Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
Researchers study energy-efficient covert communication in adversarial UAV-enabled wireless systems, where a UAV delivers information to a legitimate ground receiver while a malicious detector with noise uncertainty tries to detect it. They maximize covert energy efficiency, defined as achievable covert throughput per unit of energy, by jointly designing transmit power and flying location. The original three-dimensional problem is reduced to a one-dimensional search over the flying angle, and numerical results verify the derivations.
The authors propose SLIMQ, a privacy-preserving scheme for multi-dimensional range queries outsourced to cloud servers. It organizes data with an R-tree, reduces range queries to prefix matching, and uses an adaptive three-party secret sharing scheme with an offline-online mode. The paper reports that SLIMQ outperforms PRQ and TRQED+ in online query efficiency while keeping competitive offline precomputation overhead.
Verifiable Timed Signatures (VTS) let a solver check a timed signature's validity before spending computation, but in existing schemes solving can begin as soon as the signature is received. This is risky in atomic swaps, where a malicious initiator with fast hardware could solve early and threaten the counterparty's funds, while raising the time parameter prolongs lock-up periods. The authors propose Verifiable Encrypted Timed Signatures (VETS), which separate public verification from time-based extraction and allow extraction only after an unlock key is released, tied to an external event such as the publication of a refund transaction.
Existing compromised credential checking (C3) services, such as HaveIBeenPwned and Google Password Checkup, assume the server is fully trusted, so clients may receive unreliable results. The authors propose verifiable C3 (VerC3), which adds query-result verifiability and must be built in a two-server setting, since the authors say the problem cannot be solved with a single server. They build an instance called Have I Really Been Pwned (HIRBP), which takes 136.91 ms per query on a common PC with 86 KB of total bandwidth, and evaluate C3 services against online guessing and breach extraction attacks using 1.4 billion real-world passwords.
Bhra-VITARIT is a weighted atomic swap protocol for obtaining a signature from a t-out-of-m weighted, timed-release threshold service, such as one using BLS, by directly initiating the swap. It needs only minimal signature verification and is compatible with Bitcoin-like systems and many digital signature schemes. The authors' Schnorr/BLS prototype verifies partial evaluation results in O(1) time, taking 8.93 ms regardless of server count, and cuts on-chain gas for 4096 servers on Ethereum from 21M to 786K, a reduction of over 96.3%.
Researchers propose a blockchain-based scheme that combines secure deduplication with integrity auditing for encrypted cloud storage. The design uses random masking to produce unlinkable integrity proofs, protecting user ownership privacy during audits, and a blockchain ledger that records ciphertext-to-owner relationships so deduplication holds when users are offline. A lightweight hash-based probabilistic proof of ownership is added to resist duplicate-faking attacks without full-file verification.
The DRAW paper proposes a two-stage deep watermarking framework that decouples robustness to different distortions so each can be adjusted independently. Stage 1 trains parallel watermark networks per distortion using random orthogonal masks, and stage 2 trains a transformer-based decoder on the frozen embedding network. The authors report superior robustness and adjustability over the state of the art, plus a frequency loss for a better transparency-robustness trade-off.
This research proposes accountable-authority identity-based matchmaking encryption (A-IB-ME), which addresses key escrow and accountability for malicious behavior in IB-ME, where the authority can generate any identity's encryption and decryption keys. In A-IB-ME, the creator of an encipher box or decoder box can be implicated in disputes over key abuse. The authors give a formal definition and construction, a security proof under standard assumptions without random oracles, and a theoretical and experimental performance evaluation. They apply it to privacy-preserving user matching in mobile social networks.
This research measures the terrestrial soft error rate of a GPU-based implementation of TFHE, a variant of fully homomorphic encryption that supports logical operations, using accelerated proton irradiation experiments. The measured rate is 7.80 FIT (Failures In Time) for the decrypted output of a 32-bit adder. Assuming the overall error rate scales proportionally with circuit size, the authors estimate a silent data corruption (SDC) probability of 1.6% for multiplying 500-by-500 matrices.
This paper proposes two hybrid physical-layer authentication schemes for mmWave MIMO beam alignment, a linear weighted combination scheme and a two-threshold combined scheme. They jointly use antenna array mutual coupling and angle of arrival to defend against impersonation attacks. The authors derive detection and false alarm expressions, optimize feature weights under a false alarm constraint, and validate the designs by simulation.
CSFlow is a content-aware flow control system for fine-grained encrypted data sharing in cloud-edge settings. It extends access control encryption (ACE) with a cross-domain scheme, CACE, that tags each message with its content and sets sender policies over attribute vectors and tags. The authors give a formal security analysis of the selective no-read and no-write rules and of soundness for CACE.
