Conference research

Only a public VAE is needed to approximate the latent space and remove the Tree-Ring watermark, reducing detection AUC from 0.993 to 0.153, and outperforming attacks that require full model access.

Proposes multi-resolution perturbations that uniformly break PhotoDNA, PDQ, NeuralHash, and pHash, enabling either evasion or triggering of moderation, with significantly improved convergence efficiency.

Proposes Chimera, an end-to-end attack that uses a hardware-aware GAN compensator to generate forged images with digital signatures, simultaneously bypassing deepfake detection and recapture detection, with a high attack success rate.

Evaluates detection models on 451,000 real phishing websites, finding poor real-world performance and vulnerability to logo tampering and adversarial perturbations.

Proposes task-level jailbreak based on knowledge decomposition, not relying on specific prompts or tokens, with stronger resistance to realignment, success rate about 10% higher than SOTA, and builds a defense evaluation benchmark based on it.

Uses timing side channels to reverse-engineer the cascaded safety filters of DALL·E 2/3, and exploits negation expressions and low-resource language vulnerabilities to achieve jailbreaks.

SOMBRA implements covert target removal attacks using attention fusion with a 99% success rate; LUCIA defends with credibility-aware attention, greatly reducing the removal rate.

Proposes the first gradient-based method to evade AIGT detectors, outperforming existing evasion methods on multiple datasets and two commercial detectors, and provides defense ideas.

Proposes Crescendo, a multi-turn jailbreak that appears harmless and gradually escalates the conversation, along with an automated tool, achieving high success rates on multiple mainstream models and capable of jailbreaking multimodal models.

Shadow Hack exploits object shadows to attack LiDAR point clouds, achieving extremely high success rates in both simulation and physical experiments; it also proposes the BB-Validator defense.

Finds that appending multiple eos tokens causes context segmentation and pushes inputs closer to the refusal boundary, which can improve the success rates of 8 jailbreak methods on 16 open-source models, and mainstream commercial APIs are also affected.

Uses attention sinks to generate transferable visual adversarial inputs that induce hallucinations, effective on 6 MLLMs as well as GPT-4o and Gemini 1.5.

Proposes a black-box fuzzing jailbreak framework starting from an empty seed pool, achieving success rates over 90%, 80%, and 74% on GPT-3.5, GPT-4, and Gemini-Pro, with shorter and more semantically coherent prompts.

Using a custom LCD and VAE costing less than $400, converts visible-light faces to near-infrared and performs face swapping, successfully breaking commercial near-infrared face authentication such as Windows Hello, with confirmation from Microsoft.

Proposes two attacks that exploit seemingly legitimate unlearning requests to break safety alignment, increasing LLaMA harmfulness by 11 times on average, and also effective against GPT-4o fine-tuning services.

First systematic taxonomy of efficiency attacks against dynamic deep learning systems, covering three categories of dynamic behaviors, and points out limitations of existing defenses against such attacks.

Treats safety mechanisms as embedded backdoors, using structurally similar twin prompts to locate and prune safety-related parameters, achieving success rates of 89% to 98% across 16 LLMs from five vendors.

Demonstrates that even without bidding, colluding reviewers and authors can exploit a machine learning-based text matching assignment mechanism to be assigned target papers, and points out specific vulnerabilities and improvement suggestions.

Proposes an untranslation attack that induces speech translation systems to output source-language content instead of translations; with a perturbation budget of 0.001, the success rate reaches 87.5%, and it is extended to a physical-world universal perturbation attack.

Adding a single blocking document to a knowledge base can make RAG refuse to answer specific queries, without requiring instruction injection or knowledge of the target model; existing safety metrics cannot measure this vulnerability.

Proposes cross-modal indirect injection attacks against vision-language models, where images contain hidden meta-instructions that can manipulate the style and opinions of the model's responses.

Separating prompts and data into two channels and fine-tuning the model to follow only the instructions in the prompt part significantly improves resistance to prompt injection with almost no impact on utility.

Proposes a context attribution framework that locates the text in long contexts responsible for outputs, usable for post-hoc forensics of attacks such as prompt injection, with better efficiency and accuracy than existing attribution methods.

Proposes AgentFuzz, a directed grey-box fuzzing approach, discovering 34 high-severity 0-days in 20 open-source agents, with 23 CVEs assigned.

