Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,040 items
Large language models (LLMs) can mimic human language in general and are now showing nuanced, idiosyncratic human behavior. This could expand their use in research and reduce the influence of human subjects. It also bears on AI alignment and the technology's role in society.
This study examines how artificial intelligence can protect online social communities from cyberbullying, which the source describes as a significant problem harming people's mental health. It surveys several AI technologies, their applications, and the obstacles to addressing the problem. The aim is a complete overview of how AI can create safer online environments, along with future direction.
This article presents a post-hoc insider threat detection framework that combines an explicit graph built from predefined rules with an implicit graph derived from feature similarities via the Gumbel softmax trick. Both graphs feed separate GCNs, then an attention mechanism and a Bi-LSTM model user behavior over time. On the CERT r5.2 dataset it reports an AUC of 98.62, a 100% detection rate and a 0.05 false positive rate, and on the harder r6.2 dataset an AUC of 88.48, an 80.15% detection rate and a 0.15 false positive rate.
Researchers propose most overestimated Q value regularization (MQR), an offline reinforcement learning algorithm for high-dimensional discrete action spaces. MQR penalizes the action with the most overestimated Q value rather than applying uniform penalties across the whole action space. On a robotic pushing and grasping task, it reached a 96.94% clearance rate in simulation and 99.04% in real-world dense configurations, and the code is publicly available.
This paper presents PIRS, a two-server offline/online private information retrieval scheme with small client storage. In an offline phase the client preprocesses a database replicated on two servers into query-independent hints, then retrieves any record during an online phase without exposing its index, with sublinear server-side computation. PIRS lets the client outsource the hints to the servers using secret sharing rather than storing them, reducing local storage from GB/MB to MB/KB, and a proof-of-concept prototype measures computational, communication and storage overheads.
The paper proposes LigSecOTA, a lightweight over-the-air software update scheme for automotive ECUs. It replaces certificates tied to physical identifiers such as the VIN with a one-machine-one-certificate digital identity system based on bit time information. The authors formally verify its security properties with ProVerif and report lower computation and communication overhead than state-of-the-art secure OTA updates on an NXP LS1028A platform.
ChargerWhisper is a side-channel attack that uses inaudible high-frequency sounds from a fast charger's inductors, capacitors and transformers to infer private information on a charging phone. The sounds correlate with the charger's output power, which shifts with the user's activity. The researchers demonstrated a website fingerprinting attack and a PIN inference attack on off-the-shelf devices, reporting robust performance across diverse usage settings.
This paper proposes a lightweight, scalable authentication protocol for VANET communications spanning six modes, including Vehicle-to-EdgeRSU, Vehicle-to-Vehicle and User-to-Distributed Server. It combines elliptic-curve cryptography, hash-based commitments and ephemeral key exchange to provide mutual authentication and end-to-end confidentiality. The authors report formal and informal security assessments and performance benchmarking, claiming strong resistance to prevalent threats and efficiency for real-time vehicular deployment.
The authors prove that a general family of spurious local minima exists in the loss landscape of deep CNNs with strictly convex losses and ReLU activations, for arbitrary architectures. They build the minima by pairing a local minimum with a second parameter point of equal empirical risk, then design a deterministic optimizer that escapes local minima. On CIFAR-10, CIFAR-100 and ImageNet-1k, it beats SGD or Adam in accuracy by 0.27% on average across CNNs, ResNets, MLPs and transformers.
Researchers propose FPSE, a fully perturbed self-ensemble framework that combines a cascaded parallel CNN-transformer for semisupervised medical image segmentation. The method applies data, model, and feature perturbations and feeds CNN-extracted shallow local features to the transformer, which reduces its need for labeled data. With only 5% labeled data on the automatic cardiac diagnosis challenge and AbdomenCT-1K, and 1% on ISIC2018, FPSE outperforms prior state-of-the-art methods by 11.5%, 0.7% and 2.4% in Dice score, respectively.
