{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:XD6Q4FEKWB4JIVGQIH3EB2EO6V","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f50acd9c232342165d0d9cfc261dee76c5f5119a2ab62cbf1a1533fb34355fce","cross_cats_sorted":["cs.MM"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-03-05T16:06:41Z","title_canon_sha256":"816e485db619764ef4103748f4e4e17c3a9a1fe1572e27bffd10ac5ab09aa740"},"schema_version":"1.0","source":{"id":"2203.02777","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2203.02777","created_at":"2026-07-05T04:02:27Z"},{"alias_kind":"arxiv_version","alias_value":"2203.02777v1","created_at":"2026-07-05T04:02:27Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2203.02777","created_at":"2026-07-05T04:02:27Z"},{"alias_kind":"pith_short_12","alias_value":"XD6Q4FEKWB4J","created_at":"2026-07-05T04:02:27Z"},{"alias_kind":"pith_short_16","alias_value":"XD6Q4FEKWB4JIVGQ","created_at":"2026-07-05T04:02:27Z"},{"alias_kind":"pith_short_8","alias_value":"XD6Q4FEK","created_at":"2026-07-05T04:02:27Z"}],"graph_snapshots":[{"event_id":"sha256:1b62ced54062cfe64696a0b143cd70c306ce11d2b3298d1407495e540f63dd31","target":"graph","created_at":"2026-07-05T04:02:27Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2203.02777/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Many model watermarking methods have been developed to prevent valuable deployed commercial models from being stealthily stolen by model distillations. However, watermarks produced by most existing model watermarking methods can be easily evaded by ensemble distillation, because averaging the outputs of multiple ensembled models can significantly reduce or even erase the watermarks. In this paper, we focus on tackling the challenging task of defending against ensemble distillation. We propose a novel watermarking technique named CosWM to achieve outstanding model watermarking performance again","authors_text":"Jian Pei, Lanjun Wang, Laurent Charette, Lingyang Chu, Yizhou Chen, Yong Zhang","cross_cats":["cs.MM"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-03-05T16:06:41Z","title":"Cosine Model Watermarking Against Ensemble Distillation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2203.02777","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2c2d5d2fe9c7061b3342dcbfa3602d2ed52ac8a74c470580b1b7512c5d393140","target":"record","created_at":"2026-07-05T04:02:27Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f50acd9c232342165d0d9cfc261dee76c5f5119a2ab62cbf1a1533fb34355fce","cross_cats_sorted":["cs.MM"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-03-05T16:06:41Z","title_canon_sha256":"816e485db619764ef4103748f4e4e17c3a9a1fe1572e27bffd10ac5ab09aa740"},"schema_version":"1.0","source":{"id":"2203.02777","kind":"arxiv","version":1}},"canonical_sha256":"b8fd0e148ab0789454d041f640e88ef55a074c1a1fde209fecf4ef8ff66cd04a","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b8fd0e148ab0789454d041f640e88ef55a074c1a1fde209fecf4ef8ff66cd04a","first_computed_at":"2026-07-05T04:02:27.387601Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:02:27.387601Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"V0S/gllt4VZwFrlZXh305XSq40G0uF21wOpj07qe/HFjnJUy1eYFqYCHNPkz23ocNAtJaqMWHOa/vNn2u8OiAQ==","signature_status":"signed_v1","signed_at":"2026-07-05T04:02:27.388312Z","signed_message":"canonical_sha256_bytes"},"source_id":"2203.02777","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2c2d5d2fe9c7061b3342dcbfa3602d2ed52ac8a74c470580b1b7512c5d393140","sha256:1b62ced54062cfe64696a0b143cd70c306ce11d2b3298d1407495e540f63dd31"],"state_sha256":"8d1b131d9f61dc0b6d3c245bbe7bdcb95cd727252091eaf177e8f01add3df0bb"}