Analyzes the moderation policies of 14 generative AI online tools and Reddit user feedback, finding that moderation can block malicious generation, but failures and post-hoc support often frustrate users.

Conducts the first systematic evaluation of seven activation approximation techniques, finds safety degradation in all ten aligned models, and proposes the QuadA method to mitigate it.

The first deterministic certified defense for GNNs against arbitrary perturbations to edges, nodes, and node features, applicable to node and graph classification, and superior to existing certified defenses.

Embeds watermarks in original speech to prevent its use in TTS speaker adaptation, thereby detecting fake speech generated by open-source and commercial TTS, and remaining robust to adaptation attacks.

Proposes the CAMP training paradigm, which optimizes a surrogate loss for the local certified radius, improving the certified expected return of DRL by up to about two times without losing provable robustness.

Proposes the first certifiable perceptual hashing system, trained with three optimization terms for evasion resistance, collision resistance, and functionality, providing provable guarantees against evasion and collision attacks, and performing well in illicit content detection.

Proposes a multimodal smoothing mechanism, providing the first certified robustness for traffic analysis models against multimodal adversarial perturbations, outperforming existing methods on six models.

Proposes HagDe, which iteratively perturbs samples along the gradient ascent direction and detects adversarial samples via abnormal loss spikes, achieving defense effectiveness of 88.5% and 90.7% against AdvDroidZero and BagAmmo, respectively.

Builds a dataset of 7,838 samples to evaluate 8 detectors, finding degraded performance on newer LLMs, and that adversarial and model-stealing attacks can evade detection, with success rates up to 0.966.

Analyzes jailbreak mechanisms based on the linear representation hypothesis, proposing JBShield, which simultaneously detects and adjusts hidden layer representations, with an average detection accuracy of 0.95 and attack success rate reduced from 61% to 2%.

Uses reinforcement learning to add a lightweight obfuscation layer, reducing unauthorized parties' accuracy to near random, defending against model stealing and fine-tuning attacks, and reducing latency by 35% on SGX2 and GPU.

Proposes prompt obfuscation, generating representations that are functionally equivalent but do not leak the original system prompt information, with utility comparable to the original prompt; three de-obfuscation attacks fail to extract meaningful information.

Proposes an LLM text watermark based on pseudorandom segment allocation for content provenance; with a 20-bit message embedded in 200 tokens, the match rate reaches 97.6%, and provides theoretical guarantees against editing.

PANTS combines adversarial ML with SMT solvers to generate adversarial inputs and uses them for adversarial training, with a higher probability of finding adversarial inputs than baselines and a robustness improvement of 52.7%.

Uses depth sensing and depth estimation to detect misleading re-shoots, achieving about 95% accuracy on iPhones and 74% on Samsung phones.

Uses shadow LLMs to detect harmful prompts in parallel and distills a dedicated defense model, outperforming seven existing defenses with low latency and remaining relatively robust to adaptive jailbreaks and prompt injection.

Automatically reconstructs a writable version of read-only on-device models and embeds watermarks to prevent model theft, achieving a success rate of 81.14% on 403 real apps.

Performs formal attack modeling on PoT schemes, derives a general distinguishing criterion, and constructs a PoT scheme based on it that can resist attacks that have broken existing schemes.

First security risk quantification of seven commercial AI search engines, finding that benign queries often return malicious URLs, and proposes an agent-based defense with only about 10.7% loss of usable information.

Use scene graph generation and classification to identify harmful entities and relationships in images, with F1 on average 95.52% higher than baselines, and can locate and remove 95% of harmful content.

An anomaly detection model based on reconstruction error, used to identify malicious PDFs and locate anomalous regions, with an accuracy of 99.54%, and robustness superior to existing work under four adversarial attack frameworks.

Construct a benchmark containing over 410,000 Chinese and English deepfake speech samples, evaluate 12 detectors, with the best EER at 13.50% and all others exceeding 20%, and performance dropping substantially in real-world scenarios; MLLMs have no detection capability.

Constructs the UnsafeConcepts dataset to evaluate 8 VLMs, finds a modality gap, and uses a simplified RL method based on PPO to improve recognition of unsafe concepts in images.

Uses style transfer to generate dynamic watermarks and leverages OOD features to avoid implanting harmful backdoors, achieving a 95% success rate verified on black-box models and resisting 8 attack scenarios.

