Conference research

Using the RGBA image Alpha channel to make humans and models see different content, it can deceive 100 image recognition systems without queries, and proposes a histogram detection method.

Embeds malicious code into popular applications and generates adversarial perturbations, producing Android malware that evades detection in batches, with an average attack success rate of 88.3% against Drebin and MaMaDroid.

First systematic study of BFA on DNN executable files, finding that attacks can be performed with only knowledge of the model structure, and that on average about 1.4 bit flips can reduce accuracy to random level.

Proposes a laser-triggered physical adversarial patch attacking autonomous driving visual perception, with an average attack success rate of 91.9% at 50 meters, significantly outperforming TPatch.

Propose an attack that generates universal adversarial perturbations for arbitrary multimodal wireless signals, validated on a software-defined radio platform, significantly degrading performance even under strong defenses.

The first large-scale measurement of physical adversarial attacks on commercial traffic sign recognition systems finds that attacks do not generalize easily, with spatial memory design being the main cause, and proposes a new attack success rate metric.

Addressing the security and privacy risks of third-party LLM applications lacking isolation, propose an execution isolation architecture that resists multiple attacks with no loss of functionality, and most queries have overhead below 30%.

The first BFA defense for DNN executable files, detecting bit flips in data and code segments based on semantic integrity checks, with an average mitigation rate of 97.51% and an overhead of about 2.47%.

Experiments with 35 cochlear implant users and 87 normal-hearing listeners show that the former identify voice conversion forgery only about 67% correctly, and evaluate whether detectors trained on CI-simulated audio can serve as a proxy.

Points out that feature sparsity is the common root of poisoning, evasion, and concept drift, and uses compression techniques and density-boosting training to mitigate sparsity, enhancing detectors' resistance to attacks.

Analyzes how visual art and propaganda techniques weaken existing harmful meme detection, and proposes HMGUARD based on adaptive prompting and CoT, achieving an accuracy of 0.92.

Proposes EncoderLock, which makes the encoder perform poorly on forbidden domains while maintaining utility on authorized domains, with supervised, unsupervised, and zero-shot variants.

Injects a positive backdoor into Textual Inversion embeddings, so that when sensitive words are combined with the embedding, a preset image is output instead of harmful content, and it can resist adaptive attacks.

Constructs the first unsafe video dataset for video generation models and summarizes 5 categories of unsafe content, proposing a defense method that works inside the sampling process, achieving an accuracy of 0.90 with a 10x reduction in resource overhead.

Uses physical models of the Doppler effect and drumhead vibration to extract micro-frequencies and incorporate them into the loss function, outperforming existing methods on a newly constructed dataset and enabling detection of AI-generated speech.

Proposes the relative competition score RCS to measure potential separability, detecting backdoored models without samples, with average detection rates significantly better than 7 baselines across over 10,000 models and 14 types of attacks.

The first dynamic backdoor detection framework, which judges backdoors through few-shot weight perturbation of attention layers, and found one suspected backdoored model among 49 models on Hugging Face.

Proposes FoundationFL, where the server generates synthetic updates and aggregates them with client updates using Trimmed-mean or Median to defend against federated learning poisoning attacks, and provides convergence analysis.

Using the two phenomena of semantic drift and attribute overemphasis, it compares self-supervised models with backdoored models to filter poisoned nodes, greatly reducing attack success rates under 21 attacks.

Proposes EaaW, which embeds multi-bit watermarks into feature attribution explanations of trigger samples rather than predictions, avoiding the harmfulness and ambiguity of backdoor watermarks, and can resist potential attacks.

Using a multi-objective evolutionary algorithm to optimize black-box backdoor triggers in dual domains, the attack success rate is no less than 99%, and both robustness and stealth are superior to existing stealth attacks.

Purifies backdoors by adjusting batch normalization layer statistics, reducing attack success rate from 100% to near 0 using only 1% of training data.

Proposes the first client-side backdoor defense for Split Learning, where the server detects and rolls back poisoned models through frequency-domain static analysis and rotation-distance dynamic analysis, effectively mitigating backdoors while maintaining utility.

Proposes two attacks, POLISHED and FUSION, causing poisoned low-rank adapters to output attacker-specified content or maliciously call tools when triggered, with all three defenses failing to fully resist them.

Proposes TellTale, which detects poisoned samples from the spectral domain of training trajectories, requiring no clean data, effective across modalities and tasks, with detection accuracy of at least 95.52% and a false positive rate of no more than 0.61%.

Propose a key-driven face anonymization and authentication framework that preserves identity authentication capability while hiding the original face.

Propose an attack that amplifies membership privacy leakage in black-box models through malicious training code and evades common privacy audits.

Uses lookup tables to implement a private inference protocol for quantized operators, with online communication of only log n, improving online performance over existing PPML schemes by 40-60x for CNNs and 10-25x for LLMs.

Protects on-device DNN models on Armv8-A devices using a virtualized TEE, bringing the accelerator into the trusted boundary, with a minimal TCB and negligible inference latency overhead.

Proposes the first score-based black-box membership inference attack framework for diffusion models, covering four attack scenarios, with AUC reaching 0.95.

