{"as_of":"2026-08-09T22:44:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:818dd0854b46f571b699c27d216e8869ef8a4fdf1bc79a1a0f51fd30f5a93354","coverage":[{"denominator":45,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":45,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T10:44:40.250400Z","state":"measured"},{"denominator":45,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":45,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2506.04556/citation-record","integrity":"/paper/2506.04556/integrity","json":"/paper/2506.04556/citation-record.json","paper":"/paper/2506.04556"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.901047Z","title":"Efficient self-supervised learning with contextualized target representations for vision, speech and language,","venue":null,"work_id":"0116baa3-d1a3-4129-837c-f7bb1b8d6dc7","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.191629Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:30a81999260a98b1fb63e1558d687953278914d90d5da09400f6dfe9fc863da8","observation_id":"25100a51-66b9-4b48-b7e2-4fec3d2f6fff","resolution":{"observed_at":"2026-08-07T10:44:40.905537Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.888583Z","title":"Reaas: Enabling adversarially robust downstream classifiers via robust encoder as a service,","venue":null,"work_id":"7ad4c293-f6ac-411a-8917-348a564640b4","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.271897Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:0044359063325fb36497eab764f8aaa80f6cf6eb002e17576592e41bd9ae8687","observation_id":"f97fde2f-c62c-4097-af6c-89b07d60b78d","resolution":{"observed_at":"2026-08-07T10:44:40.892746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.875622Z","title":"Can’t steal? cont- steal! contrastive stealing attacks against image encoders,","venue":null,"work_id":"8e9f6818-8231-4a13-b658-95faf8fac2de","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.275499Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:e0a921e3e9a61eb22f42c10e4dd98f0bf14d14f4fc310f91cffbc7804a87ba6c","observation_id":"462d6e05-03b5-42fc-b673-e93bf2ad8838","resolution":{"observed_at":"2026-08-07T10:44:40.879691Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2208.03948","last_updated":"2022-08-08T07:23:37Z","snapshot_observed_at":"2026-07-06T13:39:43.614791Z","submitted_at":"2022-08-08T07:23:37Z","title":"AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning","version":1},"cited_work":{"arxiv_id":"2208.03948","doi":null,"metadata_source":"pith","pith_arxiv_id":"2208.03948","snapshot_observed_at":"2026-08-07T10:44:40.405774Z","title":"AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning","venue":"cs.CV","work_id":"4f937437-6173-4497-a5cb-d8b068176696","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.279936Z"},"links":{"cited_paper":"/paper/2208.03948","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:ed61b77dd60e5a7b0d44197c466eb30e7b68b3da3f609539938a1661d0a2159b","observation_id":"0d1ce80d-5b78-4ecb-9f69-c7dd58346f03","resolution":{"observed_at":"2026-08-07T10:44:40.411203Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2110.15444","last_updated":"2023-06-09T15:53:54Z","snapshot_observed_at":"2026-07-06T12:03:13.739036Z","submitted_at":"2021-10-28T21:45:53Z","title":"10 Security and Privacy Problems in Large Foundation Models","version":3},"cited_work":{"arxiv_id":"2110.15444","doi":null,"metadata_source":"pith","pith_arxiv_id":"2110.15444","snapshot_observed_at":"2026-08-07T10:44:40.387590Z","title":"10 Security and Privacy Problems in Large Foundation Models","venue":"cs.CR","work_id":"fc133468-33c2-4c9f-abf9-72698d210822","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.405645Z"},"links":{"cited_paper":"/paper/2110.15444","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:e7ec64cec33280342aee9f56cd4d5bb2e610486eb1ed12d93fd7adc00ca4b45b","observation_id":"eaeffeaf-138c-461e-a72e-b1600f0533c8","resolution":{"observed_at":"2026-08-07T10:44:40.392059Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.862804Z","title":"On the difficulty of defending self-supervised learning against model extraction,","venue":null,"work_id":"5b1ab9ad-300f-41b9-b0e0-53f844af3c55","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.499997Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:4ad64e13fd99addfd69963b30bc06b6fd19b14f643d2d38c47c83b64cafbe268","observation_id":"3fb902fe-7253-4ed3-a7d7-c37e3540bf34","resolution":{"observed_at":"2026-08-07T10:44:40.867200Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.837308Z","title":"Self-supervised