This paper proposes PDRU, a privacy-preserving dual reputation updating scheme for vehicle platoons. It uses a dual reputation model to resist single reputation attacks, and a multi-dimensional evaluation framework where following vehicles score the leading vehicle with weighted-average feedback. The authors report, through theoretical analysis and simulation, a strong balance between robustness, privacy, security, and efficiency, with lower computation and communication overhead on the Trusted Authority side.
MDA-SMuSha is a multi-dimensional data aggregation scheme for smart grids that uses Shamir's multi-secret sharing so smart meters perform only one Paillier encryption. The source reports that rigorous security analyses show it satisfies privacy-preservation, authenticity, data integrity and fault-tolerance requirements. Theoretical analyses and experiments indicate it has lower computation costs than state-of-the-art methods, with comparable communication costs.
This research paper proposes two enhancements to masking-differential prompting (MDP), a defense against backdoor attacks on pre-trained language models under few-shot, prompt-based learning. The authors replace KL divergence with Jensen–Shannon divergence, which stays finite when anchor set density is low, and add an adaptive threshold method that searches automatically using a false rejection rate (FRR) allowance instead of costly manual ROC/AUC threshold selection. The authors report that the method defends better against typical backdoor attacks on text classification and generation benchmarks.
Researchers studied why combining adversarial training with federated learning can degrade robust accuracy at later training stages. They found that adversarial data generated locally increases data heterogeneity among clients. They propose Slack Federated Adversarial Training (SFAT), which assigns client-wise slack during aggregation, and an extension, SFAT*, with hierarchical aggregation for mixed standard and adversarial clients.
Researchers propose SIAMD, a structural-information adversarial framework that models bot behavior and detects bots proactively. It organizes multi-relational interactions into a heterogeneous graph, uses structural entropy to find layered account communities, and uses large language models to generate synthetic messages that evolve the network. Experiments on real-world datasets report that SIAMD significantly and consistently outperforms state-of-the-art social bot detection baselines in effectiveness, generalizability, robustness, and interpretability.
This systematic review categorizes Gradient Inversion Attacks (GIA) on Federated Learning (FL) into three types: optimization-based (OP-GIA), generation-based (GEN-GIA), and analytics-based (ANA-GIA). The authors evaluate each type's effectiveness, practicality and detectability. They find OP-GIA the most practical setting despite weak performance, while GEN-GIA and ANA-GIA are impractical due to dependencies and easy detection.
Fix: The authors offer a three-stage defense pipeline for users designing FL frameworks and protocols, but the source text does not give its stages.
IEEE Xplore (Security & AI Journals)Researchers propose Inner-Probe, a lightweight framework that estimates how much copyrighted subdatasets influence LLM-generated text. Instead of relying only on text, it trains an LSTM-based network on multihead attention (MHA) results during output generation to analyze subdataset contributions. It also detects noncopyrighted text via a concatenated global projector trained with unsupervised contrastive learning. Reported results include 3× efficiency over semantic model training on Books3, 15.04%–58.7% higher accuracy than baselines on the Pile, and a 0.104 AUC increase for noncopyrighted data filtering.
The AIBOM Generator, an open-source tool that produces an AI Software Bill of Materials in CycloneDX format for models on Hugging Face, was contributed to the OWASP GenAI Security Project and now exists as the OWASP AIBOM Generator. The project is improving AI-relevant field checks, completeness scoring and automated extraction, and is developing the OWASP AIBOM Generation Handbook.
Marcus Williams, Cameron Raymond and Micah Carroll describe a pipeline that uses de-identified ChatGPT production traffic to build realistic alignment evaluations. The method resamples the final model response from each conversation and labels the new responses with LLM monitors, either to discover unknown misaligned behaviors or to estimate how often known ones occur. The authors note the pipeline depends on a monitor's ability to detect undesirable behaviors and cannot guarantee catching all of them.
Researchers propose a steganographic method that embeds secret data into neural network models during compression, covering quantization, pruning and distillation. A separate extraction network lets a receiver recover the hidden data while ordinary users remain unaware of it. The paper reports reduced model size and inference time, high accuracy, and evaluates capacity, security and robustness for steganography.