{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:ZBJEND37IRXXWGQZLFEYUK45R5","short_pith_number":"pith:ZBJEND37","canonical_record":{"source":{"id":"2506.04556","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-05T02:14:30Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3b3349c582d3653eaa2ff628656c0e5b58f83055ba811bcf69b7799a26566112","abstract_canon_sha256":"8128903ce3c3a7daa604f3c3dd9814cb5f2637e97eace68e28caccbaf0e0ef38"},"schema_version":"1.0"},"canonical_sha256":"c852468f7f446f7b1a1959498a2b9d8f5bb4b0656cd5903051021d0106494581","source":{"kind":"arxiv","id":"2506.04556","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.04556","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"arxiv_version","alias_value":"2506.04556v1","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.04556","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_12","alias_value":"ZBJEND37IRXX","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_16","alias_value":"ZBJEND37IRXXWGQZ","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_8","alias_value":"ZBJEND37","created_at":"2026-07-05T11:16:16Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:ZBJEND37IRXXWGQZLFEYUK45R5","target":"record","payload":{"canonical_record":{"source":{"id":"2506.04556","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-05T02:14:30Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"3b3349c582d3653eaa2ff628656c0e5b58f83055ba811bcf69b7799a26566112","abstract_canon_sha256":"8128903ce3c3a7daa604f3c3dd9814cb5f2637e97eace68e28caccbaf0e0ef38"},"schema_version":"1.0"},"canonical_sha256":"c852468f7f446f7b1a1959498a2b9d8f5bb4b0656cd5903051021d0106494581","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:16:16.609867Z","signature_b64":"L78X0iVfmZ+j7iVs/3jGbBqaFnxYHzAmmwbpfi4mFXp4R1eBR7n92gp6FLWsJZa/uuf/ErTsiIkPZt9COEoiBw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c852468f7f446f7b1a1959498a2b9d8f5bb4b0656cd5903051021d0106494581","last_reissued_at":"2026-07-05T11:16:16.609396Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:16:16.609396Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.04556","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:16:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"oEg2zaePgGP0THtwnrWJceu5l2qPFrPRDRYKGa7l0rct3dlHPN1A21I3kx7Tt+m8Dc8qvOPf9fa2J8tP3UXQBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T02:23:31.581364Z"},"content_sha256":"131fbf1f3c6e38ec1dadaa01ab6a04dcdd369b700216eeb8aedcf5a6f23b1568","schema_version":"1.0","event_id":"sha256:131fbf1f3c6e38ec1dadaa01ab6a04dcdd369b700216eeb8aedcf5a6f23b1568"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:ZBJEND37IRXXWGQZLFEYUK45R5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Chuan Zhang, Haotian Liang, Liehuang Zhu, Xuhao Ren, Yajie Wang, Zehui Xiong","submitted_at":"2025-06-05T02:14:30Z","abstract_excerpt":"To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected,"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.04556","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.04556/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:16:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wv17zBnpGaJNpDwbOqfqMP29HBRhKDIoNsGsKVEVCo/6HKx5bQ3iTBiYNNDu4uV2Gq4cAht34gzwjvQuSwgPCQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T02:23:31.582841Z"},"content_sha256":"8fbdbd9ad4181f138c091ca450985f52f915b1cf810f9553e8d3850f852f8128","schema_version":"1.0","event_id":"sha256:8fbdbd9ad4181f138c091ca450985f52f915b1cf810f9553e8d3850f852f8128"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ZBJEND37IRXXWGQZLFEYUK45R5/bundle.json","state_url":"https://pith.science/pith/ZBJEND37IRXXWGQZLFEYUK45R5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ZBJEND37IRXXWGQZLFEYUK45R5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T02:23:31Z","links":{"resolver":"https://pith.science/pith/ZBJEND37IRXXWGQZLFEYUK45R5","bundle":"https://pith.science/pith/ZBJEND37IRXXWGQZLFEYUK45R5/bundle.json","state":"https://pith.science/pith/ZBJEND37IRXXWGQZLFEYUK45R5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ZBJEND37IRXXWGQZLFEYUK45R5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:ZBJEND37IRXXWGQZLFEYUK45R5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8128903ce3c3a7daa604f3c3dd9814cb5f2637e97eace68e28caccbaf0e0ef38","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-05T02:14:30Z","title_canon_sha256":"3b3349c582d3653eaa2ff628656c0e5b58f83055ba811bcf69b7799a26566112"},"schema_version":"1.0","source":{"id":"2506.04556","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.04556","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"arxiv_version","alias_value":"2506.04556v1","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.04556","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_12","alias_value":"ZBJEND37IRXX","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_16","alias_value":"ZBJEND37IRXXWGQZ","created_at":"2026-07-05T11:16:16Z"},{"alias_kind":"pith_short_8","alias_value":"ZBJEND37","created_at":"2026-07-05T11:16:16Z"}],"graph_snapshots":[{"event_id":"sha256:8fbdbd9ad4181f138c091ca450985f52f915b1cf810f9553e8d3850f852f8128","target":"graph","created_at":"2026-07-05T11:16:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.04556/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected,","authors_text":"Chuan Zhang, Haotian Liang, Liehuang Zhu, Xuhao Ren, Yajie Wang, Zehui Xiong","cross_cats":["cs.AI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.04556","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:131fbf1f3c6e38ec1dadaa01ab6a04dcdd369b700216eeb8aedcf5a6f23b1568","target":"record","created_at":"2026-07-05T11:16:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8128903ce3c3a7daa604f3c3dd9814cb5f2637e97eace68e28caccbaf0e0ef38","cross_cats_sorted":["cs.AI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-06-05T02:14:30Z","title_canon_sha256":"3b3349c582d3653eaa2ff628656c0e5b58f83055ba811bcf69b7799a26566112"},"schema_version":"1.0","source":{"id":"2506.04556","kind":"arxiv","version":1}},"canonical_sha256":"c852468f7f446f7b1a1959498a2b9d8f5bb4b0656cd5903051021d0106494581","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c852468f7f446f7b1a1959498a2b9d8f5bb4b0656cd5903051021d0106494581","first_computed_at":"2026-07-05T11:16:16.609396Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:16:16.609396Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"L78X0iVfmZ+j7iVs/3jGbBqaFnxYHzAmmwbpfi4mFXp4R1eBR7n92gp6FLWsJZa/uuf/ErTsiIkPZt9COEoiBw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:16:16.609867Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.04556","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:131fbf1f3c6e38ec1dadaa01ab6a04dcdd369b700216eeb8aedcf5a6f23b1568","sha256:8fbdbd9ad4181f138c091ca450985f52f915b1cf810f9553e8d3850f852f8128"],"state_sha256":"b005ab2e3540300292293dad05fc92f01fac062ea81ee3c68c58da12871c374f"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MzFEGlJmza49G0Yy5ezJy2MDwg6hyCN73A5xHO6sZ4mXcDpZIa9MXzPJFvPeWzMwyuKmwqBAhfOLrmj3x+1rBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T02:23:31.587294Z","bundle_sha256":"05a8877dce073b433b7cf832ce325c19a0cbab85efecd9f96a9e04081fbf834c"}}