learning of adversarial example: Towards good generalizations for deepfake detection,","venue":null,"work_id":"ec50402c-e0a6-4961-a794-e7e8a83432ed","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.627456Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:340406665cf655bf5529fbbe12e3ee79dd81cd79f0a66cc7209cd07321c7df04","observation_id":"0be1f689-d3b0-457b-9e9e-c4e6ddc79874","resolution":{"observed_at":"2026-08-07T10:44:40.841539Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.823068Z","title":"Encodermi: Membership inference against pre-trained encoders in contrastive learning,","venue":null,"work_id":"1e22cbbc-46b7-4604-8732-d6e6f7b3e216","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.634529Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:44d7c48aaa29b90d7459e2f740427a1b4a2fb23a1dfe6f82035023834a992b72","observation_id":"7c68f1ab-f8f8-4a91-9806-8cecb448b2f7","resolution":{"observed_at":"2026-08-07T10:44:40.827495Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.808604Z","title":"Semi-leak: Membership inference attacks against semi-supervised learning,","venue":null,"work_id":"bbbaa76c-41ca-4c84-abf1-1306cb6cc315","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.638965Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:fdd713d3d242795f9e80bde443616b48e0a6ffac00d9144404861cfc8d480321","observation_id":"90e8f8cd-8899-4cad-81c7-190cad8b5033","resolution":{"observed_at":"2026-08-07T10:44:40.813801Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.795439Z","title":"Badencoder: Backdoor attacks to pre- trained encoders in self-supervised learning,","venue":null,"work_id":"99860e56-bb7b-42ee-b098-f9573cb3ce88","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.694412Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:38ea7aad4f2d7dbac1714baa5a4c4fe5312986e1ab95ca0bc0a0e2fb8f690682","observation_id":"473f2a09-63d0-49ca-b6c8-4b91c1d4ed6b","resolution":{"observed_at":"2026-08-07T10:44:40.799812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.782959Z","title":"Backdoor attacks on self-supervised learning,","venue":null,"work_id":"ca70023e-ec16-4917-be82-29d626a38c25","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.774646Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:efdb5ff5ae4cbb0bae7ebdeb117de2445424b638e11ea08634345020e6ab200a","observation_id":"8b7e4dfa-b66c-4594-afca-3d0ae65969f2","resolution":{"observed_at":"2026-08-07T10:44:40.787281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.770467Z","title":"An embarrassingly simple backdoor attack on self-supervised learning,","venue":null,"work_id":"5c1c98ef-530d-4b39-a7e5-c8044b991d79","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.834205Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:aff8ff299e2fdf4779abd703a823b4380610524167708055f5bde29f680ac4a8","observation_id":"0ebc5ab2-4f13-404e-b51e-7ef85bf686e2","resolution":{"observed_at":"2026-08-07T10:44:40.774694Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.756215Z","title":"PRADA: protecting against DNN model stealing attacks,","venue":null,"work_id":"70e56612-6f79-487c-9e98-48b987cf0c48","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.899883Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:e003c12b00bf1884e625642b4a8d717162d2d70f1b6b6ca9ccb46525de49c412","observation_id":"9e76930d-5102-4c76-956f-ced949968441","resolution":{"observed_at":"2026-08-07T10:44:40.760904Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.743652Z","title":"Modelguard: Information-theoretic defense against model extraction attacks,","venue":null,"work_id":"e4b5b76d-673b-4ffd-bc4a-de16e58264e4","year":2024},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:39.974999Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:981c910c977588b19783ed84837ac9103173cf0dadd956e86086fe49bdf0985f","observation_id":"7d3fb1c8-d773-43c3-b3ed-6d4d5ab04635","resolution":{"observed_at":"2026-08-07T10:44:40.747911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.730959Z","title":"Plmmark: A secure and robust black-box watermarking framework for pre-trained language