Injects arbitrary biases into diffusion models using a small number of malicious samples with natural text trigger words, costing only $10–15, and it is difficult to detect without knowing the bias.

Attackers copy a training subset and request unlearning, finding that retraining fails under certain conditions, unlearning causes model degradation, and near-duplicate samples can bypass deduplication detection.

By optimizing a smoothed attack success rate objective to deductively search for triggers, backdoors can be inverted using only forward propagation, achieving near-perfect detection across multiple attacks and models.

Uses continuous embedding vectors as soft triggers to map multiple tokens to the same backdoor pathway, and ensures stealth through a latent adversarial mechanism, remaining effective and usable across four LLMs.

Proposes MergeBackdoor, which makes the upstream model appear benign, and after merging the backdoor success rate approaches 1.0, while existing detection finds it difficult to spot anomalies.

For the first time, implements a Rowhammer attack on NVIDIA GDDR6 GPUs, injecting bit flips and tampering with ML models, reducing accuracy by up to 80%.

Proposes a universal poisoning attack that identifies and removes protective perturbations such as NightShade and Glaze, achieving a TPR of 99.98% for detecting NightShade, revealing the limitations of existing protection schemes.

Plants backdoors in an AI-driven ISP model through data poisoning, causing people wearing a specific cloak to be completely erased from output images, and validates this in real-world scenarios.

The study tampers with text-to-image models through poisoning so that benign prompts generate unsafe images, analyzes the causes of side effects, and proposes a poisoning method that balances stealth and effectiveness.

Proposes two types of persistent backdoors, Blind Task and Latent Task, which achieve high success rates under various continual learning algorithms and can evade defenses such as SentiNet and I-BAU.

Proposes a stealthy poisoning framework that constructs undetectable malicious models through three modules, capable of defeating three typical classes of Byzantine-robust defenses.

Injecting a small amount of malicious text into a knowledge base can induce LLMs to output attacker-specified answers; with 5 injected texts per target question, the attack success rate reaches 90%, and existing defenses are insufficient.

Finds that a mismatch between training and inference trigger strengths can actually enhance attacks and improve stealth; mixed-strength training raises the worst-case attack success rate from 10.61% to 92.77%.

Proposes ONEFLIP, which implants a backdoor by flipping just a single bit of a full-precision model, achieving an average attack success rate of 99.6% and resisting backdoor defenses.

A two-stage attack systematically reverses RAG's output opinions on specific topics through adversarial perturbations, and existing mitigation methods are difficult to defend against.

Proposes the DIFF2 attack, which implants malicious processes in diffusion sampling, significantly weakening the effectiveness of adversarial purification and robustness certification.

Proposes an efficient and robust single-mask secure aggregation scheme that tolerates malicious clients and aggregators and resists poisoning, with speed 563.64 times faster than Flamingo.

Recovers model parameters from real CNNs running on Nvidia Jetson using electromagnetic side-channel correlation analysis of convolutional partial sums.

Audits nine GenAI browser assistants and finds that they often send full webpage content and form inputs to servers, some also share with third-party trackers, and infer user attributes for personalization.

Proposes FEDLEAK, which uses partial gradient matching and gradient regularization to reconstruct client data with high fidelity even in real federated learning settings, revealing significant privacy vulnerabilities.

Analysis finds that group chat chatbots often read far more messages than needed and can correlate users across groups; proposes the SnoopGuard protocol, supporting selective message access and sender anonymity while maintaining end-to-end security.

Proposes a unified prompt inversion method that first trains an inversion model and then fine-tunes it with reinforcement learning, enabling reconstruction of prompts for text and image models from outputs, with extension to video, outperforming the respective best methods.

Using generative AI to launch model extraction, membership inference, and model inversion attacks under data-free, black-box conditions, with effectiveness comparable to white-box baselines that have training data and parameters.

Proposes four inversion attacks against LLM internal states that can reconstruct inputs from intermediate layers, e.g., reconstructing long medical prompts from Llama-3 intermediate layers with F1 of 86.88, and existing defenses cannot fully prevent them.

Proposes disparity inference attacks to identify high-risk groups, and provides the first batch of targeted attribute inference attacks with significantly higher accuracy, while also proposing mitigation techniques that preserve model performance.

