Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
This research paper examines why classical empirical risk minimization (ERM) performs well on open set domain adaptation (OSDA), a setting with unknown target classes and shifted distributions. The authors introduce the fully informative causal invariance model (FICIM) and the partially informative causal invariance model (PICIM), and derive an OSDA theoretical bound showing ERM performs well under FICIM but poorly under PICIM. Experiments on multiple datasets validate these results, which the authors suggest may also inform training and fine-tuning of large language models (LLMs).
This paper presents NatIMG-FL, a federated learning framework for classifying X-ray images across healthcare institutions without sharing sensitive data. It uses natural images as auxiliary supervised data to align feature distributions between natural and X-ray images, and introduces a dual weights-based knowledge transfer method to handle heterogeneous model architectures.
FedWeight is a density-aware adaptive weight optimization method for federated learning that targets data heterogeneity across clients with non-IID data. Each client adjusts its loss function weights per class, using density estimated by kernel density estimation, and assigns larger weights to sparse classes. The authors report theoretical analysis and experiments showing more accurate models and faster convergence than integrated baseline approaches.
The paper proposes Feature-space Planes Searcher (FPS), an unsupervised domain adaptation framework that corrects decision-boundary misalignment while keeping a pre-trained feature encoder frozen. It argues this avoids the cost and unpredictable distortions of fine-tuning, and adds an Intra-Class Distance Metric (ICDM) for label-free hyperparameter selection. The authors report competitive benchmark results and applications including protein structure prediction, remote sensing classification and earthquake detection.
Researchers examined whether controller actions at the joint level of a robot can be inferred from encrypted network traffic. The source text provided is limited to the title, publication details and authors, so the method and findings are not described.
Researchers propose a triple-chain architecture for sensitive thumbnail-preserving encryption (TPE), arguing that existing TPE schemes encrypt pixels, blocks, or channels independently, which creates security vulnerabilities. The design links three encryption chains at the pixel, block, and channel levels, so any minor change to the original or encrypted image produces completely different encryption or decryption results. The authors report that the approach achieves sensitive TPE while keeping visual usability and privacy protection.
This paper introduces CLLME, a certificateless lattice-based matchmaking encryption scheme for bilateral access control in data sharing. Both senders and receivers specify matching access structures, so decryption requires mutual authorization, and a lightweight authenticity check filters out irrelevant ciphertexts before costly decryption. The authors prove indistinguishability against chosen-plaintext attacks and existential unforgeability against chosen-message attacks under lattice-based assumptions, and report favorable communication and computation efficiency.
The paper proposes Xsyn, a one-stage X-ray security image synthesis pipeline built on text-to-image generation, to avoid the labor-intensive foreground extraction of prior two-stage methods. It adds Cross-Attention Refinement (CAR), which uses the diffusion model's cross-attention map to refine bounding box annotations, and Background Occlusion Modeling (BOM), which models background occlusion in latent space. Experiments report a 1.2% mAP improvement over previous methods and better prohibited item detection across several X-ray datasets and detectors.
Researchers ask whether external groups can evaluate frontier language models by substituting WildChat, a public dataset of about 1 million conversations collected between April 2023 and May 2024, for private production data in their Deployment Simulation technique. They report that WildChat-based predictions of real-world failure rates are surprisingly accurate, typically within roughly 3x error for GPT-5.1, 5.2 and 5.4, despite a 2-3 year data gap. Predictive performance degrades most for more technical and agentic forms of misalignment.
This survey reviews Direct Preference Optimization (DPO), an RL-free alternative to Reinforcement Learning from Human Feedback (RLHF) for aligning LLM policy models with human preferences. It covers theoretical analyses, variants, relevant preference datasets, and applications. The authors categorize recent DPO studies by key research questions and propose future research directions.
OpenAI describes Deployment Simulation, a method that replays privacy-preserving samples of past conversations with a new candidate model before release to preview its behavior. The company says the method improved estimates of undesired behavior rates across multiple GPT-5-series Thinking deployments, surfaced novel misalignment, and reduced models' ability to recognize they are being tested. It can measure behaviors occurring at no less than 1 in 200,000 messages.
Trident is a face forgery detection framework that uses triplet learning in a Siamese network to generalize to forgery methods it was not trained on. It adds domain-adversarial training with a forgery discriminator to learn forgery-agnostic embeddings, and blocks gradient flow from the classifier head to the embedding model to reduce overfitting to forgery-specific artifacts. The authors report effectiveness across multiple benchmarks and ablation studies.
This paper presents a fingerprinting method for text-to-image diffusion models that encodes bit-string fingerprints into the coefficients of a personalized normalization module (PNM), so they can be recovered from any generated image. It adds an anti-collusion mechanism based on lossless function-invariant parameter transformations, which the authors report degrades the generation quality of colluded models, and reports fingerprint extraction accuracy above 99.5% across several T2I generation and editing tasks.
The source is a survey article titled "A Survey of Neural Network Robustness Assessment in Image Recognition," published in ACM Computing Surveys, Volume 58, Issue 12, pages 1-40, in September 2026. The provided text contains only the bibliographic citation and no abstract, method, or findings.
The source is a journal citation for a paper titled "Watermarking for Model Ownership Verification: Invisible at Deployment, Activated by Updates," published in ACM Transactions on Privacy and Security, Volume 29, Issue 3, pages 1-28, August 2026. The source text contains no abstract, method, or findings, so the summary cannot describe the research beyond its title and publication details.