrSLaqTFr/QOVNFnseHGS/mM9Bg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"92ee8cfc21f8c2aecf5e5b9b456d76a4ed52c2a12cfc4e78c4abb43b327884ef","last_reissued_at":"2026-06-30T01:17:23.637122Z","signature_status":"signed_v1","first_computed_at":"2026-06-30T01:17:23.637122Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.06597","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-30T01:17:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZlAwQ6s4ng3jvjiBbi4dLNMYuphseM4Q1VNzhq54bhJL7JhmGn3fF2oJ0LCSjARcu2I8PNfiricVjiJ4EqjtDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T23:14:40.795736Z"},"content_sha256":"0a2b0712652bb71ed8af9c6dea21f67c3d38f86bc55b7704172dc27b8dfb5877","schema_version":"1.0","event_id":"sha256:0a2b0712652bb71ed8af9c6dea21f67c3d38f86bc55b7704172dc27b8dfb5877"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:SLXIZ7BB7DBK5T26LONUK3LWUT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"No TPU Left Behind: Retrofitting Side-Channel Protection into Edge TPUs","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Anuj Dubey, Ashley Kurian, Aydin Aysu, Modini Ayyagari","submitted_at":"2025-06-07T00:10:03Z","abstract_excerpt":"Side-channel attacks can recover neural network parameters from physical signals, even on commercial edge accelerators. Existing defenses require changes to hardware, instruction set, or compiler, and cannot be deployed on fixed-function platforms such as TPUs. We present the first training-time defense that protects models on off-the-shelf TPUs without modifying the hardware or firmware. Our approach trains multiple functionally equivalent parameter versions per layer and randomly composes them at inference. This reduces the correlation that side-channel attacks rely on while preserving model"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.06597","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.06597/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-30T01:17:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"xJWLKC33zfL2sASSvQs5DmiKvbmO1CR5gtv5+OFuW/B4XEpH6UgXm8s8IDUb4YMuCNJMKj1VCDmF/KYlDgQtBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T23:14:40.796380Z"},"content_sha256":"64eb06d0fff6b4f1904e2250cac78661692c064d6a08c6a46da0e444e4b4e7aa","schema_version":"1.0","event_id":"sha256:64eb06d0fff6b4f1904e2250cac78661692c064d6a08c6a46da0e444e4b4e7aa"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/bundle.json","state_url":"https://pith.science/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T23:14:40Z","links":{"resolver":"https://pith.science/pith/SLXIZ7BB7DBK5T26LONUK3LWUT","bundle":"https://pith.science/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/bundle.json","state":"https://pith.science/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SLXIZ7BB7DBK5T26LONUK3LWUT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:SLXIZ7BB7DBK5T26LONUK3LWUT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"5a29885349c8e440de051283140e5a20d3647bdcef3ce4e7888fccae5dd9fab5","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-07T00:10:03Z","title_canon_sha256":"8f4fc77f6205831cfb5d53384a0a3be94c4ee7d71ba74da5ccf9df436e0f3dfe"},"schema_version":"1.0","source":{"id":"2506.06597","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.06597","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"arxiv_version","alias_value":"2506.06597v2","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.06597","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_12","alias_value":"SLXIZ7BB7DBK","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_16","alias_value":"SLXIZ7BB7DBK5T26","created_at":"2026-06-30T01:17:23Z"},{"alias_kind":"pith_short_8","alias_value":"SLXIZ7BB","created_at":"2026-06-30T01:17:23Z"}],"graph_snapshots":[{"event_id":"sha256:64eb06d0fff6b4f1904e2250cac78661692c064d6a08c6a46da0e444e4b4e7aa","target":"graph","created_at":"2026-06-30T01:17:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.06597/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Side-channel attacks can recover neural network parameters from physical signals, even on commercial edge accelerators. Existing defenses require changes to hardware, instruction set, or compiler, and cannot be deployed on fixed-function platforms such as TPUs. We present the first training-time defense that protects models on off-the-shelf TPUs without modifying the hardware or firmware. Our approach trains multiple functionally equivalent parameter versions per layer and randomly composes them at inference. This reduces the correlation that side-channel attacks rely on while preserving model","authors_text":"Anuj Dubey, Ashley Kurian, Aydin Aysu, Modini Ayyagari","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-07T00:10:03Z","title":"No TPU Left Behind: Retrofitting Side-Channel Protection into Edge TPUs"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.06597","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:0a2b0712652bb71ed8af9c6dea21f67c3d38f86bc55b7704172dc27b8dfb5877","target":"record","created_at":"2026-06-30T01:17:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"5a29885349c8e440de051283140e5a20d3647bdcef3ce4e7888fccae5dd9fab5","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-07T00:10:03Z","title_canon_sha256":"8f4fc77f6205831cfb5d53384a0a3be94c4ee7d71ba74da5ccf9df436e0f3dfe"},"schema_version":"1.0","source":{"id":"2506.06597","kind":"arxiv","version":2}},"canonical_sha256":"92ee8cfc21f8c2aecf5e5b9b456d76a4ed52c2a12cfc4e78c4abb43b327884ef","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"92ee8cfc21f8c2aecf5e5b9b456d76a4ed52c2a12cfc4e78c4abb43b327884ef","first_computed_at":"2026-06-30T01:17:23.637122Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-30T01:17:23.637122Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UdGunuYS8olTP2G72XCSgOv/QSdvu+AkhFqjIT2RAhonY6750nqrHbCgGkoHrSLaqTFr/QOVNFnseHGS/mM9Bg==","signature_status":"signed_v1","signed_at":"2026-06-30T01:17:23.637774Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.06597","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:0a2b0712652bb71ed8af9c6dea21f67c3d38f86bc55b7704172dc27b8dfb5877","sha256:64eb06d0fff6b4f1904e2250cac78661692c064d6a08c6a46da0e444e4b4e7aa"],"state_sha256":"bfcb0556a840d2d88f1b119d39045b58544b977838d5de8a17f3075df7ab0450"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZRE+9zOstZzl90XiiQaVKQiGHWpk8GjwAEcQBuIph5ZJGhAYXy//YDoOHGMbIbNjZrlmoAbZ+jx1CrmrcCdDAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T23:14:40.800272Z","bundle_sha256":"69dfd94bead141fb302bafa5e2db64a484e5c49213ed625991d4dfc6c32f9eb9"}}