Proposes a DPA aggregation method based on secure multi-party computation that guarantees node-level differential privacy, outperforming existing privacy-preserving GNNs on six datasets.

Uses client momentum to simultaneously achieve differential privacy and Byzantine robustness, and removes the trusted-server assumption through secure aggregation, achieving a better privacy-utility trade-off.

Proposes a few-shot PII extraction method that requires no fine-tuning or jailbreaking, with a non-targeted extraction success rate of 48.9% at about $0.012 per record, and targeted extraction 10% to 60% higher than existing methods.

Proposes DHAttack, performing membership inference based on the boundary distance from a single sample to a fixed point, requiring only 5 to 30 queries; in some cases, [email protected]%FPR is more than an order of magnitude higher than baselines.

Systematically evaluates LLM attacks that extract personal information from public sources, finds they outperform traditional methods, and proposes a mitigation strategy based on prompt injection that can reduce attacks to the level of traditional methods.

Through 21 interviews, finds that users lack risk awareness and mistakenly believe they are protected by HIPAA, and proposes the concept of "invisible vulnerability" along with protection recommendations.

Propose VoiceSecure, a hardware microphone module that adjusts voice modifications in real time to conceal speaker identity and content, defeating speaker verification and speech recognition models while remaining intelligible to human ears.

The FIT attack uses an encoder-decoder model to exploit correlations in page access sequences, recovering object access for AI/ML inference and semantic search in confidential computing environments, with accuracy from 71.7% to 99.9%.

Propose LT-IQR, using per-sample loss trajectories during training to identify samples most vulnerable to membership inference attacks, without needing to train shadow models, achieving precision@1% of 92%.

Proposes InvLoss to quantify the upper bound of data reconstruction attack risk, and develops the risk estimator InvRE and two adaptive noise defenses.

Proposes ArrowMatch, which uses directional similarity to recover obfuscated private weights with accuracy over 98%, and proposes ArrowCloak as a defense.

Empirically finds that fine-tuning on LLM-generated data is not more private: Pythia's PII extraction success rate rises by over 20%, and after self-instruction fine-tuning, MIA's ROC-AUC improves by over 40%.

Discovers cache side-channel leakage of token values and positions in local LLM inference, designs a privilege-free eavesdropping attack that recovers input and output text with a cosine similarity of about 98%.

By actively sending carefully designed queries, 42 LLM versions can be identified with over 95% accuracy in only about 8 interactions, and the method is robust to scenarios such as system prompts and RAG.

A controlled trial with 502 participants showed that a maliciously designed conversational AI extracts more personal information than a benign AI, with strategies exploiting privacy social attributes being the most effective and having the lowest perceived risk.

First study of membership inference on VLM instruction-tuning data, exploiting sample sensitivity to temperature to propose four methods, achieving AUC over 0.8 with only 5 samples on LLaVA.

Reverse engineering DNN binaries using dynamic analysis and machine learning, supporting multiple compilers and platforms, can recover proprietary models and support gray-box adversarial attacks.

Models proactive defense as a bilevel optimization, adding tiny protective noise to images so that the image quality and semantics of images synthesized by various fine-tuning attacks are disrupted.

Detects privacy leakage using intra-layer and inter-layer semantic similarity and probability distributions of LLM internal states, achieving 92.69% average accuracy across five LLMs, 20.06% higher than existing methods.

Proposes an attack framework that optimizes prompt generation and selection strategies to extract PII from fine-tuned models, extracting up to 1,254 more emails, 634 more phone numbers, and 5,087 more names than existing attacks.

Propose the PRSA attack framework, which infers prompt intent and reproduces functionality from only a few input-output pairs, increasing attack success rate from 17.8% to 46.1% in prompt markets, and provide two defense directions.

Proposes the RULI framework, which uses dual-objective attacks to measure unlearning effectiveness and privacy risk at the per-sample granularity, finding that privacy risks in existing unlearning benchmarks are underestimated.

Instead of perturbing gradients, constructs robust data that is semantically very different from the original data but gradient-aligned, effectively defending against state-of-the-art gradient leakage attacks on multiple datasets.

Proposes the SPEC technique, which adds imperceptible perturbations to voice embeddings before upload to prevent voice cloning. It is effective against multiple synthesis models, resists adaptive adversaries, and runs in real time.

