{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2020:W6FXERCQ6PFVMMWQTJJVIFRRZD","short_pith_number":"pith:W6FXERCQ","canonical_record":{"source":{"id":"2005.10884","kind":"arxiv","version":5},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2020-05-17T03:38:34Z","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"title_canon_sha256":"a473c84f2d74b904b912d06d1f7c17c1a839bcdc2ff75c68627a10e16c6f01e7","abstract_canon_sha256":"d168abafb905d0f7789bcd97e84075fbb0a416d82286f767368bd35919f06b8d"},"schema_version":"1.0"},"canonical_sha256":"b78b724450f3cb5632d09a53541631c8ecfe89b8f8c341e592853f53ab0675ff","source":{"kind":"arxiv","id":"2005.10884","version":5},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2005.10884","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"arxiv_version","alias_value":"2005.10884v5","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2005.10884","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_12","alias_value":"W6FXERCQ6PFV","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_16","alias_value":"W6FXERCQ6PFVMMWQ","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_8","alias_value":"W6FXERCQ","created_at":"2026-07-05T02:28:04Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2020:W6FXERCQ6PFVMMWQTJJVIFRRZD","target":"record","payload":{"canonical_record":{"source":{"id":"2005.10884","kind":"arxiv","version":5},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2020-05-17T03:38:34Z","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"title_canon_sha256":"a473c84f2d74b904b912d06d1f7c17c1a839bcdc2ff75c68627a10e16c6f01e7","abstract_canon_sha256":"d168abafb905d0f7789bcd97e84075fbb0a416d82286f767368bd35919f06b8d"},"schema_version":"1.0"},"canonical_sha256":"b78b724450f3cb5632d09a53541631c8ecfe89b8f8c341e592853f53ab0675ff","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:28:04.759793Z","signature_b64":"nABjoWzSMSYuiwzt0cwHDY24FUm2ZJSZDsSyRr7ekJmJKh8OcA7Kb76vUi7Gzv+dlDUVo8CwajIwEvvhIxsJDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b78b724450f3cb5632d09a53541631c8ecfe89b8f8c341e592853f53ab0675ff","last_reissued_at":"2026-07-05T02:28:04.759364Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:28:04.759364Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2005.10884","source_version":5,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:28:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8Qe7UE5PNO3lpgD+G+jfQtNGzm3t+219QBXRU02/C+e9VNdECtvL6K8N7+J1me02BhaRLtzdWtERe4HM1HydBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T07:42:20.817128Z"},"content_sha256":"21ac8770a6166f9c10c18f0bb7802ad78b8b3d2c5f77b05424218209231204c2","schema_version":"1.0","event_id":"sha256:21ac8770a6166f9c10c18f0bb7802ad78b8b3d2c5f77b05424218209231204c2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2020:W6FXERCQ6PFVMMWQTJJVIFRRZD","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.CR","cs.LG","stat.ML"],"primary_cat":"cs.CV","authors_text":"Arjun Nitin Bhagoji, Chong Xiang, Prateek Mittal, Vikash Sehwag","submitted_at":"2020-05-17T03:38:34Z","abstract_excerpt":"Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with sma"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2005.10884","kind":"arxiv","version":5},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2005.10884/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:28:04Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0ebENtWP3vfrRtg6tInAUbEVOyyU651M4PKtLOxsvCPZTN8l22S2gR3SXWfLK6+JZKoVRhnAGFttdmHLj9VwAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T07:42:20.817762Z"},"content_sha256":"0b29342451650db807a84ec21e6e077940ca8712c469e8078dd68e99793d97f3","schema_version":"1.0","event_id":"sha256:0b29342451650db807a84ec21e6e077940ca8712c469e8078dd68e99793d97f3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/bundle.json","state_url":"https://pith.science/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T07:42:20Z","links":{"resolver":"https://pith.science/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD","bundle":"https://pith.science/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/bundle.json","state":"https://pith.science/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/state.json","well_known_bundle":"https://pith.science/.well-known/pith/W6FXERCQ6PFVMMWQTJJVIFRRZD/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2020:W6FXERCQ6PFVMMWQTJJVIFRRZD","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d168abafb905d0f7789bcd97e84075fbb0a416d82286f767368bd35919f06b8d","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2020-05-17T03:38:34Z","title_canon_sha256":"a473c84f2d74b904b912d06d1f7c17c1a839bcdc2ff75c68627a10e16c6f01e7"},"schema_version":"1.0","source":{"id":"2005.10884","kind":"arxiv","version":5}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2005.10884","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"arxiv_version","alias_value":"2005.10884v5","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2005.10884","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_12","alias_value":"W6FXERCQ6PFV","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_16","alias_value":"W6FXERCQ6PFVMMWQ","created_at":"2026-07-05T02:28:04Z"},{"alias_kind":"pith_short_8","alias_value":"W6FXERCQ","created_at":"2026-07-05T02:28:04Z"}],"graph_snapshots":[{"event_id":"sha256:0b29342451650db807a84ec21e6e077940ca8712c469e8078dd68e99793d97f3","target":"graph","created_at":"2026-07-05T02:28:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2005.10884/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with sma","authors_text":"Arjun Nitin Bhagoji, Chong Xiang, Prateek Mittal, Vikash Sehwag","cross_cats":["cs.CR","cs.LG","stat.ML"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2020-05-17T03:38:34Z","title":"PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2005.10884","kind":"arxiv","version":5},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:21ac8770a6166f9c10c18f0bb7802ad78b8b3d2c5f77b05424218209231204c2","target":"record","created_at":"2026-07-05T02:28:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d168abafb905d0f7789bcd97e84075fbb0a416d82286f767368bd35919f06b8d","cross_cats_sorted":["cs.CR","cs.LG","stat.ML"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CV","submitted_at":"2020-05-17T03:38:34Z","title_canon_sha256":"a473c84f2d74b904b912d06d1f7c17c1a839bcdc2ff75c68627a10e16c6f01e7"},"schema_version":"1.0","source":{"id":"2005.10884","kind":"arxiv","version":5}},"canonical_sha256":"b78b724450f3cb5632d09a53541631c8ecfe89b8f8c341e592853f53ab0675ff","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b78b724450f3cb5632d09a53541631c8ecfe89b8f8c341e592853f53ab0675ff","first_computed_at":"2026-07-05T02:28:04.759364Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:28:04.759364Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"nABjoWzSMSYuiwzt0cwHDY24FUm2ZJSZDsSyRr7ekJmJKh8OcA7Kb76vUi7Gzv+dlDUVo8CwajIwEvvhIxsJDA==","signature_status":"signed_v1","signed_at":"2026-07-05T02:28:04.759793Z","signed_message":"canonical_sha256_bytes"},"source_id":"2005.10884","source_kind":"arxiv","source_version":5}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:21ac8770a6166f9c10c18f0bb7802ad78b8b3d2c5f77b05424218209231204c2","sha256:0b29342451650db807a84ec21e6e077940ca8712c469e8078dd68e99793d97f3"],"state_sha256":"60bcf3bee2582e5467171513c1050a318db25de2b9c195abd6647b0479aafcb1"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lgrqiIAwLkzi0Q1Vct7Q4y4j932HAdwEIFJTR4nf9uRqOa2Aj+qFDZhW0elxeca4E760EvkScaXuv8a221DvCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T07:42:20.822360Z","bundle_sha256":"e658e362cfb8a6afbd3fc57603d8874db29b2fdda2051043fdac06ba4b5f544c"}}