Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
Wang, Yan, Zhang and Wen propose DEGAN, a dual-enhanced GAN for detecting botnets in industrial IoT networks. The paper addresses imbalanced training data, and was published in the Journal of Information Security and Applications, Volume 100, in July 2026.
This paper studies leaky private information retrieval (L-PIR), where privacy leakage is measured by a pure differential privacy parameter called the leakage ratio exponent. The authors show that the active pure-DP constraints couple adjacent Hamming-weight layers of the random key, so the problem reduces to a layered optimization whose optimum is geometric across layers, requiring only cyclic permutations and assigning higher probabilities to lower-Hamming-weight keys. This yields an O(log K) leakage ratio exponent at fixed download cost D, improving on the previous Θ(K) exponent from prior work.
Researchers propose TS-VulA, a three-stage vulnerability analysis framework for Industrial Internet of Things (IIoT) that combines attack graphs, ModernBERT-based SentenceBERT scoring of exploitation likelihood and criticality, and multi-layer heterogeneous network analysis of device importance. Experiments report average accuracy of 87.86% and average precision of 87.33% for the vulnerability assessment method, exceeding existing methods. Simulated case studies indicate TS-VulA outperforms prevailing vulnerability analysis methods.
Vul-CTG is a multimodal framework for software vulnerability detection that combines code text and program graph representations. It builds enriched graphs from statement-level source code graphs and abstract code property graphs, aligns them with code text through a new architecture called CTG-Former, and uses contrastive learning and pre-training to resist noisy labels. On recent function-level datasets it reports an approximate 3% F1-score improvement over state-of-the-art methods.
The paper presents LBRS, a lattice-based blind ring signature that adapts the two-round SnowBlind protocol from the discrete logarithm setting to lattices while adding ring anonymity. The authors formally prove correctness, anonymity, blindness and one-more unforgeability under lattice assumptions, and implement it in a post-quantum anonymous voting architecture. Experiments report a significant advantage in signature size and comparable time costs.
SilentNoise is a framework for maliciously secure, non-interactive MPC protocols that sample additive DP noise without a trusted curator. After a one-time interactive setup, parties generate an unbounded number of noise shares non-interactively, and incorrect noise from malicious parties is rejected. The protocols reduce utility loss by an exponential factor in the number of computing parties and can reach a constant loss under a strong honest-majority setting.
VOLE-PDRAA is a privacy-preserving data retrieval protocol designed to meet GDPR requirements of lawfulness and data minimization. It builds on Vector-OLE, using a VOLE-blinded identifier and a non-interactive zero-knowledge proof for anonymous authorization and verifiable informed consent, and labeled private set intersection for post-quantum confidentiality. The authors report a UC-framework security analysis and experiments that compare favorably with state-of-the-art work.
This paper proposes two privacy-preserving, fault-tolerant truth discovery schemes for mobile crowdsensing: RsAnonTD, which combines ring signatures with perturbation for stable user sets, and McFeKDeTD, which uses multi-client inner product functional encryption and a lightweight zero-knowledge proof for dynamic workers. Experiments show RsAnonTD and McFeKDeTD cut computational overheads by about 98% and 69%, respectively, compared with RPTD-II.
Michalek, O'Shaughnessy and Wahlstrom published a scoping review in Computers & Security on cyber incident prevention and response for small and medium-sized enterprises. The source text provided contains only the title, publication date and author list, so no method or findings are described.
Researchers propose Trigger without Trace (TwT), a stealthy backdoor attack on text-to-image diffusion models. It uses syntactic structures as triggers to break semantic consistency and applies a Kernel Maximum Mean Discrepancy (KMMD) regularizer to align cross-attention distributions with benign samples. The method reports a 97.5% attack success rate and over 98% of backdoor samples bypassing three state-of-the-art detection mechanisms.
Researchers present Model Defense Variational Autoencoder (MDV), a method against model extraction attacks (MEA), where attackers build a locally trained clone of a deep learning model. MDV replaces realistic auxiliary data, which is often absent, unstable in effect, and leaves some categories less protected, with virtual auxiliary data. The authors say experiments show it addresses these three problems.
Researchers propose the Degradation Consistency Learning Framework to improve deepfake face detection on forgery methods unseen during training. The method exploits degradation inconsistencies between background and manipulated face regions, using a data generation network and a detection network mining both spatial and frequency domain clues, coupled through adversarial training. The authors report effectiveness on benchmark datasets under in-dataset and cross-dataset protocols.
This research presents a hard-label black-box attack on 3D point cloud models, where the attacker can only observe the predicted label of an input. The method builds a class-aware decision boundary through a learnable spectrum-fusion strategy, then uses iterative coordinate-spectrum optimization with curvature-aware boundary search to produce adversarial point clouds with trivial perturbations. The authors report that the attack competitively outperforms existing white-box and black-box attackers in attack performance and adversary quality.
Palladium is a system for training deep neural networks that protects both model parameters and training data while outsourcing most linear layer computations to untrusted GPUs. It uses Trusted Execution Environments to preserve confidentiality and verify integrity, with a Cloak and UnCloak strategy and a stochastic operator verification mechanism that detects breaches outside the TEE with 99% confidence. A prototype built on Libtorch and Occlum, evaluated on four network architectures and four datasets, shows strong security guarantees, reasonable performance overhead, and preserved training accuracy.
PersGuard is a backdoor-based framework that protects pre-trained text-to-image diffusion models from unauthorized personalization. Protectors embed a backdoor before release, so that fine-tuning on protected images triggers predefined protective outputs, while unprotected images cause the backdoor to be removed during fine-tuning. The authors report superior privacy protection over perturbation-based methods across gray-box and black-box settings, multi-object protection, and facial identity protection.
Garland is a federated recommendation scheme built on graph neural networks that addresses the limited one-order subgraphs each user can access. It expands subgraphs using secret-shared shuffle so that both item privacy and user relationship privacy are preserved, with integrity checks against malicious servers. The source states that theoretical analysis supports its privacy and integrity, and that experiments on four datasets show it outperforms state-of-the-art solutions.
This paper extends ROSE, a black-box watermarking protocol for MLaaS settings that quantifies ownership through statistical rarity measured in bits and adversarial computational work. Experiments on CNNs, ResNets and Vision Transformers show primary-task accuracy is preserved at low trigger fractions, watermark recovery is high, and rarity values reach several hundred bits, including under fine-tuning, pruning, quantization and sanitizers such as Neural Cleanse and Neural Laundering. The authors limit their empirical claims to the image-classification architectures they tested.