Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,040 items
Researchers show that the hyper-parameters of a closed-box deep reinforcement learning model can be inferred from its observable states and actions. They introduce a hyper-parameter inference attack named HyperInfer, which uses two state generation methods that provoke divergent model responses. Inference accuracy exceeds 90% in some settings, such as PPO with CartPole.
Fix: The source proposes potential defensive strategies to minimize the risk of hyper-parameter leakage in DRL models but does not specify them in the provided text.
IEEE Xplore (Security & AI Journals)Researchers present a passive shape-based flow correlation attack against the Nym mixnet, assuming an adversary who controls both the entry and exit gateway-requesters. Their neural network scores flow pairs by traffic distribution similarity, reaching a PR-AUC of 0.9998 at a base rate of 1.9 × 10^-4 paired flow tuples after one minute of attacking default Nym. They also systematically evaluate five defense strategies, finding that the right choice and scale of countermeasures offers meaningful protection.
FedMPS is a federated learning framework that combines multi-level prototype-based contrastive learning with prototype-guided soft label generation. Instead of exchanging model parameters, clients transmit only prototypes and soft labels, which the authors report reduces global knowledge shift and communication costs. Experiments on six publicly available datasets compare it against current state-of-the-art federated learning approaches.
A survey of hard sample mining (HSM), a paradigm for improving deep learning training efficiency and robustness through representative sample selection. The authors propose unified definitions of hard samples based on sample complexity quantification criteria, a systematic taxonomy of HSM approaches, and identify research frontiers in the field.
The authors propose a 3-D multiobject tracking framework for autonomous driving that combines a voxel masking encoder (VME) with a deep hashing paradigm (DHP). The hashing step computes Hamming distances between image and category hash codes to avoid cross-category association errors, and a distance optimization matching (DOM) method builds the cost matrix from geometric dimensions and spatial distances. Experiments on the KITTI dataset report tracking accuracy that surpasses other advanced methods.
This paper proposes Leaper, a location privacy trading framework for Mobile Crowd Sensing (MCS) that provides personalized differential privacy. Leaper gives each worker a personalized obfuscated range and perturbs the worker's location within it, combining differential privacy with k-anonymity to improve task allocation efficiency. It quantifies each worker's location privacy loss and compensates workers through a cost-effective auction. Evaluations on real-world datasets show that Leaper guarantees personalized differential privacy, truthfulness, individual rationality and budget feasibility.
This paper shows that a leakage-resilient authenticated key exchange protocol for smart grid, proposed by Cheng et al., is vulnerable to offline password-guessing and key compromise impersonation (KCI) attacks and lacks perfect forward secrecy (PFS). The authors propose a decentralized ultra-lightweight AKE protocol between neighborhood service providers (NSPs) and smart metering devices (SMDs) that uses the public Solana blockchain for transparency and key revocation. They report 24% and 98% improvements in communication and computational overheads.
The authors propose FedK-RF, a federated kernel learning algorithm that shares random features of local data subsets to improve predictive accuracy under data heterogeneity while protecting privacy. They extend it to FedNK-RF, which adds a federated Nyström approximation to reduce errors from random features, and derive excess risk bounds with minimax optimal rates using integral operator theory. Experiments are reported to show FedNK-RF's superiority.
Researchers propose a data fusion framework for datacenters that adds a trustworthiness check on data sources. It pairs a time-aware trust model built on dynamic Bayesian networks with a minimum spanning tree (MST) aggregation protocol. On a large benchmark, the method cuts control-center computation cost by 36.6% and communication and storage costs by 23.8% and 34.7%.
Researchers developed a framework to identify and measure which leakage sources drive microarchitectural website-fingerprinting attacks, which use timing information to reveal a victim's browsing from a co-resident attacker. Testing three published attacks, they identified four leakage classes: core contention, interrupts, frequency scaling, and cache eviction. They showed that controlling these sources can completely mitigate leakage, and that each source alone still leaks enough for fingerprinting. Correlation analysis between source events and measured timing quantified each source's relative contribution.
