Conference research

Proposes Causal Analyst, which uses causal discovery to identify the direct causes of jailbreaks among prompt features, and thereby improves attack success rates and enhances guardrails' recognition of obfuscated malicious intent.

Systematically evaluates the robustness of 20 models under extreme function inlining, finding that inlining can affect model behavior and be used to construct evasive binary variants.

NetMasquerade uses reinforcement learning and Traffic-BERT to make attack traffic mimic benign traffic, evading 6 detection methods across 80 scenarios with a success rate exceeding 96.65%.

The study finds that 178 of 199 LLM applications may be affected by capability escalation or degradation, and 17 can execute malicious tasks without adversarial rewriting.

Proposes a query-efficient model extraction framework, SSLExtraction, which selects queries via greedy random walks in feature space, removing black-box watermarks while copying the model and significantly reducing query cost.

A dual jailbreak framework that breaks both the LLM and the guardrail simultaneously, achieving an average success rate of 93.67% against GPT-4 protected by LlamaGuard-3, and proposes EGUARD as an ensemble defense.

Locates and prunes safety neurons to disable safety mechanisms, achieving an average attack success rate of 76.9% across more than 20 open-source models, and can transfer to black-box models.

Steganographically embedding malicious queries and responses into normal images to bypass input and output filters, achieving attack success rates up to 99% against GPT-4o, Gemini, Grok-3, and others.

Proposes a low-cost targeted infrared adversarial perturbation attack and designs a segmentation-based detection method for efficient defense.

Proposes a black-box input optimization attack that causes LLMs to fall into extremely long reasoning loops, significantly reducing service throughput and even causing service failure.

Proposes a training-free search-based prompt stealing method that can extract generation prompts from images across multiple platforms and improve attack success rates.

Proposes Rennervate, which uses fine-grained attention features to detect and clean indirect prompt injections, outperforming 15 defense methods across five models and six datasets.

When the attacker does not know the order of the data segments and controls only one of them, optimizing the injection with an order-independent loss is significantly effective across 12 LLMs.

ToolHijacker injects malicious tool documentation into the tool library to manipulate tool selection, significantly outperforming existing attacks, and multiple existing defenses are insufficient.

Finds that attackers can manipulate LLM responses obtained by others by injecting cache entries, and proposes improved defense mechanisms.

It points out new attacks against IsolateGPT and proposes the ACE architecture, which divides planning into abstract and concrete stages and enforces isolation between applications, maintaining safety on indirect prompt injection benchmarks.

Identifying XTHP threats can hijack Agent task control flow and steal or pollute information. They developed Chord to scan 66 tools and found 75% to be vulnerable.

Through a central Provider and cryptographic access control tokens, users can control communication between agents, with low performance overhead and no impact on task utility.

After evaluating 16 platforms, it finds an average unsafe response rate of 65.1%, and trains a model to identify low-safety personas.

Finds that the separability of hidden states between safe and harmful responses weakens as generation proceeds, and proposes DEEPALIGN to reduce the success rate of nine types of jailbreak attacks to near zero.

The study shows that character-level perturbations can effectively remove various LLM watermarks under limited black-box queries and can bypass fixed defense strategies.

Proposed Falcon, a third-party adversarial example detection method that exploits differences in noise tolerance between clean and adversarial samples, achieving about 80% TPR at 5% FPR across 6 commercial DNN services.

Proposes self-supervised adversarial training with mutual information penalty for ViT, surpassing existing adversarial training methods on ImageNet-1K and resisting adaptive attacks.

Implanting trigger-label associations in LLMs so that generated phishing content is automatically labeled for identification, with detection accuracy exceeding 90% across scenarios.

Uses two-level vector quantization to discretize visual representations to block attack paths, significantly improving defense success rates against jailbreak and toxic image attacks while largely maintaining utility.

Analyzed moderation differences across 15 large models in different regions and languages, finding significant variation in moderation rates and response lengths.

Combines LoRA fine-tuning with zero-knowledge proofs to verify training correctness while protecting model parameters and training data privacy.

Proposes a deepfake detection method that fuses visual-language explanations and graph neural networks, improving robustness against customized deepfakes and adversarial attacks.

It proposes an asynchronous zero-knowledge proof framework that verifies federated learning computations under a malicious threat model and reduces proof generation time.

Proposed WebSpotter to locate malicious payloads in HTTP requests and automatically generate WAF rules, improving localization accuracy by at least 22% over baselines.

Proposes a universal backdoor attack for tabular data, achieving up to 100% attack success rate across five datasets and four models.

Proposes the CBA framework that does not require original training data, reducing trigger false positive rates by 50% to 70% on six LoRA models while maintaining a high attack success rate.

Without requiring attack target priors or poisoned data, it restores triggers through adversarial simulation and gradient inversion, then removes backdoors via clustering and fine-tuning, reducing the average attack success rate by 97.87%.

QuRA implants backdoors solely by optimizing quantization rounding directions, achieving near 100% attack success rates in most cases with almost no loss of precision, and can bypass existing defenses.

Combining entropy-regularized teacher training, CVAE synthetic data distillation, and contribution-aware aggregation, it defends against both passive and active membership inference attacks while maintaining model accuracy.

Proposes the FME protocol, which improves privacy, robustness, and efficiency in large-domain classification and key-value statistics through hash filtering, multiple encryption, and dummy data.

Proposed CMIA and PMIA membership inference attacks that leverage sample dependence and proxy samples to improve privacy risk assessment in low false-positive scenarios.

It proposes a method to convert Tor exit trajectories into entry perspectives, helping to more accurately assess the risk of website fingerprinting to user privacy.

