{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:TUEFPBYWLNH2DCK5CNJZ4WINH7","short_pith_number":"pith:TUEFPBYW","canonical_record":{"source":{"id":"2507.18105","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-24T05:30:54Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"fa54a89dbdba0c88aa9f8f9395b28faa9136f266548012441a8d6f8729bd61b8","abstract_canon_sha256":"005f7c566b6d5b819c22cc26734e634f1dee5b42b7e2b1df8302d9a5535e395d"},"schema_version":"1.0"},"canonical_sha256":"9d085787165b4fa1895d13539e590d3ffaf382b2d068817089715ebbf5964919","source":{"kind":"arxiv","id":"2507.18105","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.18105","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"arxiv_version","alias_value":"2507.18105v1","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.18105","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_12","alias_value":"TUEFPBYWLNH2","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_16","alias_value":"TUEFPBYWLNH2DCK5","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_8","alias_value":"TUEFPBYW","created_at":"2026-07-05T11:42:41Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:TUEFPBYWLNH2DCK5CNJZ4WINH7","target":"record","payload":{"canonical_record":{"source":{"id":"2507.18105","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-24T05:30:54Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"fa54a89dbdba0c88aa9f8f9395b28faa9136f266548012441a8d6f8729bd61b8","abstract_canon_sha256":"005f7c566b6d5b819c22cc26734e634f1dee5b42b7e2b1df8302d9a5535e395d"},"schema_version":"1.0"},"canonical_sha256":"9d085787165b4fa1895d13539e590d3ffaf382b2d068817089715ebbf5964919","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:42:41.623626Z","signature_b64":"9J2shhSSXNLSmMJpPMalZ/1N2gzwDZz/Q+WwFdjAKVEiE0MGyHPp/RHTw16Oz1X5cuVvyYJEQhLs5Fo1FBt6AA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9d085787165b4fa1895d13539e590d3ffaf382b2d068817089715ebbf5964919","last_reissued_at":"2026-07-05T11:42:41.623146Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:42:41.623146Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.18105","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:42:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"j5ff+KdZlyxBRK5bKg9REWedCX4QsM4YgolVRwOLy+55FqQJg4I3Dr57SSZXFaUWbk7oc7ls7JMEC9Agy9UJAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T05:01:17.510519Z"},"content_sha256":"ab0acf6e36936a032dcee108f3b6a0c4f7269a9e46fe858fb34fec0499bc0b66","schema_version":"1.0","event_id":"sha256:ab0acf6e36936a032dcee108f3b6a0c4f7269a9e46fe858fb34fec0499bc0b66"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:TUEFPBYWLNH2DCK5CNJZ4WINH7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Understanding the Supply Chain and Risks of Large Language Model Applications","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.SE","authors_text":"Jiongchi Yu, Lili Quan, Qiang Hu, Sen Chen, Xiaofei Xie, Yao Zhang, Yujie Ma","submitted_at":"2025-07-24T05:30:54Z","abstract_excerpt":"The rise of Large Language Models (LLMs) has led to the widespread deployment of LLM-based systems across diverse domains. As these systems proliferate, understanding the risks associated with their complex supply chains is increasingly important. LLM-based systems are not standalone as they rely on interconnected supply chains involving pretrained models, third-party libraries, datasets, and infrastructure. Yet, most risk assessments narrowly focus on model or data level, overlooking broader supply chain vulnerabilities. While recent studies have begun to address LLM supply chain risks, there"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.18105","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.18105/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:42:41Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3ECu+cLmAg8EAPTLEX/i4WRu1S+/adE0NvpCHx+3ZQor6s7tZj0HtZKKPwkKzBEnUgG8f937aCkxdXCXAs7qCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T05:01:17.511103Z"},"content_sha256":"063db7a19401a189e06e0f79a1fe9a2dd1a827a5d553ff2bbbbf3059cbc07635","schema_version":"1.0","event_id":"sha256:063db7a19401a189e06e0f79a1fe9a2dd1a827a5d553ff2bbbbf3059cbc07635"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