Researchers propose a strategic data forgetting scheme for federated unlearning that accounts for a boundedly rational federated learning server. The scheme uses a prospect theory-driven data forgetting game to design a truthful incentive mechanism that encourages clients to retain more data during unlearning. A penalty mechanism discourages selfish behavior, and a zero-payment mechanism aims for equitable reward distribution. Simulations are reported to confirm the scheme motivates high-quality models and improves the accuracy of unlearned models.
AirMask is a defense system that protects WiFi-connected IoT devices from attacks that infer privacy-sensitive user behavior from side-channel fingerprints of wireless frames. Instead of modifying each device, it passively senses fingerprints in the air and injects crafted frames to mask them, operating in a predict-inject-assess loop. The authors report a hardware prototype with Integrated, TAP, and Air modes, evaluated on 90 IoT device types and 53 fine-grained behaviors with negligible bandwidth and latency overhead.
This paper presents the first comprehensive empirical study of synthetic data for Text-Based Person Retrieval (TBPR), which has so far depended on real person images. The authors propose a data synthesis pipeline that runs without any real person data, combining inter-class image generation via automatic prompt construction with intra-class augmentation through text-driven image editing. They test whether synthetic data can replace or complement real data across diverse scenarios, and release the code and a large-scale synthetic dataset at https://github.com/Flame-Chasers/SynTBPR.
This paper proposes CaDe, a defense for object detectors against physical adversarial patch attacks. It argues that patches mainly disrupt operational causal consistency across the layers of a deep neural network rather than corrupting feature values directly. CaDe combines hierarchical stability constraints with adaptive sparse causal decoupling, and reports mAP gains of 6.19% against Hiding Attack and 5.53% against Appearing Attack over the best baseline, with a 0.14% mAP drop on benign samples.
Fix: CaDe mitigates the hierarchical propagation of residual perturbations through hierarchical stability constraints and adaptive sparse causal decoupling strategies.
IEEE Xplore (Security & AI Journals)Researchers examine why single-step adversarial training, a cheaper alternative to standard adversarial training, often suffers catastrophic overfitting under larger perturbations. They identify "fakers," single-step adversarial examples that are learned and correctly classified yet fail to expose true model vulnerabilities, and that degrade robustness, resist learning and diverge strongly from their clean counterparts. They propose FAST, which adjusts label smoothing by learning difficulty and adds a weak-effect auxiliary sample, reporting superior clean accuracy and robustness across various attacks.
The paper shows that server-side adversaries can still manipulate client selection and replay aggregation in existing TEE-aided federated learning protocols, by exploiting TEE limitations, namely state rollback and I/O manipulation. It presents DisT-FL, a distributed system of servers guarded by multiple TEEs that forms an append-only ledger, ensuring operation linearizability against rollback and incorporating inputs from reliable servers against I/O manipulation. In WAN evaluations, DisT-FL counters the attacks, matches single-TEE performance, and delivers a 6x throughput boost over its counterparts.
Fix: DisT-FL: a distributed system of servers guarded by multiple TEEs forming an append-only ledger, ensuring operation linearizability to thwart state rollback attacks and incorporating inputs from reliable servers to mitigate I/O manipulation threats.
IEEE Xplore (Security & AI Journals)EncFormer is a two-party framework for private Transformer inference that combines fully homomorphic encryption (FHE) and secure multiparty computation (MPC). It adds Stage-Compatible Patterns to reduce repacking and FHE–MPC conversions, plus a secure complex CKKS–MPC conversion protocol. On GPT- and BERT-style models, it reports 1.4×–30.4× lower inference-time communication and 1.3×–9.9× lower end-to-end latency than prior hybrid FHE–MPC systems.
Fix: One proposed detection method leverages logic circuit-level redundancy and can detect nearly all SDCs, at the cost of reducing throughput to around 50%.
IEEE Xplore (Security & AI Journals)This paper examines whether existing machine unlearning methods truly remove the influence of target training samples when the training dataset contains many similar samples. Experiments on four constructed datasets for image and language models show a notable gap between expected and actual performance for most existing methods, including the retraining-from-scratch baseline. The authors also explore potential solutions to improve current unlearning approaches.
Researchers propose Spa, a backdoor attack framework for federated learning that aims to be both stealthy and persistent. Instead of training a conflicting secondary task, Spa uses feature-space alignment to fold backdoor features into the primary objective, and it uses adversarial dynamic trigger optimization that co-evolves with the global model. Experiments report attack success rates near 100% with minimal utility loss, and the backdoor stays effective around 900 FL rounds after attacks stop.