Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,040 items
Researchers propose MPS-Fuzz, a fine-grained coverage method for edge-coverage-guided fuzzing that builds on basic block units with multiple predecessors and successors. It adds a separate bitmap to track MPS unit coverage and is implemented on AFL. Across 16 benchmarks from FuzzBench and Unifuzz, after 24-hour runs it explored 9.6% more edges and found 25.7% more bugs than AFL, and it also found a previously unknown bug in a real-world program that received a CVE.
This paper introduces Srchpa, a fully private shortest path computation scheme that protects both the user's location and the server's routing information. Its locally iterative method needs only a single round of interaction between user and server. The authors report formal security analyses showing full privacy even when the server is malicious, plus experiments showing lower computation, communication and storage costs on the user side.
The paper proposes Flexible Linked EXecution (FLEX), a hotpatching technique for real-time embedded systems that avoids reboots. FLEX redirects function calls and global variable accesses through a compile-time generated Control Flow Table (CFT) and applies updates with a double-buffered pointer swap. In experiments it showed about 11% average execution overhead and roughly 17% more flash memory usage.
This special issue editorial examines how evolving information technology and societal trends may shape future work, tasks and jobs. It argues for a futures-oriented research paradigm that projects many possible scenarios, weighs how much each is valued, and identifies steps organizations can take now to reach the futures they want. The editorial also introduces the special issue articles and suggests areas for further research.
This paper proposes an optimal control framework for (ε, δ)-differentially private federated learning that jointly and adaptively sets the DP noise variance and the number of communication rounds, based on training accuracy. The authors derive the optimality gap under this framework. In experiments on MLP, CNN and ResNet-9 models, the framework lets DP-FL converge faster and reach better accuracy than existing techniques at a given privacy level.
This paper studies AS-level topology inference for path-aware networking (PAN) with prefix-deterministic path identifiers (PIDs), such as those used by CoLoR, where PID-Prefix identifies inter-domain paths and PID-Suffix is reserved for security functions. The authors propose an Alternating Expanding and Checking (AEC) algorithm that iteratively builds a tree-like AS-level topology from in-packet PIDs. In experiments on an empirical Internet topology of 201 ASes, AEC reached 99.6% accuracy when the observer received only 30 packets from each AS.
Mimi is a multi-keyword search scheme for encrypted data that adds two-factor verification, aiming to fix weaknesses in existing privacy-preserving retrieval schemes. It uses a dynamic verification tree to check returned results, an encrypted searchable inverted index with sub-linear search time, and a secure symmetric key exchange protocol. The authors report security analysis and empirical evaluations but give no numbers in the source text.
Researchers propose DIST, a disentangled spatiotemporal graph neural network framework for traffic forecasting under distribution shifts caused by exogenous factors. The method explicitly separates latent invariant variables from dynamically evolving spatiotemporal dependencies, and a graph perturbation module simulates topology variations during training. The paper reports that comprehensive real-world experiments demonstrate the approach's superiority, with source code published on GitHub.
This paper proposes a Bayesian attack graph method for large-scale, active intranet security assessment. It extracts system audit logs to capture real-time changes, generates attack graphs with MulVAL, and removes weak dependencies to find direct-risk paths. Tested on an enterprise intranet using logs from over 1,000 hosts, it reports intranet risk values at any given time and identifies specific, observable potential attack paths.
Researchers propose a training method that detects poisoned samples in the early stages of training and removes the backdoor by retraining the classifier part of the model on relabeled poisoned samples. Evaluated against twelve attacks on four datasets, it reduced the average attack success rate to 0.07% while lowering average accuracy by 0.33%.
Fix: The proposed defense detects poisoned samples early in training and removes the backdoor by retraining the classifier part of the model on relabeled poisoned samples.
IEEE Xplore (Security & AI Journals)This research introduces Dynamic Attention Analysis (DAA), a backdoor detection method for text-to-image diffusion models that tracks how cross-attention maps evolve over time rather than relying on static features. The authors report that backdoor samples show distinct evolution patterns at the $ $> token compared to benign samples. Across six backdoor attack scenarios, their DAA-S method achieved an average F1 Score of 79.27% and an AUC of 86.27%, surpassing existing detection methods.
