Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
SafeSteer is a lightweight inference-time steering framework that defends Vision Language Models against jailbreak attacks without modifying model weights. It uses singular value decomposition to purify a low-dimensional safety subspace from noisy activation differences, then projects the raw steering vector into that subspace. The authors report a reduction of over 60% in attack success rate while maintaining utility on benign tasks.
Researchers propose a dynamic differential privacy scheme for multi-agent electricity trading in smart grids, where agents have heterogeneous privacy needs. The method uses a weighted mutual information risk metric, a Markov decision process model, and adaptive noise injection with a denoising network, and the authors prove it satisfies ε-differential privacy. In simulations it improves privacy protection by 79.11% and 77.76% over fixed-noise and personalized-noise benchmarks, and the denoising network removes 50.97% of the cost increase caused by noise.
Researchers study how code obfuscation affects static analysis methods for detecting malicious JavaScript. They find existing detectors fail against medium-strength obfuscation and propose SeGra, which uses data flow features, random walks and sequence conversion of graph structure. SeGra reaches 99.5% accuracy on medium-strength obfuscated code and 70.4% on low-strength code, with 67.1% on high-strength code after learning from low-strength samples.
The paper presents SecArchive, a Provable Data Possession (PDP) scheme for multi-cloud, multi-copy archival storage. It deters cloud storage servers from subcontracting storage to third parties, since doing so would expose their private key. Tag generation for d copies costs O(n+d), compared with O(nd) in prior schemes, and auditors can challenge distinct blocks across copies in one query.
Researchers propose CROSS-TEE, a cross-module distributed trusted execution environment architecture for managing interactions between vehicle system modules such as domain controllers and central gateways. The design isolates trusted applications in a trusted house mechanism, requires security checks by a secure monitor or trusted OS before normal-world CAN bus invocation requests are approved, and encrypts Ethernet traffic through a pre-transmission protocol. On Renesas RA6M5 and Raspberry Pi 3 Model B prototypes, the authors report blocking arbitrary CAN bus message injection, unauthorized invocations and malicious in-vehicle Ethernet access, with overheads of about 7.8% for CAN bus communication and 1.73× for encrypted Ethernet.
CVFL-Pro is a verifiable federated learning framework that lets clients check whether a malicious server has falsified aggregation results, without a trusted authority. It combines masking and Shamir's secret sharing for privacy and dropout robustness, a lightweight MAC scheme with auxiliary nodes for verifiability, and an adaptive compression algorithm, AOTop-k. On MNIST, CIFAR-10 and CIFAR-100 it cuts communication overhead by 58.07% versus Top-k and 95.81% versus SecAgg, while maintaining accuracy.
TLCFI-PLC is a lightweight control flow integrity scheme that defends PLCs against RunStage attacks, in which adversaries corrupt memory and hijack control flow to manipulate control logic while the PLC is in Run mode. It works in two phases: offline analysis that uses trampoline-based instrumentation to build a control flow baseline, and online monitoring in which an asynchronous checker reads execution records from shared memory. A prototype on a WAGO PLC running the CodeSys runtime showed instrumentation generally under 5 seconds and average binary-size overhead below 1%.
This paper presents a radio frequency fingerprint identification (RFFI) system for identifying Wi-Fi devices by their hardware characteristics. It removes channel effects from channel state information (CSI) using a spectrum averaging algorithm that exploits a multi-antenna receiver's spatial diversity, then applies a high-order difference algorithm in the logarithmic domain to extract fingerprint features. Tested on a testbed of 12 commercial Wi-Fi devices with a four-antenna USRP X310 receiver, the system achieved 90.28% average classification accuracy, outperforming state-of-the-art methods by 2.97%–9.73%.
This research paper examines security regression in continual learning (CL) malware detectors, where malware detected before a model update evades detection afterward. The authors find that up to 3-6% of malware experiences this regression after updates. They introduce a regression-aware framework, instantiated as Positive Congruent Training (PCT), which halves regression on the ELSA, Tesseract, and AZ-Class datasets while preserving detection performance.
Researchers propose SCPC, a framework for concept erasure in text-to-image models that removes a target concept while preserving semantically close concepts. Existing methods often degrade close-proximity concepts; for example, erasing 'English Springer' may hurt generation of 'Cocker Spaniel'. SCPC samples semantic-agnostic embeddings within a hypersphere around the erased concept, refines sampling with a learnable adversarial offset, and applies a semantic-agnostic knowledge distillation objective. Experiments reportedly show it erases targets while preserving generation quality for both close and distant concepts. Code and data are promised for future release.
