{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2023:ZD5JO2P4ZSMGJQ5KL42VVQSCU6","short_pith_number":"pith:ZD5JO2P4","canonical_record":{"source":{"id":"2309.05610","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-09-11T16:49:05Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"8900cd5c0ea51ea5a2b3e25f99b8cd0e3dfd0bc8666c2265e9a9bfc3ceffc7ce","abstract_canon_sha256":"d3ee4032abe4754b8acf41d129efd23f0d58992181ab0a4ad2f510c7183f293e"},"schema_version":"1.0"},"canonical_sha256":"c8fa9769fccc9864c3aa5f355ac242a7906ff642d99e4beb0fd3f583a66e0283","source":{"kind":"arxiv","id":"2309.05610","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.05610","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"arxiv_version","alias_value":"2309.05610v2","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.05610","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_12","alias_value":"ZD5JO2P4ZSMG","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_16","alias_value":"ZD5JO2P4ZSMGJQ5K","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_8","alias_value":"ZD5JO2P4","created_at":"2026-07-05T08:45:22Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2023:ZD5JO2P4ZSMGJQ5KL42VVQSCU6","target":"record","payload":{"canonical_record":{"source":{"id":"2309.05610","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-09-11T16:49:05Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"8900cd5c0ea51ea5a2b3e25f99b8cd0e3dfd0bc8666c2265e9a9bfc3ceffc7ce","abstract_canon_sha256":"d3ee4032abe4754b8acf41d129efd23f0d58992181ab0a4ad2f510c7183f293e"},"schema_version":"1.0"},"canonical_sha256":"c8fa9769fccc9864c3aa5f355ac242a7906ff642d99e4beb0fd3f583a66e0283","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:45:22.215888Z","signature_b64":"Alnm4+ObmS2NBe+UwRUHy6Cr/WjMCMGkGehVELnMR368PcvePrr4rhHNk8zNPCxXvRpaix9q3ftYRPSrJQOwCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c8fa9769fccc9864c3aa5f355ac242a7906ff642d99e4beb0fd3f583a66e0283","last_reissued_at":"2026-07-05T08:45:22.215522Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:45:22.215522Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2309.05610","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:45:22Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ov6IzaMbrdAmsF4dLOrcSK7TGBZYx+KHI7RTYqoFVuxNCjyL7Evm841D1X34GQJWTpWgbtakK1eCAFHrcAIwCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-24T04:16:24.407743Z"},"content_sha256":"192e9ad19a6352785b4d13f04337ace58386102ba88aecbaeb0783c804611d57","schema_version":"1.0","event_id":"sha256:192e9ad19a6352785b4d13f04337ace58386102ba88aecbaeb0783c804611d57"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2023:ZD5JO2P4ZSMGJQ5KL42VVQSCU6","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Privacy Side Channels in Machine Learning Systems","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Christopher A. Choquette-Choo, Edoardo Debenedetti, Eric Wallace, Florian Tram\\`er, Giorgio Severi, Matthew Jagielski, Milad Nasr, Nicholas Carlini","submitted_at":"2023-09-11T16:49:05Z","abstract_excerpt":"Most current approaches for protecting privacy in machine learning (ML) assume that models exist in a vacuum. Yet, in reality, these models are part of larger systems that include components for training data filtering, output monitoring, and more. In this work, we introduce privacy side channels: attacks that exploit these system-level components to extract private information at far higher rates than is otherwise possible for standalone models. We propose four categories of side channels that span the entire ML lifecycle (training data filtering, input preprocessing, output post-processing, "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.05610","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2309.05610/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:45:22Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"F3L2waU0h1J8DIT46da4YviLa3ODiXjlV7u2s5Ec26QF6xKL6JkA2RwTbhzQOze14DopYjdMhQOPbDpTgLQODw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-24T04:16:24.408104Z"},"content_sha256":"c8eebccffa99cf1e8690098ca5165e45f26ff0ca2b298327e1a7004ce6015651","schema_version":"1.0","event_id":"sha256:c8eebccffa99cf1e8690098ca5165e45f26ff0ca2b298327e1a7004ce6015651"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/bundle.json","state_url":