{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:ZXKCAV4G4VT3LFAVCDH6TUNJB4","short_pith_number":"pith:ZXKCAV4G","canonical_record":{"source":{"id":"2105.00164","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2021-05-01T04:41:00Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ddb7b94a6531a6afaf170074aa5614ded6a3d188023ccff65476979f1bb67bb3","abstract_canon_sha256":"25cd97bacf488d1597f822a8dc6f283f67a7146f802a79162825e40636add160"},"schema_version":"1.0"},"canonical_sha256":"cdd4205786e567b5941510cfe9d1a90f027d744847e8863ea189c1449a1d2a8b","source":{"kind":"arxiv","id":"2105.00164","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.00164","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"arxiv_version","alias_value":"2105.00164v3","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.00164","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_12","alias_value":"ZXKCAV4G4VT3","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_16","alias_value":"ZXKCAV4G4VT3LFAV","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_8","alias_value":"ZXKCAV4G","created_at":"2026-07-05T03:17:50Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:ZXKCAV4G4VT3LFAVCDH6TUNJB4","target":"record","payload":{"canonical_record":{"source":{"id":"2105.00164","kind":"arxiv","version":3},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2021-05-01T04:41:00Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"ddb7b94a6531a6afaf170074aa5614ded6a3d188023ccff65476979f1bb67bb3","abstract_canon_sha256":"25cd97bacf488d1597f822a8dc6f283f67a7146f802a79162825e40636add160"},"schema_version":"1.0"},"canonical_sha256":"cdd4205786e567b5941510cfe9d1a90f027d744847e8863ea189c1449a1d2a8b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:17:50.636682Z","signature_b64":"GepRYtwicTgHFT2onSHndqx+9sXj9kunXSTy5oJPhWL6rZhQxmKaiHbedqXH2rp4NeZTTEKIV9nZ+uozSI4QBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"cdd4205786e567b5941510cfe9d1a90f027d744847e8863ea189c1449a1d2a8b","last_reissued_at":"2026-07-05T03:17:50.636142Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:17:50.636142Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2105.00164","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:17:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"egyICiVmY9FwM7+roA6aE4lU0y4q5w4noZV2Jnglmitk5PP/PrKTij0PRrmhYE15+wbyJX3Y/g4JVW7pkDEbBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T22:06:15.363193Z"},"content_sha256":"4e30c707829691667b9b928c3b37d428984139e7f697993a3d070fe9fbe036a8","schema_version":"1.0","event_id":"sha256:4e30c707829691667b9b928c3b37d428984139e7f697993a3d070fe9fbe036a8"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:ZXKCAV4G4VT3LFAVCDH6TUNJB4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Hidden Backdoors in Human-Centric Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.CL","authors_text":"Benjamin Zi Hao Zhao, Haojin Zhu, Hui Liu, Jialiang Lu, Minhui Xue, Shaofeng Li, Tian Dong","submitted_at":"2021-05-01T04:41:00Z","abstract_excerpt":"Natural language processing (NLP) systems have been proven to be vulnerable to backdoor attacks, whereby hidden features (backdoors) are trained into a language model and may only be activated by specific inputs (called triggers), to trick the model into producing unexpected behaviors. In this paper, we create covert and natural triggers for textual backdoor attacks, \\textit{hidden backdoors}, where triggers can fool both modern language models and human inspection. We deploy our hidden backdoors through two state-of-the-art trigger embedding methods. The first approach via homograph replaceme"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.00164","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2105.00164/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:17:50Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"t72h941Lam/wV0P9nszdXXkl6VS8c0a8G3zkQXaAKD2N2KcGRgBDH69n9B+LRPxnWDdE+8QJyM59DKpfo49MCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-17T22:06:15.363570Z"},"content_sha256":"2d6b0b66cba58acb6940c574f376dc4f9bd93eee45ceaf68d08538c5f0ec4d9f","schema_version":"1.0","event_id":"sha256:2d6b0b66cba58acb6940c574f376dc4f9bd93eee45ceaf68d08538c5f0ec4d9f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/bundle.json","state_url":"https://pith.science/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-17T22:06:15Z","links":{"resolver":"https://pith.science/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4","bundle":"https://pith.science/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/bundle.json","state":"https://pith.science/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ZXKCAV4G4VT3LFAVCDH6TUNJB4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:ZXKCAV4G4VT3LFAVCDH6TUNJB4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"25cd97bacf488d1597f822a8dc6f283f67a7146f802a79162825e40636add160","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2021-05-01T04:41:00Z","title_canon_sha256":"ddb7b94a6531a6afaf170074aa5614ded6a3d188023ccff65476979f1bb67bb3"},"schema_version":"1.0","source":{"id":"2105.00164","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.00164","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"arxiv_version","alias_value":"2105.00164v3","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.00164","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_12","alias_value":"ZXKCAV4G4VT3","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_16","alias_value":"ZXKCAV4G4VT3LFAV","created_at":"2026-07-05T03:17:50Z"},{"alias_kind":"pith_short_8","alias_value":"ZXKCAV4G","created_at":"2026-07-05T03:17:50Z"}],"graph_snapshots":[{"event_id":"sha256:2d6b0b66cba58acb6940c574f376dc4f9bd93eee45ceaf68d08538c5f0ec4d9f","target":"graph","created_at":"2026-07-05T03:17:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2105.00164/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Natural language processing (NLP) systems have been proven to be vulnerable to backdoor attacks, whereby hidden features (backdoors) are trained into a language model and may only be activated by specific inputs (called triggers), to trick the model into producing unexpected behaviors. In this paper, we create covert and natural triggers for textual backdoor attacks, \\textit{hidden backdoors}, where triggers can fool both modern language models and human inspection. We deploy our hidden backdoors through two state-of-the-art trigger embedding methods. The first approach via homograph replaceme","authors_text":"Benjamin Zi Hao Zhao, Haojin Zhu, Hui Liu, Jialiang Lu, Minhui Xue, Shaofeng Li, Tian Dong","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2021-05-01T04:41:00Z","title":"Hidden Backdoors in Human-Centric Language Models"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.00164","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4e30c707829691667b9b928c3b37d428984139e7f697993a3d070fe9fbe036a8","target":"record","created_at":"2026-07-05T03:17:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"25cd97bacf488d1597f822a8dc6f283f67a7146f802a79162825e40636add160","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CL","submitted_at":"2021-05-01T04:41:00Z","title_canon_sha256":"ddb7b94a6531a6afaf170074aa5614ded6a3d188023ccff65476979f1bb67bb3"},"schema_version":"1.0","source":{"id":"2105.00164","kind":"arxiv","version":3}},"canonical_sha256":"cdd4205786e567b5941510cfe9d1a90f027d744847e8863ea189c1449a1d2a8b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"cdd4205786e567b5941510cfe9d1a90f027d744847e8863ea189c1449a1d2a8b","first_computed_at":"2026-07-05T03:17:50.636142Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:17:50.636142Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"GepRYtwicTgHFT2onSHndqx+9sXj9kunXSTy5oJPhWL6rZhQxmKaiHbedqXH2rp4NeZTTEKIV9nZ+uozSI4QBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T03:17:50.636682Z","signed_message":"canonical_sha256_bytes"},"source_id":"2105.00164","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4e30c707829691667b9b928c3b37d428984139e7f697993a3d070fe9fbe036a8","sha256:2d6b0b66cba58acb6940c574f376dc4f9bd93eee45ceaf68d08538c5f0ec4d9f"],"state_sha256":"2d61424c755a4adcd67a4fb0fceeb93ac85f5d6a498724cd2c204f3f67649564"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BTFssuz5X0U+3jF+sGWqtSciac148Pe5dvPc1dUyeRuHb9dfjQ1fzjiOm9ejrT2WCf7SH8yQRxVmm4wZQ3QCDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-17T22:06:15.366291Z","bundle_sha256":"bf9ebc991f28932d9108d2beddce2731c5d163c7ba2b5229da67271db176c130"}}