Researchers show that transferable adversarial attacks on Vision-Language Pre-training Models (VLPMs) can be simpler and more effective than existing multi-stage pipelines with complicated loss functions. They identify three overlooked issues caused by inappropriate cross-modal interactions and excessive operations, and propose the Simple Vision-Language Attack (SimVLA) pipeline. On the Flickr30k text-image retrieval dataset, SimVLA outperforms the SOTA baseline in R@1 transferability by 8.01%-14.71% while using about 35.73% of the time and 46.26% of the max VRAM.
Deep learning point cloud classifiers are highly vulnerable to adversarial attacks, and existing diffusion-based purification defenses have a distributional gap and a semantic mismatch. The authors propose PANDA, a two-stage framework: PANDA-P trains a dual-branch diffusion purifier on both clean-to-clean and adversarial-to-clean paths, and PANDA-A fine-tunes the classifier with a consistency-driven objective to recalibrate its decision boundary. The source reports consistently superior robustness over existing purification-based defenses on synthetic and real-world benchmarks.
The authors present ParDef, a defense for deep neural networks against diverse parameter attacks, which directly tamper with model weights and persist across inferences. ParDef combines keyed channel reparameterization, QC-LDPC quantization with error correction, and adaptive robust inference. Evaluated on CIFAR-10, CIFAR-100, and Tiny-ImageNet with ResNet and VGG models, plus DeiT on ImageNet-1K and CIFAR-100, it consistently reduces attack success rates while keeping high model performance and moderate deployment overhead.
Fix: ParDef: keyed channel reparameterization, QC-LDPC quantization, and adaptive robust inference, applied to securing at-rest model parameters in DNN deployments.
IEEE Xplore (Security & AI Journals)Researchers identify an attribute leakage flaw in SecDT, a secret-sharing framework for outsourced decision tree inference, where node attributes are exposed to non-owner parties. They propose SecDT+v1 and SecDT+v2, which use the transformation matrix technique to obfuscate attributes, and SecDT+vH and SecDT+vDP, which add dot-product operations to hide attribute access patterns. Evaluations on real-world datasets report better classification latency and bandwidth efficiency than prior solutions.
Fix: The paper proposes SecDT+v1 and SecDT+v2 (transformation matrix obfuscation of node attributes) and SecDT+vH and SecDT+vDP (dot-product operations to hide attribute access patterns) as enhancements to SecDT.
IEEE Xplore (Security & AI Journals)HashRuler is a lightweight detection framework for backdoor attacks on deep hashing models used in large-scale image retrieval. It uses two metrics, Center Similarity Deviation (CSD) and Local Sparsity (LS), to flag poisoned samples by their hash codes, and reports up to 97% detection accuracy against the BadHash clean-label attack across diverse datasets, attack types and architectures.
This paper proposes a robust quantum federated learning method that defends against both colluding and non-colluding Byzantine attacks. It extends DBSCAN into an adaptive clustering-based defense with adaptive weight allocation, serving as a server-side robust aggregation mechanism. In experiments on MNIST and Fashion-MNIST, including label-flipping and backdoor attacks, MNIST accuracy reached 98%, a 38-percentage-point gain over the undefended baseline.
Fix: The proposed adaptive clustering-based defense algorithm, a server-side robust aggregation mechanism for quantum federated learning under mixed Byzantine attack settings.
IEEE Xplore (Security & AI Journals)Researchers present a black-box safety auditing agent that defends customized LLM systems against backdoored system instructions, which are malicious rules hidden in system instructions and need no fine-tuning. The agent uses metacognitive probing, which leverages the model's safety-alignment mechanisms to induce it to reveal predefined triggers, and then sanitizes those triggers from user queries. Experiments across three backdoor attack algorithms and multiple state-of-the-art LLMs substantiate its effectiveness.
Fix: The paper proposes a black-box safety auditing agent that uses metacognitive probing to reveal triggers and sanitizes them from user queries to keep the backdoor inactive. It also covers task-specific and broad-spectrum prompt-based probing, and requiring the model to articulate its reasoning.
IEEE Xplore (Security & AI Journals)Researchers propose SFLBR, a Byzantine-robust secure federated learning framework. Encryption keeps local gradients in ciphertext, which prevents the server from telling honest gradients from malicious ones, so an attacker can inject manipulated gradients into secure aggregation. SFLBR uses the gradient median as a benchmark, a layer-wise cosine similarity metric, and a trust score function, and the authors report state-of-the-art defense performance across diverse attack scenarios in experiments.
This article argues that privacy protection should shift from safeguarding the "real me" as the holder of personal data to safeguarding the "statistical me": the inferred, model-generated version of a person that AI systems construct, remember, and act upon. The author frames privacy as needing to govern data, representation, and action.