This exploratory qualitative study evaluates an AI-driven metaverse prototype designed for cybersecurity training, with feedback from 53 cybersecurity professionals. The authors identify challenges in operationalizing the agentic metaverse, a convergence of immersive metaverse platforms and multi-agent systems, and offer six recommendations with emphasis on implementation and governance.
Fix: The source states six recommendations to guide operationalization of the agentic metaverse, with emphasis on implementation and governance considerations, but does not list their specific content in the provided text.
AIS eLibrary (Journal of AIS, CAIS, etc.)This research article proposes PPFPL, a privacy-preserving federated prototype learning framework for cross-silo federated learning. It uses prototypes as client-submitted model updates to limit the effect of poisoned Non-IID data, and a secure aggregation protocol built on homomorphic encryption that runs on two servers to achieve Byzantine-robust aggregation. The authors report theoretical convergence and privacy analyses and experiments on public datasets showing resistance to data poisoning under Non-IID settings.
Researchers propose RSG-DA, a framework for deepfake detection that targets poor generalization to unknown images and novel forgery types. It combines a Dynamic Landmark Diffusion Generator that synthesizes hybrid forgery samples, a Dual Data Augmentation strategy, and a Lightweight Generic Forgery Distillation module. Experiments report consistent gains over state-of-the-art methods in intra-dataset and cross-dataset evaluations.
This paper presents APK-Specific Backdoor Attack (ASBA), a poisoning method against machine learning-based Android malware detection (AMD) models. ASBA trains a generative adversarial network to create a distinct trigger for each malware sample, so that discovering one trigger via static analysis does not expose all the malware carrying it. The authors report a 94.6% average attack success rate across three datasets, five feature extraction methods and three classification models.
The paper introduces M&M, a framework for secure two-party machine learning that uses an efficient modulus conversion protocol to run each cryptographic subprotocol in its optimal modulus domain. The authors report a 6x to 100x improvement for approximated truncations with 1-bit error tolerance, an average 5x reduction in communication and 4x reduction in runtime for machine learning functions, and a 25% to 99% cost-efficiency gain for private deep neural network inference alongside a 50% gain for private gradient boosting decision tree training.
The paper proposes the Fairly Proportional Noise Mechanism (FPNM), a differential privacy method that accounts for both the direction and magnitude of noise relative to raw query results to reduce unfairness across groups. In decision tasks, FPNM reduces unfairness by average reductions of 19.17% in F-Norm and 17.32% in average unfairness. When combined with DP-SGD for learning tasks, it achieves fairness comparable to fairness-aware baselines with better accuracy, while empirical privacy holds under membership inference attacks.
Researchers present WiIntruder, a perturbation attack against deep learning models used in WiFi-based wireless sensing. The method aims for universality, robustness and stealthiness by improving transferability across sensing models, optimizing device synchronization and propagation factors with a particle swarm algorithm, and varying attack patterns from a generative adversarial network. In black-box scenarios, average accuracy across four common WiFi-based services dropped by 72.9%.
The authors present a verifiable secure inference scheme that uses a blockchain to verify the origins of both user inputs and model weights. Neural networks are converted into zero-knowledge proof constraints with optimized structures, and the scheme is applied to a regulatable privacy-preserving transaction system where anomaly detection runs on encrypted ledger data. The paper claims rigorous security proofs and reports computational and communication performance to demonstrate scalability.
This paper studies how privacy preservation and Byzantine-robustness interact in decentralized stochastic gradient descent, where honest-but-curious agents try to infer neighbors' data and Byzantine agents send wrong messages. The authors inject Gaussian noise for privacy and use robust aggregation rules against Byzantine attacks, and find a tradeoff: the noise worsens the learning error caused by defending against Byzantine attacks. They analyze how the "mixing abilities" of robust aggregation rules affect this tradeoff, and their theory is supported by numerical experiments.