Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
This research presents a new method for generating counterfactual explanations (minimal changes needed to flip an AI model's prediction), which are a type of explainable AI that helps users understand why models make specific decisions. The approach combines physics concepts like energy minimization and simulated annealing (an optimization technique inspired by metallurgy) to find the smallest, most realistic modifications needed to change a model's output, with applications tested in cybersecurity for Internet of Things devices (networked physical devices like sensors and cameras).
This research paper proposes a new cryptographic method for secure data sharing in Internet of Vehicles (IoV, a system where vehicles communicate with each other and road infrastructure). The method uses Certificateless Signcryption (CLSC, a technique that encrypts data and verifies its authenticity without requiring traditional certificates) to allow one sender to securely share customized data with multiple specific receivers while keeping it hidden from others, even across different geographic regions. The proposed approach reduces computational complexity and includes privacy protections through pseudonym generation (creating fake identities).
Mujaz is a system that uses natural language processing (NLP, the field of AI that helps computers understand human language) to automatically clean up and summarize vulnerability descriptions found in public databases. The system was trained on a collection of carefully labeled vulnerability summaries and uses pre-trained language models (AI systems trained on large amounts of text) to create clearer, more consistent descriptions that help developers and organizations understand and patch security issues more effectively.
This paper describes a new watermarking technique (a method to embed hidden ownership markers into AI models) that remains stable when models are fine-tuned (adjusted to perform new tasks) across different domains. The researchers propose a system that automatically adjusts synthetic training samples and watermark embedding based on the specific data, using out-of-distribution awareness (detecting when data differs significantly from expected patterns) to keep the watermark robust while maintaining the model's performance on its actual task.
This paper presents DynMD, a new machine learning model that uses Graph Neural Networks (GNNs, which are AI systems that analyze connected data points and their relationships) to detect malware by analyzing streaming behavioral data (information about what a program does over time). Unlike previous approaches that miss how malware behaviors connect over time, DynMD uses an energy-based method to better understand malware patterns and can detect threats 3.81 to 5.33 times faster than existing systems.
Researchers developed BPDA, a method for finding security vulnerabilities in embedded firmware (software that runs on devices like routers and IoT devices) by tracking how user input flows through code to reach dangerous functions called sinks. The method is faster and more accurate than existing tools, discovering 163 real vulnerabilities including 34 previously unknown ones when tested on firmware from major manufacturers.
Federated learning (a way for multiple parties to train an AI model together without sharing their raw data with a central server) normally requires many communication rounds that waste bandwidth and can leak private information. Existing compression methods reduce communication but ignore privacy risks and fail when some clients disconnect. Octopus addresses these issues by using Sketch (a data compression technique) to compress gradients (the direction and size of updates to a model), adding protective masks around the compressed data, and including a strategy to handle disconnected clients.
Fix: Octopus employs Sketch to compress gradients and embeds masks for the compressed gradients to safeguard them while reducing communication overhead. The scheme proposes an anti-disconnection strategy to support model updates even when some clients are disconnected.
IEEE Xplore (Security & AI Journals)EEG-FE_rrRS is a biometric recognition system that uses brain wave signals (EEG, electroencephalogram) and a fuzzy extractor (a cryptographic tool that converts messy biometric data into secure, consistent digital codes) to create unique digital identities for users in applications like drones and virtual worlds. The system combines EEG signal processing with a fuzzy extractor framework and demonstrates high accuracy in recognizing individuals, achieving nearly perfect results on certain datasets.
Federated learning (a training method where multiple parties collaborate to build an AI model without sharing raw data) is vulnerable to model poisoning attacks (where attackers inject harmful updates during training to break the model). This paper proposes MSDFL and HMSDFL, new defensive approaches that strengthen models by improving their stability, meaning they become less sensitive to small changes in their internal parameters, making them more resistant to these poisoning attacks.
Fix: The source explicitly describes the solution: 'we introduce a new method named Model Stability Defense for Federated Learning (MSDFL), designed to fortify the defense of FL systems against model poisoning attacks. MSDFL utilizes a minmax optimization framework, which is fundamentally linked to empirical risk for exploring the effects of model perturbations. The core aim of our approach is to minimize the norm of the model-output Jacobian matrix without compromising predictive performance, thereby establishing defense through enhanced model stability.' The paper also proposes 'a refined version of MSDFL, named Holistic Model Stability Defense for Federated Learning (HMSDFL), which considers model stability across all output dimensions of the logits to effectively eradicate the disparity in model convergence speed induced by MSDFL.'
IEEE Xplore (Security & AI Journals)Millimeter-wave radars (mmWave, sensors that use radio waves to detect objects) used in autonomous vehicles can be tricked by attackers who send false signals to distort what the radar perceives, potentially causing dangerous driving behavior. AttackDeceiver is a new anti-spoofing system (a defense against false signal attacks) that uses a phase-shifted interleaving waveform (a specially designed radio signal pattern) to detect fake targets by comparing readings from two independent channels, and it also tricks adaptive attackers into creating unrealistic fake objects that are easier to identify.