models,","venue":null,"work_id":"571136d7-1b5b-48c5-94e5-97c57e3ddedc","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.028591Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:22cc7024410b8fcc7a6263548b6d826bd88fd3ab75f9cf384e15287aebb5c9f8","observation_id":"2ab41232-eaba-4239-9cc6-391572a825d9","resolution":{"observed_at":"2026-08-07T10:44:40.735272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.04673","last_updated":"2023-12-06T08:23:34Z","snapshot_observed_at":"2026-07-06T16:04:15.121439Z","submitted_at":"2023-08-09T02:54:11Z","title":"SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning","version":3},"cited_work":{"arxiv_id":"2308.04673","doi":null,"metadata_source":"pith","pith_arxiv_id":"2308.04673","snapshot_observed_at":"2026-08-07T10:44:40.367494Z","title":"SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning","venue":"cs.CR","work_id":"de651055-921c-4031-821f-0cc2d258aa7c","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.111089Z"},"links":{"cited_paper":"/paper/2308.04673","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:39428e2804066ea19ef3f21586ee4f8488331b0b95aa927dfde792aa0bd4fd5c","observation_id":"12dbe15b-2fb2-4056-94d3-2fafc4299c61","resolution":{"observed_at":"2026-08-07T10:44:40.373313Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05863","last_updated":"2023-11-10T04:27:27Z","snapshot_observed_at":"2026-07-06T16:45:36.159896Z","submitted_at":"2023-11-10T04:27:27Z","title":"Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Service","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05863","snapshot_observed_at":"2026-08-07T10:44:40.127433Z","title":"Water- marking vision-language pre-trained models for multi-modal embedding as a service,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.127433Z"},"links":{"cited_paper":"/paper/2311.05863","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:624fc460927916cd30cdd8aaf0d0c9442d7a9d46b25263ae6852bf52a84ddc8c","observation_id":"b50303af-2aca-4c51-bcda-5d14597ad6d8","resolution":{"observed_at":"2026-08-07T10:44:40.127433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.716278Z","title":"Threat modeling ai/ml systems and dependencies,","venue":null,"work_id":"7d94f05a-ae24-41e3-b7b0-8194af1c05e4","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.133264Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:1d32aa74634da864ac48c31b654778de1f96196973c604a56bf1b17110fed8de","observation_id":"94b4034d-15f9-441a-82cb-b6d21c1e9513","resolution":{"observed_at":"2026-08-07T10:44:40.721028Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.702849Z","title":"Stolenencoder: Stealing pre- trained encoders in self-supervised learning,","venue":null,"work_id":"8a968b1c-740a-4c2f-ba7e-e41b93866650","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.137481Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:4f1dbdb27fc9bc27d2903ccb0ee98a5a19f045c654d5ccfa179fce5aa8a4e4ba","observation_id":"471b45a2-f491-4ada-a726-73de39438a94","resolution":{"observed_at":"2026-08-07T10:44:40.707365Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.689910Z","title":"D-DAE: defense- penetrating model extraction attacks,","venue":null,"work_id":"68a46f4e-ff31-4732-90ee-3c36d33591c5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.141333Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:8030b00b158d38e9c7e808eaf3caa50d3b0e0564a118f191ed474ab65525c738","observation_id":"6360808a-6018-4006-a21c-99387ebe30be","resolution":{"observed_at":"2026-08-07T10:44:40.694383Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.676732Z","title":"Magnet: A two-pronged defense against adversarial examples,","venue":null,"work_id":"b1621b85-efb4-421e-8a5d-b0ec32b1c71a","year":2017},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.145843Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:a95557ae694c6611960acba89b5fe61d707e2ca01e723a4eae79574dfed835a8","observation_id":"7a9633b8-5d36-4d2b-8440-b3ad99c7b51e","resolution":{"observed_at":"2026-08-07T10:44:40.681735Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.665111Z","title":"Model extraction attacks and defenses on cloud-based machine learning models,","venue":null,"work_id":"64222355-ab57-4089-adce-ea0c37c3d960","year":2020},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.150321Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:ae0958feb0e8d7336509fc1fb7957930449475c998d2a3e3a05e0420d371cd81","observation_id":"bf1893f4-048f-426d-b9b8-0ce94647753a","resolution":{"observed_at":"2026-08-07T10:44:40.669143Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.652598Z","title":"Inversenet: Augmenting model extraction attacks with training data inversion,","venue":null,"work_id":"f3422973-2c42-44e4-82c7-69f9e6e69560","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.154830Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:24eb9047467271f637444e969e3531fb851c32f99816fab4a27d23ca0a3f31f4","observation_id":"8bcd002c-4632-4d0c-8e6b-cfb4a9d93f31","resolution":{"observed_at":"2026-08-07T10:44:40.656590Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.639561Z","title":"Stealing machine learning models via prediction apis,","venue":null,"work_id":"daaa724c-706f-4c9a-a28c-537eb853b700","year":2016},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.159306Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:e5a7a12aa5cabf4531194bf954dcefb678f49649a3309a14443072c180063488","observation_id":"ef7d6b50-b01f-48fd-af60-d9fe7c274184","resolution":{"observed_at":"2026-08-07T10:44:40.643846Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.626145Z","title":"Black-box attacks on sequential recommenders via data-free model extraction,","venue":null,"work_id":"6d7abe9d-568d-4f9b-a72c-72e2d9be178b","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.163322Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:f22f77101b72f5a5c8b40ed857fb7deb81fb7aa48b6e61275915b44285b9c1ff","observation_id":"5325badb-2bcb-40a4-85b2-d9c20f1daed1","resolution":{"observed_at":"2026-08-07T10:44:40.630471Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.612163Z","title":"Divtheft: An ensemble model stealing attack by divide-and-conquer,","venue":null,"work_id":"662088c5-6bf2-4a79-8bda-1c7348ba80b4","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.167952Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:32e234cf99b6147cf6f0d8428b2204e1f0aefaf76443bd2ad4d58784ab426878","observation_id":"e70c0880-a877-4b19-85b5-95c222df059e","resolution":{"observed_at":"2026-08-07T10:44:40.617105Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.05127","last_updated":"2023-08-09T06:23:54Z","snapshot_observed_at":"2026-07-06T16:04:30.940641Z","submitted_at":"2023-08-09T06:23:54Z","title":"Data-Free Model Extraction Attacks in the Context of Object Detection","version":1},"cited_work":{"arxiv_id":"2308.05127","doi":null,"metadata_source":"pith","pith_arxiv_id":"2308.05127","snapshot_observed_at":"2026-08-07T10:44:40.334947Z","title":"Data-Free Model Extraction Attacks in the Context of Object Detection","venue":"cs.CR","work_id":"f4be4bd7-2987-4f08-8435-355486e7ef4b","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.172344Z"},"links":{"cited_paper":"/paper/2308.05127","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:8b3a8033a6d0cf2b38f3f3893f7f50d2058b9e45b676c00b75a8aace05684cb1","observation_id":"503d7391-ae9a-4587-80bb-a36f8682390d","resolution":{"observed_at":"2026-08-07T10:44:40.339775Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.598180Z","title":"MAZE: data-free model stealing attack using zeroth-order gradient estimation,","venue":null,"work_id":"5dcc14fc-b6b4-45d5-81ba-fb1ddc06b90b","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.176624Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:303188e0c43bc60b40e7bcfbdcc72a19c10188772effaa26c9eb8ca3e04bde7a","observation_id":"9606e46e-7216-4d6d-9adf-c544653fdb50","resolution":{"observed_at":"2026-08-07T10:44:40.602888Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.584366Z","title":"Data-free model extraction,","venue":null,"work_id":"dab599e2-765a-42df-b0ea-9e47608f7013","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.180343Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:025a431cff61b15c08ff6e40f8f510961e5e7d9a55ae3612b598f157794f3ed4","observation_id":"88db8f25-a96b-43d5-8cb5-aafc6052c0cc","resolution":{"observed_at":"2026-08-07T10:44:40.589527Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.571433Z","title":"Entangled watermarks as a defense against model extraction,","venue":null,"work_id":"9586a11a-24f8-451d-8887-86a07443d9c0","year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.184340Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:869a533bcda688bf95c44fe70a4418c06e82e8a2a615de293b9a2dfbc6f6843c","observation_id":"9871662b-44ed-42bd-9136-2c65fc569b84","resolution":{"observed_at":"2026-08-07T10:44:40.575613Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2104.12623","last_updated":"2023-02-28T09:37:59Z","snapshot_observed_at":"2026-08-01T19:16:59.624967Z","submitted_at":"2021-04-26T14:50:59Z","title":"Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.12623","snapshot_observed_at":"2026-08-07T10:44:40.188346Z","title":"Good