"https://pith.science/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-24T04:16:24Z","links":{"resolver":"https://pith.science/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6","bundle":"https://pith.science/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/bundle.json","state":"https://pith.science/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ZD5JO2P4ZSMGJQ5KL42VVQSCU6/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:ZD5JO2P4ZSMGJQ5KL42VVQSCU6","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d3ee4032abe4754b8acf41d129efd23f0d58992181ab0a4ad2f510c7183f293e","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-09-11T16:49:05Z","title_canon_sha256":"8900cd5c0ea51ea5a2b3e25f99b8cd0e3dfd0bc8666c2265e9a9bfc3ceffc7ce"},"schema_version":"1.0","source":{"id":"2309.05610","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2309.05610","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"arxiv_version","alias_value":"2309.05610v2","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2309.05610","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_12","alias_value":"ZD5JO2P4ZSMG","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_16","alias_value":"ZD5JO2P4ZSMGJQ5K","created_at":"2026-07-05T08:45:22Z"},{"alias_kind":"pith_short_8","alias_value":"ZD5JO2P4","created_at":"2026-07-05T08:45:22Z"}],"graph_snapshots":[{"event_id":"sha256:c8eebccffa99cf1e8690098ca5165e45f26ff0ca2b298327e1a7004ce6015651","target":"graph","created_at":"2026-07-05T08:45:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2309.05610/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Most current approaches for protecting privacy in machine learning (ML) assume that models exist in a vacuum. Yet, in reality, these models are part of larger systems that include components for training data filtering, output monitoring, and more. In this work, we introduce privacy side channels: attacks that exploit these system-level components to extract private information at far higher rates than is otherwise possible for standalone models. We propose four categories of side channels that span the entire ML lifecycle (training data filtering, input preprocessing, output post-processing, ","authors_text":"Christopher A. Choquette-Choo, Edoardo Debenedetti, Eric Wallace, Florian Tram\\`er, Giorgio Severi, Matthew Jagielski, Milad Nasr, Nicholas Carlini","cross_cats":["cs.LG"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-09-11T16:49:05Z","title":"Privacy Side Channels in Machine Learning Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2309.05610","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:192e9ad19a6352785b4d13f04337ace58386102ba88aecbaeb0783c804611d57","target":"record","created_at":"2026-07-05T08:45:22Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d3ee4032abe4754b8acf41d129efd23f0d58992181ab0a4ad2f510c7183f293e","cross_cats_sorted":["cs.LG"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2023-09-11T16:49:05Z","title_canon_sha256":"8900cd5c0ea51ea5a2b3e25f99b8cd0e3dfd0bc8666c2265e9a9bfc3ceffc7ce"},"schema_version":"1.0","source":{"id":"2309.05610","kind":"arxiv","version":2}},"canonical_sha256":"c8fa9769fccc9864c3aa5f355ac242a7906ff642d99e4beb0fd3f583a66e0283","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c8fa9769fccc9864c3aa5f355ac242a7906ff642d99e4beb0fd3f583a66e0283","first_computed_at":"2026-07-05T08:45:22.215522Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:45:22.215522Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Alnm4+ObmS2NBe+UwRUHy6Cr/WjMCMGkGehVELnMR368PcvePrr4rhHNk8zNPCxXvRpaix9q3ftYRPSrJQOwCw==","signature_status":"signed_v1","signed_at":"2026-07-05T08:45:22.215888Z","signed_message":"canonical_sha256_bytes"},"source_id":"2309.05610","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:192e9ad19a6352785b4d13f04337ace58386102ba88aecbaeb0783c804611d57","sha256:c8eebccffa99cf1e8690098ca5165e45f26ff0ca2b298327e1a7004ce6015651"],"state_sha256":"976e0cf44e99370b3558046594518a4c6ba80275929fd5de3956fba3cea025cb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"S9OCeUzaCqoWo+wHrsrVvXSdi8crLU0DIOWQa2KjOmbkf1hQ2YkjnLLBAwbkoVkIIGcOGJU3BxdCeN0Vakc+DQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-24T04:16:24.410199Z","bundle_sha256":"4f0d78e2f07b38bdb60656729d2bc21ba9ab944e829c67ec9685eee3ae06b702"}}