Fix: The source describes the AttackDeceiver system itself as the mitigation. It works by comparing range and velocity estimates from two independent virtual channels to detect and mitigate spoofing attacks, and by inducing attackers to generate false targets with unrealistic velocity fluctuations that can be identified. The prototype achieved false target recall exceeding 97.9% and signal-to-interference-plus-noise ratio enhancement exceeding 13.46 dB.
IEEE Xplore (Security & AI Journals)Researchers demonstrated a flow correlation attack against Nym, a mixnet (a network system that hides which user is communicating with which destination by routing traffic through multiple nodes). By analyzing the pattern and rate of data packets, an attacker controlling entry and exit gateways can use a neural network (a machine learning model inspired by how brains process information) to match incoming flows with outgoing flows with very high accuracy. The study tested five defense strategies and found that using the right combination of countermeasures at appropriate scales can meaningfully reduce the attack's effectiveness.
Fix: The source states: 'the right choice and scale of countermeasure(s) can offer meaningful protection' and mentions that 'five evaluated defense strategies' were tested. However, the source does not explicitly specify which countermeasures to implement, their names, configuration details, or version updates. The text only notes that 'steps a mixnet such as Nym can take to make our attack both less likely and less accurate' exist but does not detail them.
IEEE Xplore (Security & AI Journals)Researchers discovered that hyper-parameters (settings that control how a deep reinforcement learning model learns and behaves) can be leaked from closed-box DRL models, meaning attackers can figure out these secret settings just by observing how the model responds to different situations. They created an attack called HyperInfer that successfully inferred hyper-parameters with over 90% accuracy, showing that even restricted AI models may expose information that was meant to stay hidden.
PrivESD is a new system that allows machine learning classification (logistic regression, a technique for categorizing data) to work on encrypted streaming data (continuously flowing information that's been scrambled for privacy) while stored in the cloud. The system splits the computational work between cloud servers and edge devices (computers closer to where data originates) to reduce processing burden and privacy risks, and uses special encryption methods that still allow the system to compare values without revealing the actual data.
Hard sample mining (HSM, a technique for selecting the most difficult training examples to focus a model's learning) has emerged as a method to improve how efficiently deep neural networks (AI systems based on interconnected layers inspired by brain neurons) train and make them more robust to errors. This survey article reviews different HSM approaches and explains how they help address training inefficiency and data distribution biases (when training data doesn't represent real-world scenarios fairly) in deep learning.
Researchers created a method called UTE-SS (Unlearnable text examples generation via syntax-oriented shortcut) to protect text data from being used to train AI models without permission. The method adds small, hard-to-notice changes to text by altering its syntax (grammatical structure) so that language models learn misleading patterns instead of useful information, making the text data effectively useless for training.
FedMPS is a federated learning (FL, a technique where multiple computers train an AI model together without sharing raw data) framework that addresses performance problems caused by data heterogeneity (differences in data across participants). Instead of exchanging full model parameters, FedMPS transmits only prototypes (representative feature patterns) and soft labels (probability-based output predictions), which reduces communication costs and improves how well models learn from each other.
This paper presents a new system for 3-D multiobject tracking (MOT, a technique where AI follows multiple objects moving through 3-D space) used in autonomous vehicles to improve safety. The system uses a voxel masking encoder (a method that processes 3-D space divided into small cubes, focusing on important features while ignoring empty space) and deep hashing (a technique that converts objects into compact numerical codes for fast comparison) to better track distant objects, partially hidden objects, and similar-looking objects. The method was tested on the KITTI dataset (a standard collection of driving videos used to evaluate autonomous vehicle systems) and showed better tracking accuracy than existing methods.
This research paper identifies security weaknesses in a previous key exchange protocol (a method for two systems to securely agree on a shared secret) used in smart grids, specifically showing it is vulnerable to offline password-guessing and key compromise impersonation attacks (where an attacker tricks one party into thinking they are the other party). The authors propose a new, lightweight protocol that fixes these issues by using the Solana blockchain to manage keys and requiring smart meters to perform only simple operations like hashing (converting data into fixed-size codes) and encryption.
Fix: The paper proposes a decentralized ultra-lightweight AKE (authenticated key exchange) protocol that leverages the public Solana blockchain to enhance transparency and enable simple key revocation, with the SMD (smart metering device) performing only hashing, symmetric encryption/decryption, and physical unclonable function operations. However, this is a research proposal rather than a patch or update to existing software, so no software mitigation version or download link is provided.
IEEE Xplore (Security & AI Journals)This research proposes Leaper, a framework that helps mobile workers in crowdsourcing tasks (where many people contribute data from their phones) protect their location privacy while still completing work. The system uses differential privacy (a mathematical technique that adds noise to data to prevent identifying individuals) and k-anonymity (mixing a person's data with others so they can't be singled out) to obfuscate, or hide, each worker's actual location, and then compensates workers fairly based on the privacy risk they accept.
This research paper proposes FedNK-RF, an algorithm for federated learning (a decentralized approach where multiple parties train AI models together while keeping their data private) that handles heterogeneous data (data that differs significantly across different sources). The algorithm uses random features and Nyström approximation (a mathematical technique that reduces computational errors) to improve accuracy while maintaining privacy protection, and the authors prove it achieves optimal performance rates.