artists copy, great artists steal: Model extraction attacks against image translation generative adversarial networks,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.188346Z"},"links":{"cited_paper":"/paper/2104.12623","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:5b2c9f012e7d27b746b305207bc970cce1c9665dd86fbcd91ed903638470ddb7","observation_id":"5503ccc1-de81-491f-bdfe-d3f1d2d07408","resolution":{"observed_at":"2026-08-07T10:44:40.188346Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.556651Z","title":"Fe-dast: Fast and effective data-free substitute training for black-box adversarial attacks,","venue":null,"work_id":"ec12f8aa-396a-4a13-a9f8-38e0cf0e2a65","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.192686Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:269dcb5e5ede0aafaa9b340dfbe856be26aa896568f41b42958c6277ed968a41","observation_id":"ca3535f7-2d6c-4be6-be0a-3248c1d85630","resolution":{"observed_at":"2026-08-07T10:44:40.562280Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.542693Z","title":"QUDA: query-limited data-free model extraction,","venue":null,"work_id":"f17e9ac4-da58-459e-acea-cfa8767728c5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.197531Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:279245e126b19d7462f36596e3c9c86c99f40f03eda1bb8943f145dda63f07f7","observation_id":"904e3f69-5826-4f43-b5b5-7644cdcaee13","resolution":{"observed_at":"2026-08-07T10:44:40.546732Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.530004Z","title":"Knockoff nets: Stealing func- tionality of black-box models,","venue":null,"work_id":"a1a07381-7681-46d7-8260-bbaca4eedbb7","year":2019},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.202460Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:a5162f99e4523db2bf351d1e25ae65239f61fe816f0dea2d103ca68c74586c1f","observation_id":"6021d8ab-09c2-47ff-ba67-77efd9957f7e","resolution":{"observed_at":"2026-08-07T10:44:40.534463Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.515236Z","title":"Practical black-box attacks against machine learning,","venue":null,"work_id":"f874238f-4f56-4b23-9979-bb902c019f9c","year":2017},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.207004Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:41f4844d2eae2c54b7c509732d97d60b3ab62947d31bb2cae642eca0a5c17c0e","observation_id":"7a3d500a-dd37-46d9-af58-74e13cbb743a","resolution":{"observed_at":"2026-08-07T10:44:40.520561Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.849924Z","title":"DST: dynamic substitute training for data-free black-box attack,","venue":null,"work_id":"766310a8-1668-4ba3-9021-fc6b811c3e12","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.211056Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:3882c7c0995827e0dbcde0d52374188fcf27e6707af17eff8419f8d3adfc62a4","observation_id":"1b5fc14d-e842-474e-a0e4-a7b4c7685f28","resolution":{"observed_at":"2026-08-07T10:44:40.854014Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08571","last_updated":"2023-11-03T14:12:23Z","snapshot_observed_at":"2026-07-06T16:32:07.186600Z","submitted_at":"2023-10-12T17:56:53Z","title":"Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders","version":2},"cited_work":{"arxiv_id":"2310.08571","doi":null,"metadata_source":"pith","pith_arxiv_id":"2310.08571","snapshot_observed_at":"2026-08-07T10:44:40.299199Z","title":"Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders","venue":"cs.LG","work_id":"3abf95ea-2fd5-4765-9759-24b58ed58202","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.215276Z"},"links":{"cited_paper":"/paper/2310.08571","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:dd6765f9516217c0f8d249d39abeebf1ec56e8462adcda2bb4968b1620d71338","observation_id":"afded011-ba85-4769-bd15-6edc62414950","resolution":{"observed_at":"2026-08-07T10:44:40.305995Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.502377Z","title":"Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,","venue":null,"work_id":"97dd17d6-3c28-41d9-b992-e5914969f09a","year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.220741Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:1f8f087ea