Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,040 items
This article extends asynchronous federated learning (AFL) to clients with nonconvex objective functions and heterogeneous datasets. The authors provide a convergence analysis that bounds the expected gradient norm and examines the effects of staleness, variance and heterogeneity. They introduce a staleness-aware aggregation mechanism and a dynamic learning rate schedule, and implement the methods in PyTorch with Python's asyncio library.
This research article presents BMMA-GPT, a Biometric Multi-modal Authentication System for FIDO/FIDO2 and Zero Trust Architecture environments. It uses a dual-threshold mechanism with Defense-in-Depth strategies and a Geometric Programming model to select biometric permutations and verification thresholds. The authors report an AUC of approximately 0.99 with authentication latency under 1.5 seconds.
This study addresses decentralized constrained optimization over time-varying, directed networks, where transmitted information can reveal sensitive data about nodes. The authors propose ZS-DDAPush, which embeds zero-sum structured functional and state perturbations into the decentralized dual averaging push method. The authors state that it protects nodes' cost functions without sacrificing optimization accuracy, and that it converges accurately under weaker initial conditions, with experiments confirming its effectiveness.
This paper proposes a method for deploying cyber deception resources that accounts for time delays, using deep reinforcement learning with time-delay differential game theory. The authors model node security evolution in complex networks and apply proximal policy optimization (PPO) to find an optimal deception deployment strategy. Validation on a scale-free complex network showed the method tracked node evolution and attacker and defender strategies, with better stability and effectiveness than other methods.
Researchers propose a lightweight personalized multi-receiver Certificateless Signcryption (CLSC) algorithm for Internet of Vehicles data sharing. It sends customized data to each recipient while keeping it confidential from the others, adds cross-domain authentication, and supports aggregated unsigncryption to reduce computation. Formal security analysis and experiments are reported to show the scheme meets its security requirements and is efficient.
DynMD is a GNN model for malware detection on streaming behavioral data. It uses an energy function to adaptively partition windows into a lossless malware dynamic heterogeneous graph, with intra-graph and inter-graph message propagation. On three real-world malware datasets it improves detection accuracy by up to 3.99% and runs 3.81× to 5.33× faster than MG-DVD, identifying malware within an average of 40 seconds of execution.
Mujaz is a multi-task natural language processing system that normalizes and summarizes vulnerability descriptions in public vulnerability databases. The authors introduce a parallel, manually annotated corpus of vulnerability summaries and fine-tune pre-trained language models for the summarization tasks. Reported results include ROUGE scores, compression ratio, and human and expert evaluations of completeness, correctness and fluency.
Researchers propose BPDA, a bidirectional path and data flow analysis method for finding vulnerabilities in embedded firmware, especially at nonstandard library sinks that current tools miss. Tested on 84 firmware samples (Linux and VxWorks) from 8 major brands, BPDA found 163 real vulnerabilities, including 34 zero-days, with 32 confirmed by CVE/CNVD. It completed analysis in 6% of the time SaTC required and identified 21 vulnerabilities that SaTC and Mango missed.
Researchers propose EEG-FE_rrRS, an EEG biometric recognition system that uses a fuzzy extractor to give each user a unique digital identity for scenarios such as UAV and metaverse human-computer interaction. The security of the fuzzy extractor is argued from an entropy loss perspective. Simulations report 0.92% FRR and 0.08% FAR on the motor imagery database, and 0% FRR and 0% FAR on the SEED database.
AttackDeceiver is an anti-spoofing system for automotive mmWave radars that uses a phase-shifted interleaving waveform. It compares range and velocity estimates from two independent virtual channels to detect spoofing, and induces adaptive attackers to generate false targets with unrealistic velocity fluctuations. A prototype built on commercial-off-the-shelf radar kits reached a false target recall above 97.9% and a signal-to-interference-plus-noise ratio improvement above 13.46 dB.
PrivESD is a privacy-preserving logistic regression model that performs computation over encrypted streaming data, splitting work between a cloud and an edge device. The authors build a building-block library supporting secure comparison, use it to construct logistic regression, and train with stochastic gradient descent with momentum. They report that their secure compare protocol outperforms the schemes of Bost [44] and Guo [45], and that its encryption and decryption costs are similar to Paillier [42] with 2^30 keys.
This paper presents LipVor, an algorithm that certifies whether a closed-box model such as an artificial neural network is positive, based on a finite number of evaluations. Because partial monotonicity can be expressed as a positivity condition on partial derivatives, LipVor can certify partial monotonicity of a trained network without constrained architectures or piecewise linear activations. The authors suggest this could allow unconstrained networks in critical fields such as credit scoring.
Researchers study backdoor attacks on reinforcement learning agents in partially observable multiagent systems. Instead of modifying a victim's observations directly, an adversary agent uses its own actions to affect what other agents observe, and a trained trigger policy, guided by auxiliary rewards, lets it activate their backdoors with few actions. Experiments show the method triggers others' backdoors efficiently, and the authors also study defenses.
TabExtractor is a model extraction approach for tabular models that works without the victim's training data or knowledge of its architecture. It uses a tabular generator to synthesize informative samples and a contrastive tabular transformer as the clone backbone. Across six victim architectures and four real-world datasets, the extracted clone reaches 92-100% of the victim's accuracy.
IndirectVerify is a formal scheme for verifying whether machine unlearning requests have actually been executed, addressing a gap where existing verification relies on backdoor or membership inference attacks that a model provider can bypass through rapid fine-tuning. The authors generate influential sample pairs, trigger samples and reaction samples, using a perturbation-based method that alters only a small fraction of training samples so that reaction samples are misclassified. The paper claims this indirect influence provides greater robustness against bypassing than schemes that reuse the same samples throughout.
This article examines how the seven key requirements for trustworthy AI in the EU's Ethics Guidelines for Trustworthy AI can be translated into design choices for empirical risk minimization (ERM) components. It maps the design space of ML systems to fairness, privacy, robustness, and explainability. The authors argue that current ERM design prioritises accuracy over trustworthiness and call for a more holistic approach to ML.
Researchers present a framework for generating minimal counterfactual explanations in explainable AI. It approximates a model's predictive function with a local Taylor expansion, treats the counterfactual search as energy minimization using the Boltzmann distribution, and applies simulated annealing. Experiments on benchmark IoT cybersecurity datasets show the method yields actionable, interpretable counterfactuals.
The paper proposes FGRW, a fine-grained reversible watermarking scheme for protecting ownership of pre-trained models after cross-domain fine-tuning. It generates trigger and task samples using out-of-distribution awareness, and a representation-oriented regularization constraint selects modification spaces while the embedding loss guides the augmentation network. The authors report superior performance in fine-grained authorization and reversible integrity verification, and identify a trade-off between training a clean ideal model and obtaining a watermarked model.
The paper proposes Octopus, a scheme for federated learning that compresses gradients with Sketch and embeds masks in the compressed gradients to protect privacy while reducing communication overhead. It adds an anti-disconnection strategy so model updates continue when some clients drop out. The authors report security and convergence analyses and performance evaluations showing robustness, stability, and efficiency over existing schemes.
This research paper proposes Model Stability Defense for Federated Learning (MSDFL), a method that defends federated learning systems against model poisoning by minimizing the norm of the model-output Jacobian matrix. A refined variant, HMSDFL, extends stability to all logit output dimensions to address convergence-speed disparities caused by MSDFL. The authors report extensive experiments showing fidelity, robustness, compatibility, and self-protection, though the source text gives no numerical results.