{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_86c0cc9f96d367eb7f94bb0faf9f30ffd74e90cae5d8123d5f3762e99192ff27","bitcoin_anchor":{"bitcoin_attestations":["bitcoin_block_949451"],"calendar_attestations":["https://finney.calendar.eternitywall.com","https://btc.calendar.catallaxy.com","https://alice.btc.calendar.opentimestamps.org","https://bob.btc.calendar.opentimestamps.org"],"ots_url":"/registry/data/substrate/anchors/77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3.ots","stamped_at":"2026-05-15T03:00:03Z","status":"bitcoin"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_86c0cc9f96d367eb7f94bb0faf9f30ffd74e90cae5d8123d5f3762e99192ff27","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"6961f7f6afbea330d36416a1d1a4b500f99ed83fc90236736914ded9543f38d7","published":"Fri, 08 May 2026 00:00:00 -0400","receipt_hash":"6961f7f6afbea330d36416a1d1a4b500f99ed83fc90236736914ded9543f38d7","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"6961f7f6afbea330d36416a1d1a4b500f99ed83fc90236736914ded9543f38d7","observed_at":"2026-05-08T04:43:40.537619Z","parent_run_hash":"9837a17a0d4866b3bef2929e933ca29d96f4bd9656766df36f8260d720835b95","published":"Fri, 08 May 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2605.06601v1 Announce Type: cross \nAbstract: Security updates create a short but important window in which defenders and attackers can compare vulnerable and patched software. Yet in many operational settings, the most accessible artifacts are binary packages rather than source patches or advisory text. This paper asks whether a language-model agent, restricted to local binary-derived evidence, can reconstruct the security meaning of Linux distribution updates. Patch2Vuln is a local, resumable pipeline that extracts old/new ELF pairs, diffs them with Ghidra and Ghidriff, ranks changed functions, builds candidate dossiers, and asks an offline agent to produce a preliminary audit, bounded validation plan, and final audit.\n  We evaluate Patch2Vuln on 25 Ubuntu `.deb` package pairs: 20 security-update pairs and five negative controls, all manually adjudicated against private source-patch and binary-function ground truth. The agent localizes a verified security-relevant patch function","title":"Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches","url":"https://arxiv.org/abs/2605.06601","vendor":"arxiv_cs_ai"},"summary":"arXiv:2605.06601v1 Announce Type: cross \nAbstract: Security updates create a short but important window in which defenders and attackers can compare vulnerable and patched software. Yet in many operational settings, the most accessible artifacts are binary packages rather than source patches or advisory text. This paper asks whether a language-model agent, restricted to local binary-derived evidence, can reconstruct the security meaning of Linux distribution updates. Patch2Vuln is a local, resumable pipeline that extracts old/new ELF pairs, diffs them with Ghidra and Ghidriff, ranks changed functions, builds candidate dossiers, and asks an offline agent to produce a preliminary audit, bounded validation plan, and final audit.\n  We evaluate Patch2Vuln on 25 Ubuntu `.deb` package pairs: 20 security-update pairs and five negative controls, all manually adjudicated against private source-patch and binary-function ground truth. The agent localizes a verified security-relevant patch function","title":"Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-05-08T04:43:40Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2605.06601"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:e3bcbaf6d81e84f3b59873ed4059f51de9a5c908f3198fabf63fdb04aac4378a658d78a4ff2523e2348b0f74bcd1e39d31a34ec271e2c8b7a9320b7dbe5dc70b","signer":"crovia.substrate","subject":{"observed_at":"2026-05-08T04:43:40Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2605.06601"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"88a2b17a8bfb99487ce2e85bcf0fdfbd501931c5c8cccdb99986bea37f6872cb","leaf_index":120344,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"4bdc89c402b78058cffa41a556e944434ffeed023ee6b0449e3e2e0463cca8af","side":"right"},{"sibling":"5951a4b8e9dc8b69bbc704357178872b927b312ce075b4bd11b274769d4ec856","side":"right"},{"sibling":"2f60db06b603b33ddf9b091911c139692b8911d9e39c8a27dce190e063be49dd","side":"right"},{"sibling":"bedb17364d0697ce1da3675b55e8a62e59b291ea620b6c4ad509fcbdb08ca4f2","side":"left"},{"sibling":"b159aa5b1adb015ec50faabdc3c956d7367237925440c3a548abeabea55d3788","side":"left"},{"sibling":"ee48c805c85a4e43d4a9d14a4f80b704a7a8eb604db6cb321fb8c6fe08a82186","side":"right"},{"sibling":"ff6dfc3e3819926f225fca4697d75146861a953457867e78f1a01b86559feac7","side":"right"},{"sibling":"621ce3a316503da6017cc9f955ea0dca3f50bbc1e8fc10ed72f522e60e814e3f","side":"right"},{"sibling":"7cb9b06d4f6372fac19d788263daadfaf6def57cc0a73d46bed8b284ec0fe014","side":"right"},{"sibling":"42ade783b0aede9d0209c5be94ac7979e635da84dd65ecb4d383719029bbe8f4","side":"left"},{"sibling":"143f33d3924b3840fd6dd8ba12566fc35bf86189e663ef0ad4884d676f295e3a","side":"left"},{"sibling":"b1ed99341c327c7c9ab2489f40af2547ab3b3b4b6a74fb684210164fb891a413","side":"right"},{"sibling":"6ee3be9bdfc9bee55d32f7dbb0075f02fe87d20887d563d3e300caf36b1b88c7","side":"left"},{"sibling":"8ccd9937a2c0d5c04044d07d1557791b7d07bb31eac41a39a675608d44b38f23","side":"right"},{"sibling":"3a5e69cf0803f4c91f3895ed7c9a95748fef240bec4422e167c05300f79f06c0","side":"left"},{"sibling":"f2817ab288b5324fe49770372c7a10f33f7cd11005f8d4c0a730316f5229dc98","side":"left"},{"sibling":"725fac972e772ca0dc598810ea1abc70df472f72d2d6ab8a0baee2b80e5d2f4c","side":"left"},{"sibling":"98fc57dfef8873b512edc8340f7181df57302bb96777625e072235c62d7c5895","side":"right"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":134292,"merkle_root":"77fc9c28fae777b81da5b495b3115474df6592dfac590333213d3bdf8b94a9b3","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260515T023701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-05-15T02:37:25Z","sig_algorithm":"ed25519","signature":"68107a834b00b24f5d4501e5ec727445311f132a486567ecc4c72a4e6dff24c8c21f2de3105293353ba5fdbe370d032819af6aa70f694e2e39b6af6737507009","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_86c0cc9f96d367eb7f94bb0faf9f30ffd74e90cae5d8123d5f3762e99192ff27"}}