4a0aafdddcf7d497792ab66de4885faae4fcdbd2f590cbf94e4c1c0","observation_id":"2067a111-30ce-47ed-9a6a-3a127c0f112d","resolution":{"observed_at":"2026-08-07T10:44:40.506898Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.487921Z","title":"Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark,","venue":null,"work_id":"6570b33a-1980-42b4-80f6-6b07bb3884f5","year":2023},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.225203Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:7f59d9485b8e9637b1dae126a96a5c7aa4b73f559ae5e88a8a32834bb4e01c17","observation_id":"d39e61ed-ff2f-45ac-a010-2545811f8cab","resolution":{"observed_at":"2026-08-07T10:44:40.492840Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.229281Z","title":"Learning multiple layers of features from tiny images","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.229281Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:de1c85cf18d1a438cdbeb7f06aacc438cdc94b5ff096488fcabfd61bda1b44bf","observation_id":"07ef47bd-57c7-4299-9bd5-563c5e8b3902","resolution":{"observed_at":"2026-08-07T10:44:40.229281Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.465300Z","title":"Reading digits in natural images with unsupervised feature learning,","venue":null,"work_id":"87035064-80c3-4d80-863d-33e5b198943c","year":2011},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.233217Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:abf2156a907e695b1fff33b0f31800d8b06b01893ed585dad06d243d00ebc34e","observation_id":"7811dbd1-7b69-4de1-bdd9-ff9e35c4ac76","resolution":{"observed_at":"2026-08-07T10:44:40.470364Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.450384Z","title":"Auto-encoding variational bayes,","venue":null,"work_id":"61f5bb10-b07c-4914-8f61-56470e4760a1","year":2014},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.237561Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:06ab36f31328a20bb2c984a249d9539e0df6cd5547bded1a8779e46a73106225","observation_id":"8e446698-81aa-4f40-bd60-53065f104730","resolution":{"observed_at":"2026-08-07T10:44:40.455139Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.436250Z","title":"Generative adversarial nets,","venue":null,"work_id":"c50d61d1-c94f-4fb4-ac4b-3dc77f8f16fc","year":2014},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.242357Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:59c5e7e4514fbd3d382c54b749578a2557c02a740e6248ed190c5205dd5997d0","observation_id":"f2bc344f-709b-445a-ad7b-dc58065ea460","resolution":{"observed_at":"2026-08-07T10:44:40.440446Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T10:44:40.420923Z","title":"Rectifier nonlinearities improve neural network acoustic models,","venue":null,"work_id":"a7c54e9f-81a3-4c7e-9e38-f2248754c3e4","year":2013},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.246326Z"},"links":{"citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:3d65ec33db1ecccf31e105b22e50d3415345d1e6eaebb38b1385db9e07c082d2","observation_id":"456b8959-77c2-4bbe-b80d-c21ebfd3a579","resolution":{"observed_at":"2026-08-07T10:44:40.426108Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2209.02299","last_updated":"2024-09-17T11:55:58Z","snapshot_observed_at":"2026-08-02T02:19:01.218373Z","submitted_at":"2022-09-06T08:51:53Z","title":"A Survey of Machine Unlearning","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.02299","snapshot_observed_at":"2026-08-07T10:44:40.250400Z","title":"A survey of machine unlearning,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T10:44:40.250400Z"},"links":{"cited_paper":"/paper/2209.02299","citing_paper":"/paper/2506.04556"},"observation_digest":"sha256:202831c690322a1af15fe21ae20566e3ac81e3cb13a63c26a37b68ab21827522","observation_id":"c43b6982-a793-4316-a584-b5e715dd4ef7","resolution":{"observed_at":"2026-08-07T10:44:40.250400Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2506.04556","last_updated":"2025-06-05T02:14:30Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T10:36:59.630257Z","submitted_at":"2025-06-05T02:14:30Z","title":"BESA: Boosting Encoder Stealing Attack with Perturbation Recovery"},"reference_resolution":{"displayed":45,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":4,"verified_exact":5,"verified_fuzzy":36},"total_outbound_references":45},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 45 of 45 outbound references and 0 inbound Pith citation observations for arXiv:2506.04556."}