Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,038 items
Researchers propose C-GAN, a medical image steganography method that hides diagnostic reports inside cover images using a generator, extractor and discriminator trained end-to-end. The method adds a Zero-centered Wasserstein distance for stable training and local regularization on the generator to raise embedding capacity. Experiments on the Open-I, LGK and COV-CTR medical datasets report better capacity, detectability and convergence rate than recent state-of-the-art methods.
This article examines how the topology of a decentralized graph affects the convergence rate of decentralized federated learning (DFL) algorithms. It introduces a tensor-based multiple-gossip-steps method, T-MGS, which uses gossip tensors to guide information flow between sites and minimizes the second-largest absolute eigenvalue of the equivalent gossip matrix. Experiments on simulated and real datasets show T-MGS reduces communication rounds without compromising model accuracy.
Co-Boosting++ is a one-shot federated learning framework that couples synthetic data generation with ensemble construction, so each improves the other across iterations. It fixes the ensemble to generate adversarial hard samples, then uses a Mixture of Experts mechanism to reweight the ensemble based on those samples. The authors report consistent gains over state-of-the-art methods on benchmark datasets and state that it needs no local training modifications, extra transmissions, or client architecture restrictions.
ARGO, a method by Paloma Sodhi, Yueheng Li, Jessica Landon, Eric Wallace and Kai Chen, distills black-box reward models into interpretable rubrics using reinforcement learning. It searches over rubrics to maximize agreement between a rubric-conditioned LLM judge and the reward model's preference probabilities. The excerpt does not report the main findings or their numbers.
The paper proposes HAVEN, a hybrid anomaly detection system for Intra-Vehicular CAN-bus communication that combines rule-based techniques with machine learning and neural networks in binary and multiclass forms. The authors report high detection accuracy, low execution time and a high F1-score across different datasets, with the neural-network model performing best.
The paper presents MagLive, a voice liveness detection scheme for smartphones that targets replay spoofing attacks, where recorded voice is played through loudspeakers to bypass voice authentication. It uses magnetic pattern changes captured by the built-in magnetometer, processed by a TF-CNN-SAF feature extractor with supervised contrastive learning, and reports an average balanced accuracy of 99.01% and an equal error rate of 0.77%.
FreqTransNet is a deep learning image watermarking model that combines convolutional modules, Transformer structures and frequency-domain transformations. The authors report that it outperforms existing state-of-the-art deep learning watermarking approaches in visual quality and robustness. Compared with the best-performing baseline, it raises PSNR by 3.09 dB (from 47.46 dB to 50.55 dB) and keeps extraction accuracy above 97% under various attack scenarios.
This research article proposes RASE, a privacy-preserving data aggregation paradigm for IoT devices, as an alternative to earlier schemes that relied on a trusted fusion center or on local perturbation by contributors. RASE runs three steps: noise addition through a differentially private randomizer, random permutation by a shuffler that breaks the link between senders and receivers, and parameter estimation from the noisy data. The authors report extensive simulations exploring the privacy-utility trade-off of RASE.
This paper presents NiIas, a non-interactive protocol for instant authentication and secure data delivery in Multi-access Edge Computing. It sends payloads without prior handshakes and uses a multi-authorization identity-based cryptosystem to avoid certificate management. Its authenticate-before-decryption step filters unauthorized traffic before decryption, and simulations and M/D/1 queuing analysis report superior availability and stability over state-of-the-art protocols.
Researchers propose TCroS, a traceable cross-domain data sharing scheme for Internet of Vehicles data, which generalizes CP-ABE via proxy re-encryption so ciphertexts from one domain can be transformed for authorized requesters in another. Requester identities are embedded in decryption keys using Boneh-Boyen signatures, so any party can trace the source of a leaked key without a universally trusted authority. An extension, TCroSS, adds privacy-preserving expressive keyword search with Boolean queries, and the authors report IND-SCPA and IND-SCKA security with overheads comparable to single-domain settings.
The paper proposes PADRE, a privacy-aware decentralized randomness beacon that conceals participants' identities while generating randomness. It introduces the anonymous threshold verifiable random function (ATVRF), built on VRFs under the Decisional Diffie-Hellman assumption on elliptic curves, and adds an anonymous lottery to committee-based DRBs. A proof-of-concept implementation produced 102 beacons per minute on average across 64 nodes.
Researchers present the first semi-automatic study of exploitable non-control data in the Linux kernel's file system, using a custom static and dynamic analysis and testing framework. They categorize candidate file system objects by exploit strategy, including a method to overcome defenses that isolate many of these objects. The authors evaluate the objects against 18 real-world CVEs and build 10 end-to-end kernel exploits with all state-of-the-art mitigations enabled.
The article presents NomiGNN, a robust graph neural network framework for node classification that defends against label noise. It estimates noise distributions and refines loss optimization during training, and adds an edge-label prediction task using same-label probabilities to limit mis-aggregation from noisy edges. Experiments on five real-world graphs show it outperforms eight benchmark GNN models.
The authors propose FOYF ("focus on your focus"), a cross-domain few-shot semantic segmentation network that addresses domain shift when segmenting novel classes from minimal supervision. It combines several attention specialization modules built on Swin Transformer to model intraobject attributes, interobject associations and cross-scene correspondences, then fuses multigranularity features. The authors report superior performance on CD-FSS benchmarks, though the source text gives no numeric results.
This article studies partial node-based recursive state estimation for complex networks with unknown nonlinearities, where energy harvesting sensors transmit measurements only when their energy suffices for transmission. Neural networks approximate the unknown nonlinearities, and an NN-based recursive algorithm generates state estimates and nonlinearity estimates together. The effectiveness of the algorithm is demonstrated through a simulation example.
The paper proposes FoVB (Forgery-aware Audio-Visual Adaptation with Variational Bayes), a framework for multi-modal deepfake detection. It models audio-visual correlation as a Gaussian latent variable estimated via variational Bayes, using difference convolutions and a high-pass filter to extract forgery traces from both modalities, then factorizes the variable with an orthogonality constraint. The authors report that FoVB outperforms other state-of-the-art methods across various benchmarks.
This paper presents the first adversarial attack and defense framework for Pedestrian Attribute Recognition (PAR), built on a pre-trained CLIP-based PAR framework. The authors propose ASL-PAR, which generates adversarial noise through global- and patch-level semantic and label perturbations, and a semantic offset defense strategy to suppress such attacks. Experiments on the digital datasets PETA, PA100K, MSP60K and RAPv2, along with physical-domain tests, validate both the attack and the defense.
Nappa is a DNN training framework that aims to preserve data privacy while remaining compatible with heterogeneous Neural Network Accelerators (NNAs). It uses a vector decomposition method to allocate operators across NNAs, and a compiler that converts model descriptions into encrypted computation graphs running over trusted and untrusted hardware. The source reports no extra accuracy cost, higher throughput than existing methods, and negligible impact after deployment on a platform with a billion users.
This article comments on APFed, a federated learning method proposed by Chen et al. (2023) that uses additive homomorphic encryption to encrypt each client's gradient, aiming to block information leakage and defend against poisoning attacks. The authors argue that the security proof in the original paper contains a fundamental flaw, and conclude that APFed is insecure.
This measurement study evaluates code generated by five widely used LLM families across Python, Java, C++, and C, using 200 manually curated tasks. Generated code was assessed for compilation success, semantic correctness with 4,000 per-program unit test files, and quality and security with SonarQube and CodeQL. Python and Java showed higher compilation and correctness rates and fewer security findings than C and C++, which showed more memory safety issues, hard-coded secrets, and cryptographic misuses.