Optimize two-party private inference protocols for matrix multiplication and nonlinear activations, reducing communication by 80%–95%, and can generate one token of LLaMA-7B in about 8 minutes on CPU.

In federated learning, restricts gradient perturbations to a subspace orthogonal to the original gradients, defending against gradient inversion attacks recovering private data while maintaining model utility.

Finds that iterative pruning exacerbates model memorization, proposes WeMem to weaken memorization targeting data reuse and inherent memorability, outperforming five existing defenses under ten adaptive MIAs.

Before inference, regenerates inputs with a generative model to eliminate member and non-member differences without changing predicted labels, reducing MIA attack accuracy by 15.8% on average, and can be stacked with other defenses.

Leverage confidential computing and enforce DGM-Rules to restrict untrusted developers to benign training only, blocking leakage channels such as data encoding and gradient inversion, with minimal overhead.

Proposes GAP-Diff, which generates adversarial perturbations robust to JPEG compression through differentiable preprocessing simulation, interfering with diffusion model fine-tuning to protect portrait privacy.

The first study of security risks in multi-tenant LLM services, proposing PROMPTPEEK, which exploits a side channel in KV cache sharing to reconstruct other users' prompts under different prior conditions.

By mixing a small number of false-positive clients into clusters and solving linear equations to recover the model, it resists server preference profiling, with an average attack accuracy of 69.4% and at most 3% accuracy loss.

Proposes SDAR, which uses auxiliary data to learn a decodable simulator of client private models, enabling recovery of private features and labels, with effectiveness close to active attacks.

Proposes (q,η)-Learnability, which certifies unlearnable samples through parameter smoothing, and designs PUE, which reduces learnability and test accuracy on ImageNet and CIFAR-100.

The server manipulates item features presented to users to reconstruct their private interactions, significantly outperforming existing attacks such as gradient inversion in recommendation and online ranking scenarios.

Proposes reinforcement unlearning for the entire environment, giving two methods based on decremental reinforcement learning and environment poisoning, and introduces environment inference to evaluate unlearning effectiveness.

Propose Scale-MIA, which, even with secure aggregation protection, can efficiently reconstruct local training samples from aggregated updates via closed-form inversion and a generative decoder, outperforming existing attacks.

Proposes NEXUS, the first non-interactive secure Transformer inference protocol, requiring only one round of communication from the client, with bandwidth reduced by 372.5 times compared to BOLT.

Proposes a constant-round softmax protocol and a Fourier series-based GELU protocol, reducing communication by 25-41% while maintaining accuracy close to plaintext, with runtime faster than BumbleBee.

Finds that MPC secure inference remains vulnerable to membership inference attacks, and proposes SIGuard to add noise to encrypted predictions, reducing attack accuracy to near random guessing.

Propose IMMERSPY, an acoustic side-channel attack that uses CNN-LSTM to recover spoken digits from VR device motion sensors, achieving 62% accuracy for 16-digit card number recognition, and provides defenses.

Proposes the first offline RL trajectory unlearning method TrajDeleter, which forgets 94.8% of target trajectories on average with only about 1.5% of retraining time, and provides an auditing method TrajAuditor.

Analyzing five types of attacks reveals that high-importance samples are more vulnerable in membership inference and model extraction, and accordingly introduces sample-specific criteria to improve membership inference performance.

Propose URVFL, which uses a discriminator with an auxiliary classifier to generate malicious gradients indistinguishable from honest training, significantly outperforming existing attacks and bypassing existing detection methods.

SymGen uses a domain-adapted generative LLM to infer function names for stripped binaries, serving malware analysis and vulnerability discovery, with precision, recall, and F1 greatly surpassing existing methods.

Evaluate multiple LLMs on vulnerability detection in Java and C/C++, finding that some models perform poorly, context windows provide consistent gains, and factors such as quantization offer limited benefit.

Proposes GPTAid, which uses LLMs and execution feedback to filter generated API parameter security rules, with 92.3% precision, discovering 210 unknown security vulnerabilities across 47 applications.

Proposes the first technique that rewrites circuit designs with LLMs to evade piracy detection, successfully evading all tested circuits across four detection tools.

Uses LLMs to transfer existing human attributes and automatically generate contract attributes, achieving a recall of 80%, detecting 26 of 37 CVEs/attack events, and discovering 12 zero-day vulnerabilities.

Enhance LLMs with domain knowledge and document retrieval to explain the behavior and intent of malicious shell commands, and map them to MITRE ATT&CK tactics and techniques.

Proposes ChatDetector, which uses LLMs to extract resource management API constraints from documents and detect misuse, identifying 165 API pairs with 98.21% precision, and reporting 115 security vulnerabilities.

Proposes an LLM-based goal-driven web scanning agent that autonomously executes task workflows to discover deeper states, finding 12 zero-day XSS vulnerabilities across 20 applications.

Systematically evaluates security misalignment methods such as system prompt modification, fine-tuning, and model editing, finds that SFT is the strongest, and proposes the SSRA attack that requires no harmful responses and the SSRD realignment defense.