/bundle.json","state_url":"https://pith.science/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T05:01:17Z","links":{"resolver":"https://pith.science/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7","bundle":"https://pith.science/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/bundle.json","state":"https://pith.science/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/TUEFPBYWLNH2DCK5CNJZ4WINH7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:TUEFPBYWLNH2DCK5CNJZ4WINH7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"005f7c566b6d5b819c22cc26734e634f1dee5b42b7e2b1df8302d9a5535e395d","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-24T05:30:54Z","title_canon_sha256":"fa54a89dbdba0c88aa9f8f9395b28faa9136f266548012441a8d6f8729bd61b8"},"schema_version":"1.0","source":{"id":"2507.18105","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.18105","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"arxiv_version","alias_value":"2507.18105v1","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.18105","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_12","alias_value":"TUEFPBYWLNH2","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_16","alias_value":"TUEFPBYWLNH2DCK5","created_at":"2026-07-05T11:42:41Z"},{"alias_kind":"pith_short_8","alias_value":"TUEFPBYW","created_at":"2026-07-05T11:42:41Z"}],"graph_snapshots":[{"event_id":"sha256:063db7a19401a189e06e0f79a1fe9a2dd1a827a5d553ff2bbbbf3059cbc07635","target":"graph","created_at":"2026-07-05T11:42:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.18105/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The rise of Large Language Models (LLMs) has led to the widespread deployment of LLM-based systems across diverse domains. As these systems proliferate, understanding the risks associated with their complex supply chains is increasingly important. LLM-based systems are not standalone as they rely on interconnected supply chains involving pretrained models, third-party libraries, datasets, and infrastructure. Yet, most risk assessments narrowly focus on model or data level, overlooking broader supply chain vulnerabilities. While recent studies have begun to address LLM supply chain risks, there","authors_text":"Jiongchi Yu, Lili Quan, Qiang Hu, Sen Chen, Xiaofei Xie, Yao Zhang, Yujie Ma","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-24T05:30:54Z","title":"Understanding the Supply Chain and Risks of Large Language Model Applications"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.18105","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ab0acf6e36936a032dcee108f3b6a0c4f7269a9e46fe858fb34fec0499bc0b66","target":"record","created_at":"2026-07-05T11:42:41Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"005f7c566b6d5b819c22cc26734e634f1dee5b42b7e2b1df8302d9a5535e395d","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-07-24T05:30:54Z","title_canon_sha256":"fa54a89dbdba0c88aa9f8f9395b28faa9136f266548012441a8d6f8729bd61b8"},"schema_version":"1.0","source":{"id":"2507.18105","kind":"arxiv","version":1}},"canonical_sha256":"9d085787165b4fa1895d13539e590d3ffaf382b2d068817089715ebbf5964919","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9d085787165b4fa1895d13539e590d3ffaf382b2d068817089715ebbf5964919","first_computed_at":"2026-07-05T11:42:41.623146Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:42:41.623146Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"9J2shhSSXNLSmMJpPMalZ/1N2gzwDZz/Q+WwFdjAKVEiE0MGyHPp/RHTw16Oz1X5cuVvyYJEQhLs5Fo1FBt6AA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:42:41.623626Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.18105","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ab0acf6e36936a032dcee108f3b6a0c4f7269a9e46fe858fb34fec0499bc0b66","sha256:063db7a19401a189e06e0f79a1fe9a2dd1a827a5d553ff2bbbbf3059cbc07635"],"state_sha256":"c4eb7262bffb3d47c1b741ada5caccbdf046ec41ecf3e0c5c00ae85803d88c3e"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YB8upyJb61YO+CBKEOg7EX3nGEqbf8GzMXzVDwbQFTOGPDKn21zxG9Knsf69MGU7FUvAfIE9FxCsdjDvTLa1AA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T05:01:17.517838Z","bundle_sha256":"d3e12fe6e41d9ac18a025c153c1ce4cc99316b3e8395f357d869ac22090dd744"}}