Researchers present the first adaptation of boundary matrix reduction, a core topological data analysis algorithm for computing persistent homology, to operate on homomorphically encrypted data. They give mathematical correctness guarantees under appropriate parameter choices, analyze computational complexity, and validate with a plaintext simulation and a working OpenFHE implementation.
Researchers propose M²VT, a hybrid model that combines multiview learning and multitask learning to defend IoT systems against cyber-attacks. The model processes three feature subsets to perform attack detection, attack category classification and attack type classification, using autoencoder and LSTM networks. Evaluated on four public IoT benchmark datasets and one testbed dataset, it reports over 96% accuracy across all tasks and datasets, outperforming state-of-the-art approaches.
Researchers examined how metaverse characteristics shape users' experiences of awe and place attachment, and how those experiences affect engagement. Using a mixed-methods approach of qualitative interviews followed by empirical validation, they found focused immersion, enjoyment, and telepresence positively associated with awe and place attachment. Awe and place attachment significantly predict engagement, with social threat moderating the place attachment-engagement relationship.
Watson, Ma, and Kannanoor argue that most companies treat cybersecurity as a necessary expense, like insurance, against capital losses. Their paper, published in MIS Quarterly Executive in 2025, reframes cybersecurity as a strategic investment that creates business value and competitive advantage in a networked society. It also gives information systems leaders guidance on the capital-creation benefits of being a good cyber neighbor.
Researchers propose a three-layer model for organizational digital transformation, comprising IT evolution, work practices evolution and mindset evolution, together with associated dynamic capabilities. The model is drawn from an analysis of Continental AG's shop floor digital transformation at the multinational automotive supplier. The authors state that the layers must evolve in parallel because they influence and reinforce one another.
This paper argues that cybersecurity communication for cyber-physical systems (CPS) relies too heavily on requirement lists, which do not explain how security features affect resilience. It introduces "Cyber Decision Diagrams," a model-based, visualized concept for documenting cybersecurity decisions and their rationales, implemented in a software demonstrator and validated with CPS user INEOS and manufacturer HIMA.
Fix: The authors evaluate five defense strategies and their combinations, and discuss steps a mixnet such as Nym can take to make the attack less likely and less accurate. The source does not list the specific steps in the text provided.
IEEE Xplore (Security & AI Journals)Researchers propose UTE-SS, an algorithm that makes text examples unlearnable by adding syntax-level perturbations that models learn as a shortcut. The method uses a syntax template generator to select an optimal syntax per category and a perturbing text generator to rewrite in-class texts with that template. Experiments on eight Transformer-based pretrained language models across four NLP tasks show its effectiveness and flexibility, and the code is public at https://github.com/libolb/UTE-SS.
This research paper shows that privacy-preserving federated learning schemes built on two honest-but-curious, non-colluding servers still leak data when defending against model poisoning. The defense computation exposes users' gradients in plaintext to one honest-but-curious server. The authors propose PBFL, a privacy-preserving, Byzantine-robust framework with a trust-scored aggregation strategy and secure subroutines over trapdoor fully homomorphic encryption, and report theoretical security analysis and experiments showing lower overhead than prior PBFL schemes.
This paper proposes a technical framework for regulating high-risk AI systems, built on a concept called operational qualification and a temporal self-replacement test modeled on human operator certification. It introduces the operational qualification score as a measure of regulatory fitness and presents SFAIR, a tool for automated, recurrent, and secure examination and attestation of that fitness. The authors validate the approach on an open-source high-risk AI system and make SFAIR's source code publicly available.
Fix: The source states that it provides recommended actions for aligning and managing interdependencies across the three layers, which it says reduces implementation risks and improves transformation outcomes. No specific actions are given in the source text.
AIS eLibrary (Journal of AIS, CAIS, etc.)Many firms struggle to scale generative and predictive AI systems because machine learning-based mechanisms amplify general technology management challenges and create new ones. Based on an in-depth case study of Siemens AG, the authors describe how to mitigate five critical technology management risks to scale AI globally, and offer recommendations for creating company-wide business impact.
Fix: The source text states that the authors describe how to mitigate five critical technology management risks to scale AI globally and provide recommendations for company-wide business impact, but it does not list the specific mitigations in the excerpt provided.
AIS eLibrary (Journal of AIS, CAIS, etc.)