Research

Visual Large Models (VLMs, AI systems that understand images and are used in self-driving cars) need protection from intellectual property theft, but traditional methods like watermarking hurt their performance. This paper proposes a new protection framework using zero-knowledge proof (a technique that proves something is true without revealing the actual information), which includes a fingerprinting method that improves the ability to detect stolen models without harming the AI's ability to perceive traffic scenes, and a verification protocol called zk-DeepIP that protects both the model and test data from leakage during verification.

This academic paper introduces CEMT (Cyber Evaluation and Management Toolkit), a framework for assessing the cybersecurity reliability of complex systems, particularly those using AI capabilities. The toolkit helps evaluate whether AI-powered systems are secure enough to trust for critical tasks, addressing the challenge that traditional security testing may not fully capture risks in advanced AI systems.

Object detectors used in safety-critical systems are vulnerable to physical adversarial patch attacks (images or objects designed to fool AI vision systems), which work by disrupting how information flows through layers of the neural network rather than simply corrupting visual features. The paper proposes CaDe, a defense method that uses hierarchical stability constraints and adaptive sparse causal decoupling to stop adversarial perturbations from propagating through the network layers, improving detection accuracy by 5-6% against these attacks while maintaining real-time performance.

Adversarial training (a method where AI models learn to defend against adversarial attacks, which are inputs designed to fool the model) typically requires expensive multi-step calculations, so researchers use single-step versions to save computing power. However, single-step methods create some misleading adversarial examples, called "fakers," that actually weaken the model instead of strengthening it. This paper proposes FAST (Faker-Alleviating Single-step adversarial Training), which reduces the impact of fakers during training by dynamically adjusting how the model learns from difficult examples and introducing auxiliary samples to stabilize the training process.

Vision-Language Pre-training Models (VLPMs, which are AI systems trained to understand both images and text together) are vulnerable to adversarial attacks (input tricks designed to fool AI systems). This research shows that simpler attack methods can actually work better than complicated ones, and proposes SimVLA (Simple Vision-Language Attack), a streamlined approach that improves how well attacks transfer between different models while using less computing power.

Vision Language Models (VLMs, which are AIs that process both images and text) are vulnerable to jailbreak attacks (techniques that trick an AI into ignoring its safety guidelines). Existing defenses either reduce the model's usefulness or slow it down significantly. SafeSteer is a proposed defense method that uses singular value decomposition (SVD, a mathematical technique for breaking down data into simpler components) at inference time (when the model is running, without changing its internal weights) to identify and remove harmful instructions while keeping the model's normal abilities intact, achieving over 60% reduction in attack success rates with minimal slowdown.

Researchers discovered a new backdoor attack called Spa that can secretly compromise federated learning systems (distributed AI systems where multiple parties train a model together while keeping their data private). Unlike previous attacks, Spa hides malicious code by blending it with the legitimate learning process and uses adaptive triggers that change over time to avoid detection and remain effective for hundreds of training rounds.

This academic paper describes a security system designed to protect data stored across multiple cloud providers by combining certificateless cryptography (a encryption method that doesn't require digital certificates), blockchain (a distributed ledger technology), and deduplication (removing duplicate copies of data). The scheme aims to resist backdoors (hidden access points inserted by attackers) while allowing organizations to verify that their data hasn't been modified.

Decision tree classification (a machine learning method that makes predictions by asking yes/no questions about data features) is often run on cloud servers, creating privacy risks. Researchers found that SecDT, a framework designed to protect these systems using secret-sharing (splitting sensitive information into pieces so no single party can see it), has a vulnerability where the attributes (features) used in decision trees can leak to unauthorized parties. The researchers proposed four improved versions (SecDT+v1, SecDT+v2, SecDT+vH, and SecDT+vDP) that hide these attributes using mathematical techniques.

Customized LLMs (large language models built by third parties and then modified for specific use) are vulnerable to backdoored instructions, which are malicious hidden rules embedded in the system that can make the AI follow attacker commands without being detected. This paper introduces a Black-box Safety Auditing Agent that uses metacognitive probing (making the AI think deeply about its own reasoning to expose hidden triggers) to identify and remove these malicious triggers from user queries, preventing the backdoor from activating.

Machine learning-based malware detectors need frequent updates to handle new threats, but retraining from scratch with billions of samples is impractical, so continual learning (machine learning that learns incrementally from new data without forgetting old knowledge) is used instead. However, this research identifies a critical problem called security regression: even though overall detection performance may improve, some malware samples that were previously caught stop being detected after an update, silently reintroducing old threats. The researchers propose Positive Congruent Training (PCT), a regression-aware framework that integrates with existing continual learning strategies and reduces security regression by about 50% while maintaining strong overall detection performance.

Quantum federated learning (a machine learning approach where multiple computers train a model together using quantum computing) can be weakened by Byzantine attacks (when some computers send bad or malicious data to sabotage the model). This paper proposes a defense method using adaptive clustering, an algorithm that groups similar data points together, to protect quantum federated learning systems from both types of Byzantine attacks happening at the same time, achieving 98% accuracy on image classification tests.

Deep hashing models, which compress images into compact codes for fast retrieval, can be poisoned by backdoor attacks (hidden malicious behavior triggered by specific inputs) that manipulate their hash codes while appearing benign. Researchers developed HashRuler, a lightweight detection system that identifies these compromised samples by measuring two types of anomalies in the hash codes: how far a sample deviates from its class's typical hash center, and how it behaves as an outlier compared to nearby samples.

CVFL-Pro is a new federated learning framework (a system where AI models are trained across multiple computers without sharing raw data) that prevents malicious servers from cheating during model training while reducing communication costs. The framework uses cryptographic techniques like Shamir's secret sharing (a method to split secrets so no single party can reconstruct them alone) and an adaptive compression algorithm that automatically adjusts how much data is sent based on gradient changes, achieving up to 95.81% reduction in communication overhead compared to existing methods.

Researchers developed a new attack method called Perspective-Invariant Attack (PIA) that generates adversarial examples (inputs crafted to fool AI models) with improved transferability across different neural networks. By using geometric transformations that simulate different viewpoints (perspective changes), PIA makes adversarial perturbations (small, intentional changes) less dependent on the original model they were designed to attack, allowing them to more successfully fool other models including large language models.

The LLL algorithm is a mathematical tool used to break down lattices (multi-dimensional grid structures) into simpler forms, and it's important in cryptography for both attacking weak encryption systems and checking whether newer post-quantum cryptographic systems (like Kyber and Dilithium, which are designed to resist attacks from quantum computers) are truly secure.

This essay traces the history of cybersecurity from its early concepts through modern threats, including state-sponsored attacks and AI-driven threats. It covers major technical advances, significant security incidents, and cultural influences to show how cybersecurity has evolved as an ongoing competition between defenders and attackers.

The article argues that privacy protection needs to expand beyond just protecting your actual personal information to also protecting your 'statistical me,' which is the version of you that AI systems create, store, and use to make decisions about you. This shift matters because AI models infer and build detailed profiles about individuals based on data, and these AI-generated representations can be used to take actions that affect your life, even if they don't match who you really are.

This article introduces contextual integrity (CI), a privacy framework based on philosophical ideas that offers a different approach to defining privacy than traditional methods. Traditional privacy definitions have been inadequate for addressing new threats from modern digital technologies and have led to ineffective regulations, making CI a potentially better alternative.