Research

CSFlow is a system designed to control how encrypted data (data that's been scrambled so only authorized people can read it) is shared across cloud and edge computing environments (distributed computing systems with servers in different locations). Unlike older systems that only check who is allowed to send and receive data, CSFlow also examines the actual content of messages to prevent authorized users from illegally sharing sensitive information by adding content tags and sender policies to encryption keys.

Machine unlearning is a process that allows AI models to forget the influence of specific training samples, which is important for privacy and safety. Researchers tested whether existing unlearning methods actually work when the training dataset contains similar samples to the ones being removed, and found that most methods fail to completely eliminate a target sample's influence even when compared to retraining from scratch (rebuilding the model from the beginning with the unwanted sample excluded).

Federated unlearning (FUL, a process that removes a user's data influence from machine learning models trained across multiple computers) helps protect privacy by letting users exercise their right to be forgotten. This paper proposes a new framework where an FL server uses game theory (a mathematical approach to modeling strategic decision-making) and prospect theory (a model of how people make decisions under uncertainty) to incentivize clients to keep more data during unlearning while preventing selfish behavior.

This research evaluates how often cosmic ray-induced errors (soft errors, which are random bit flips caused by radiation) occur in GPU-based fully homomorphic encryption (FHE, a technique that lets computers perform calculations on encrypted data without decrypting it first). The study finds these errors happen at a rate of 7.80 FIT (Failures In Time, meaning 7.80 errors per billion hours of operation) and estimates that large matrix multiplication operations could have a 1.6% chance of silent data corruption (SDC, when errors occur but go undetected). To address this problem, the researchers propose using logic circuit-level redundancy (duplicating parts of the computation to check for errors) to detect nearly all silent data corruptions.

Text-to-image models (AI systems that generate images from written descriptions) sometimes memorize harmful concepts that need to be removed, but existing removal techniques accidentally damage the model's ability to generate similar concepts. Researchers propose SCPC, a framework that erases target concepts while protecting semantically similar ones, using a technique called semantic-agnostic knowledge distillation (matching the erased model's output to the original model's output without relying on concept meaning).

Vision Language Models (VLMs, which are AIs that process both images and text) are vulnerable to jailbreak attacks (techniques that trick an AI into ignoring its safety guidelines). Existing defenses either reduce the model's usefulness or slow it down significantly. SafeSteer is a proposed defense method that uses singular value decomposition (SVD, a mathematical technique for breaking down data into simpler components) at inference time (when the model is running, without changing its internal weights) to identify and remove harmful instructions while keeping the model's normal abilities intact, achieving over 60% reduction in attack success rates with minimal slowdown.

Vision-Language Pre-training Models (VLPMs, which are AI systems trained to understand both images and text together) are vulnerable to adversarial attacks (input tricks designed to fool AI systems). This research shows that simpler attack methods can actually work better than complicated ones, and proposes SimVLA (Simple Vision-Language Attack), a streamlined approach that improves how well attacks transfer between different models while using less computing power.

Researchers discovered a new backdoor attack called Spa that can secretly compromise federated learning systems (distributed AI systems where multiple parties train a model together while keeping their data private). Unlike previous attacks, Spa hides malicious code by blending it with the legitimate learning process and uses adaptive triggers that change over time to avoid detection and remain effective for hundreds of training rounds.

Deep learning models that classify point clouds (3D data made of many points in space) are vulnerable to adversarial attacks (carefully crafted inputs designed to fool AI systems). This paper proposes PANDA, a two-stage defense that uses diffusion models (neural networks that gradually transform noisy data into clean data) to purify attacked data and then retrains the classifier to work well with the purified data, addressing limitations in existing diffusion-based defenses.

This research addresses a weakness in malicious JavaScript detection systems: they fail to reliably identify harmful code when it has been obfuscated (disguised through code transformation techniques to hide its true purpose). The authors propose SeGra, a new detection method that uses data flow features (how data moves through the program) and random walk techniques to better identify malicious JavaScript even in obfuscated code, achieving up to 99.5% accuracy on lightly obfuscated code and 67.1% on heavily obfuscated code.