Proves that leveraging the contraction property of GNNs, the privacy budget converges with layer count rather than growing linearly, proposes the CARIBOU framework, improving the privacy-utility trade-off and supporting privacy auditing.

Based on Function Secret Sharing and CKKS complex-domain verification, it prevents malicious clients from stealing model parameters, reducing inference communication overhead by up to 94% and latency by 43%.

Proposes a one-way communication architecture that confines encrypted computation within the adapter, protecting user inputs and fine-tuned adapter privacy while achieving 20.62x to 291.48x speedup over baselines.

Uses SGX-Step to collect fine-grained latency traces and recovers model architectures on Darknet, TensorFlow Lite, and ONNX Runtime with accuracy ranging from 93.6% to 97.3%.

It proposes an adaptive WF attack framework, Proteus, which continuously fine-tunes the model using only unlabeled drift traffic, achieving an average F1 improvement of 94.24% over eight SOTA attacks across six drift scenarios.

By suppressing LLM memory of web page text through invisible perturbations, MIA AUC was reduced from 0.95 to 0.55 under a privacy backdoor, with instance exposure risk approaching zero.

Proposes ICP-MIA, using the Optimization Gap as a membership signal, estimated under black-box settings by constructing input contexts, significantly outperforming existing black-box MIA at low FPR.

A malicious federated learning server uses a training-time backdoor with an index trigger to deterministically extract clients' complete training samples, losing only 3% utility on a medical segmentation dataset.

ModelSpy exploits GPU electromagnetic leakage to reconstruct DNN architectures through walls from several meters away, achieving 97.6% layer segmentation accuracy and enhancing black-box adversarial attacks.

The first DP synthesizer for code datasets, which first uses DP-SGD to generate private synthetic code, then fine-tunes a larger model to improve utility.

The first DP synthesis method for offline RL datasets, using diffusion models to synthesize transitions and trajectories, outperforming baselines in utility and fidelity.

Proposes a prompt purifier that uses format-preserving encryption for format-sensitive words and metric differential privacy for numeric values, providing privacy guarantees while maintaining utility.

Finds that user input can be reconstructed from KV cache, and proposes KV-Cloak to defend against the attack with almost no performance impact.

Proposes a three-party privacy-preserving inference system deployable in production environments that protects user data and model parameters while maintaining lossless inference.

Proposes a method that uses truncated singular value decomposition to protect the privacy of federated learning gradients, balancing privacy and model accuracy on resource-constrained platforms.

Proposes a DP auditing method that finds shuffled training may cause a model's actual privacy leakage to exceed its theoretical guarantee.

By analyzing LLM neural activations to detect training data membership, achieves relatively high identification performance on multiple open-source models.

Proposes using zero-knowledge proofs to prevent blacklisted clients from changing credentials and re-entering federated learning aggregation rounds.

The system identifies six classes of attack vectors in LLM inference caches that can deliver malicious content or bypass safety checks, and proposes five layered defense strategies.

It proposes LogicFuzz for semantic fuzzing of PLC logic instructions, discovering 19 vulnerabilities in six production-grade PLCs, 4 of which are new vulnerabilities.

Proposes LLM-CAL to identify security-sensitive code regions in cryptographic implementations, reaching an F1 of 98.40%, used to reduce the TEE trusted computing base.

DefenseWeaver uses LLMs to generate attack trees and risk assessments, discovering and validating 11 critical attack paths across four automotive security projects.

Proposes a pretraining method for a large malware language model, achieving an average improvement of 1.1% across multiple malware classification tasks, with a maximum improvement of 28.6%.

Proposes a two-layer detection framework combining traffic features with Transformer, maintaining an F1 score above 92% under various evasion attacks.

Using LLMs to parse Bluetooth specifications and generate semantic test sequences, 36 security issues were found across 19 devices, 34 of which were unknown vulnerabilities.

Proposes an LLM-driven UI exploration framework to identify disguised applications, achieving 92.59% precision on 1644 iOS applications.

Proposes a multi-agent LLM framework to simulate benign and malicious insider activities in enterprises, and constructs a more realistic insider threat detection dataset.

A survey of 153 practitioners and an experiment with 48 participants found that LLMs improved novices' comprehension by about 98%, matching experts, but also produced hallucinations and ineffective advice.

Hybrid fuzzing with LLM agent taint analysis and PoC generation found 182 vulnerabilities in 14 firmware images, of which 140 were unknown vulnerabilities and 17 received CVEs.

Combining fine-tuning, information retrieval, and look-ahead planning, it proves that hallucination probability is bounded, and on real event logs it reduces recovery time by up to 22% compared with frontier LLMs.

Combining vulnerability interface signatures with LLM-driven fuzzing, a total of 183 vulnerabilities were found, 169 of which received CVEs, with a detection count more than 7 times that of existing black-box fuzzing.

A multi-stage LLM pipeline localizes the commit that introduces a vulnerability, with accuracy more than 38% higher than existing state-of-the-art methods.

Combines LLM static analysis with fuzzing verification, discovering 158 non-compliance bugs in 11 protocol implementations, of which 70 have been confirmed.

Uses reinforcement learning to construct attacks that evade traffic monitoring, and reduces their bandwidth utilization effectiveness through adversarial training.

Proposes a GAN combining particle swarm optimization and attention mechanisms to detect malicious traffic, achieving high accuracy in zero-day and cross-dataset tests.

Finds that familiarity pattern bias can cause LLM code analysis to overlook subtle vulnerabilities, and proposes an attack method that can be automatically injected.

Proposes a patch classification pipeline combining LLM with small models to identify out-of-bounds access and use-after-free vulnerabilities in the Linux kernel.