Research

This academic survey examines harmful fine-tuning attacks (methods where attackers modify an AI model's training process to make it behave dangerously) and the defenses designed to stop them. The paper reviews different types of attacks, how they work, and various protection strategies researchers have developed to keep large language models safe from this threat.

This academic survey paper examines metrics, or measurement methods, used to evaluate privacy-preserving generative models (AI systems that create new data while protecting personal information). The paper provides a comprehensive overview of different ways researchers measure how well these models protect privacy while still functioning effectively.

This research paper describes a new method for tracking users across multiple databases without exposing their private information. The method, called threshold multi-party private set intersection (T-MPSI, a technique where multiple parties can find matching data without revealing the full datasets to each other), improves the speed of existing approaches by 3 to 6 times, making privacy-preserving user tracking more practical for real-world deployment.

This research presents a method for creating network covert channels (hidden communication paths that bypass detection) in streaming applications like video calls by using a stego-vector model that treats different types of network traffic as independent channels. The approach uses an orchestration algorithm (a coordination system) to manage these channels simultaneously, achieving 3-25% better data transmission capacity and 10% better security compared to existing methods.

This paper presents a new method for publishing data while protecting privacy using differential privacy (a technique that adds noise to data to hide individual information). The method is designed specifically for classification tasks (training AI models to categorize data), and it improves performance by keeping class labels (the correct categories for data records) unchanged and preserving correlations (relationships between different data attributes) using large language models and clustering algorithms.

This research presents a new authentication protocol designed to work with quantum-safe cryptography (security methods that will remain secure even after powerful quantum computers are built). The protocol uses lattice-based algorithms (mathematical approaches based on complex grid structures) for digital signatures and key exchange, and is built to work in resource-limited environments while maintaining forward secrecy (ensuring that even if current keys are compromised, past communications remain protected).

This research proposes a new method for detecting Out-of-Distribution data (inputs that differ significantly from the data an AI model was trained on) by using Kernel Principal Component Analysis, or KPCA (a technique that finds patterns in data using non-linear transformations). The method creates a special non-linear subspace (a mathematical space with special properties) from normal training data and checks if new inputs fit that pattern, while also addressing practical challenges like choosing the right mathematical kernel (transformation function) and handling large amounts of data efficiently.

SALT is a watermarking technique for diffusion models (AI systems that generate images by gradually removing noise from random data) that uses semantic guidance and adaptive latent space truncation to embed hidden ownership marks. The method aims to protect diffusion models from unauthorized use while maintaining the quality of generated images. This research addresses the need for better ownership verification and copyright protection in generative AI systems.

Deep-learning models used for anomaly detection (finding unusual patterns in data) in industrial systems are vulnerable to adversarial attacks (deliberate manipulations designed to fool AI systems). Researchers created NOAE (noise-optimized adversarial examples, a method for crafting attacks on time series data) to demonstrate this vulnerability and proposed HAD (a defensive training approach using adversarial examples to make models more robust).

Text-to-image AI models like Stable Diffusion can create realistic images but their training datasets risk being used without permission, which violates the rights of data owners. Researchers propose a dataset watermarking framework (a technique that embeds hidden markers into data to track and detect unauthorized use) that can detect when datasets are misused during fine-tuning (the process of adapting a pre-trained AI model to a specific task) while keeping the images high-quality and usable. The framework was tested on Stable Diffusion and showed it can reliably identify and trace dataset misuse with minimal changes to the original data.

TabHGIF is a framework for machine unlearning (removing a model's memory of specific training data) on tabular data, which is faster than retraining from scratch but traditionally struggles to preserve both privacy and model accuracy. The method represents tabular data as a hypergraph (a graph structure that captures relationships between multiple features at once) and uses a Hypergraph Influence Function to predict how deleting data will affect the model without needing to access the original data again. In experiments, TabHGIF achieved speedups of 2.18–7.67 times compared to full retraining while maintaining accuracy close to a fully retrained model.

Backdoor attacks compromise AI models by injecting hidden triggers into training data that cause the model to misclassify inputs containing those triggers. This paper introduces Double-Blind Cleanser (DBC), a method that removes backdoors without needing access to clean data or knowing what the triggers look like, using two techniques: catastrophic forgetting (making the model forget the backdoor behavior) and Sharpness-Aware Minimization (SAM, which smooths the model's decision boundaries to restore normal functionality).

Retrieval-augmented generation (RAG, a technique where AI systems pull in external documents to answer questions) enhances large language models but introduces a new security risk: external data extraction attacks (EDEAs), where attackers can trick the system into revealing sensitive or copyrighted information from its knowledge base. Researchers developed an attack called Secret that uses AI-optimized prompts and adaptive strategies to extract data from RAG systems, successfully extracting data from commercial models where previous attacks failed.

Deep neural networks (large AI models inspired by how brains work) can be attacked through data poisoning, where attackers secretly add harmful examples to training data to make the model behave badly. Existing fixes reduce the attack's success but often make the model worse at normal tasks. Researchers propose MicroPatch, which identifies which parts of the model were corrupted by poisoned data and repairs just those parts by using reverse engineering (reconstructing the hidden attack pattern) and influence functions (mathematical tools that show how each piece of training data affected the final model).

This paper addresses security weaknesses in unified frameworks for private set operations (PSO, which are techniques that let multiple parties perform computations on their private data sets without revealing the data itself). Previous frameworks had vulnerabilities to inference attacks because they leaked information about the size of set intersections during operations like union and intersection-sum. The authors propose an improved unified framework that eliminates these leakages by introducing a new building block called permuted batched private membership test sharing, achieving stronger security with acceptable performance trade-offs.

PUFs (Physical Unclonable Functions, hardware devices that generate unique digital fingerprints) are vulnerable to machine learning attacks that can predict their responses if attackers obtain leaked challenge-response pairs (CRPs, inputs and outputs used to test PUFs). This paper presents the TEASE algorithm, which selects CRPs more strategically instead of randomly so that even if attackers leak them, the algorithm forces machine learning models to achieve only about 50% accuracy, comparable to random guessing, while resisting multiple rounds of leaks and powerful attacks.

This research proposes GCLC (Graph-based Contrastive Learning and Clustering), a framework for classifying encrypted network traffic (data sent over networks in coded form) in open-world scenarios where unknown traffic types may appear. The system uses Graph Neural Networks (machine learning models that work with interconnected data) and special learning techniques to identify traffic patterns even when data is imbalanced or new, achieving 95% accuracy at recognizing previously unseen traffic classes.

This research paper proposes a post-quantum secure semantic communication (PQSC) framework that protects data transmission against both eavesdropping and future quantum computing threats. The framework combines learning with errors (LWE, a type of encryption believed to resist quantum attacks) with VQ-VAE (a neural network compression technique) to send information efficiently while keeping it secure. Experiments show this approach works better than existing methods across different network conditions and data types.

Visual recognition systems struggle when objects are viewed from different angles, even though the object hasn't changed. This paper proposes Viewpoint-Invariant Adversarial Training (VIAT), which treats different viewing angles as attacks and trains AI models to handle them better by learning from a distribution of challenging viewpoints. The researchers also created new datasets and evaluation methods to measure how well vision models can handle viewpoint changes.