This research proposes a new method for multi-agent reinforcement learning (a type of AI where multiple independent agents learn to make decisions together) in electricity trading systems that protects user privacy while maintaining system efficiency. The approach uses dynamic differential privacy (a mathematical technique that adds controlled noise to data to hide individual information), personalized privacy assessments, and a denoising network (a neural network that removes the noise added for privacy) to balance each user's different privacy needs with the overall performance of the trading system.

This academic paper describes a security system designed to protect data stored across multiple cloud providers by combining certificateless cryptography (a encryption method that doesn't require digital certificates), blockchain (a distributed ledger technology), and deduplication (removing duplicate copies of data). The scheme aims to resist backdoors (hidden access points inserted by attackers) while allowing organizations to verify that their data hasn't been modified.

Deep neural networks deployed across cloud storage, CI/CD pipelines (automated software deployment systems), and edge devices face parameter attacks, where attackers directly modify the model's internal weights and settings rather than just manipulating input data. Unlike previous defenses that require retraining or reduce accuracy significantly, this research presents ParDef, a defense system that protects model parameters by obscuring sensitive directions, adding error-correction capabilities through QC-LDPC quantization (a compression technique with built-in redundancy), and stabilizing predictions when attacks occur.

CVFL-Pro is a new federated learning framework (a system where AI models are trained across multiple computers without sharing raw data) that prevents malicious servers from cheating during model training while reducing communication costs. The framework uses cryptographic techniques like Shamir's secret sharing (a method to split secrets so no single party can reconstruct them alone) and an adaptive compression algorithm that automatically adjusts how much data is sent based on gradient changes, achieving up to 95.81% reduction in communication overhead compared to existing methods.

Secure Federated Learning (a system where multiple parties train an AI model together while keeping their data private) protects user privacy by encrypting gradients (the numerical adjustments used to improve AI models), but this encryption also hides malicious changes from detection. The paper proposes SFLBR, a framework that uses gradient median analysis and cosine similarity metrics (mathematical measurements of how similar gradients are) to identify and filter out manipulated gradients while still keeping data encrypted.

SecArchive is a system that verifies data hasn't been lost or corrupted in multi-cloud storage (where copies of data are kept across multiple cloud providers) while preventing subcontracting attacks, where cloud servers illegally hand storage tasks to third parties. The system uses Provable Data Possession (PDP, a method to verify data integrity without downloading everything), and it's designed to be more efficient than older approaches by reducing computational work when managing multiple copies of archived data.

Deep hashing models, which compress images into compact codes for fast retrieval, can be poisoned by backdoor attacks (hidden malicious behavior triggered by specific inputs) that manipulate their hash codes while appearing benign. Researchers developed HashRuler, a lightweight detection system that identifies these compromised samples by measuring two types of anomalies in the hash codes: how far a sample deviates from its class's typical hash center, and how it behaves as an outlier compared to nearby samples.

Decision tree classification (a machine learning method that makes predictions by asking yes/no questions about data features) is often run on cloud servers, creating privacy risks. Researchers found that SecDT, a framework designed to protect these systems using secret-sharing (splitting sensitive information into pieces so no single party can see it), has a vulnerability where the attributes (features) used in decision trees can leak to unauthorized parties. The researchers proposed four improved versions (SecDT+v1, SecDT+v2, SecDT+vH, and SecDT+vDP) that hide these attributes using mathematical techniques.

PLCs (programmable logic controllers, specialized computers that control industrial systems) are at risk from RunStage Attacks, where attackers corrupt memory to hijack the program's control flow (the order in which instructions execute) and manipulate critical operations. TLCFI-PLC is a proposed defense system that uses trampoline-based instrumentation (a lightweight code insertion technique) to monitor and restrict control flow execution, splitting protection into an offline analysis phase that maps legitimate execution paths and an online monitoring phase that detects hijacking attempts. Testing on real PLCs showed the system adds minimal overhead (less than 1% file size increase) while staying within acceptable performance limits.