Proposes a safe evaluation framework for activation functions using linear approximation plus dynamic precision. Functions such as GELU are significantly faster than Iron and Bolt and are no longer a bottleneck in safe inference.

Proposes SAI two-stage training, which mitigates the impact of DP noise through a flatter loss landscape, improving accuracy by over 6% on CIFAR-10 (ε=1).

Proposes a lazy approximation method that reduces approximation error and improves accuracy and latency for BERT-like model inference under FHE, and can also be used in MPC protocols.

First systematically evaluates the vulnerability of fine-tuned LLMs to MIA, finds that attacks exploit the loss decrease in fine-tuning, then proposes SOFT selectively confusing data to balance privacy and performance across six domains.

Systematically review synthetic image generation methods, privacy attacks and mitigations, and establish a benchmark using membership inference attacks to evaluate the utility-privacy trade-off of synthetic data.

Proposes a unified taxonomy and formal definitions for data reconstruction attacks in the vision domain, along with quantitative metrics and LLM-assisted visual evaluation, and establishes an evaluation benchmark.

Systematically reviews the threat models, taxonomy, defense mechanisms, and evaluation metrics of gradient inversion attacks, and points out key challenges and future directions.

Systematically reviews gradient inversion attacks and evaluates them under multiple settings, finding they are limited, fragile, and easily defended against in real training.

A secure data alignment framework based on polynomial operations, with communication volume 31 to 210 times less than existing methods and runtime up to 8.21 times faster.

Adds adversarial optimization noise to uploaded data to achieve task-level usage control: it blocks unauthorized training, while target task accuracy drops only about 1.8%.

Analyzing the practical and theoretical limitations of data-poisoning attacks: existing methods cannot produce sufficiently consistent gradients and are easily detected by validators; finding equal-gradient mini-batches within the legal value domain is not easy.

Proposes PETAL, which uses per-token semantic similarity to approximate output probabilities and compute perplexity, enabling membership inference from generated text alone, with effectiveness comparable to logits-based attacks.

Proposes the IAM framework, which uses a single shadow model to measure sample-level unlearning completeness, can be extended to LLMs, and finds that approximate unlearning algorithms generally risk over- or under-unlearning.

Proposes DP-AggZO, which mitigates bias caused by clipping and achieves better convergence rates and model utility under the same privacy constraints.

Proposes AudioShield, which generates transferable universal adversarial perturbations in latent space to protect real-time speech, effective on four commercial ASR APIs and LLM-driven ASR, with good audio quality and robustness against adaptive countermeasures.

Evaluates 576,000 code samples generated by 16 LLMs, finding commercial models hallucinate packages at least 5.2% of the time and open-source models 21.7%, and validates mitigation strategies.

Proposes Halligan, a general-purpose solver based on VLM, which achieves a 60.7% solve rate on 2,600 challenges across 26 types of visual CAPTCHAs, and infiltrates a real human CAPTCHA farm.

Exploits LLM weaknesses such as bias and memory limitations, using disguise, honeypot tokens, and traps against automated penetration testing agents, achieving 100% success on 11 CTF machines, and open-sources the CHeaT tool.

Uses LLM-driven coverage-guided evolutionary automation to synthesize generative fuzzers, achieving a coverage improvement of up to 434.8%, and discovers 5 0-days on cvc5.

HLPFuzz uses LLMs to solve complex constraints, finding 52 bugs in 9 language processors, with coverage leading by up to 190%.

Combines code property graph slicing with LLMs for vulnerability detection, reducing code volume by 67.84–90.93%, improving F1 by 15–40% over baselines, and remaining robust to syntax changes.

G²FUZZ lets LLMs synthesize and mutate Python input generators, then AFL++ performs local mutation; it outperforms existing tools in coverage and bug finding, discovering 10 new bugs, 3 of which received CVEs.

PassLLM uses LoRA to fine-tune LLMs to cover four types of password guessing scenarios, and achieves higher success rates than existing best methods on 11 real-world datasets.

Combining LLM chain-of-thought analysis of Tor traffic detection for IoT threats, discovered 45 vulnerabilities within 12 months, 29 of which were zero-days.

Evaluates the power of web-enabled LLM agents in personal information cyberattacks: PII collection precision reaches 95.9%, 93.9% of impersonation posts are judged as real, phishing click-through rate increases by 46.67%, and existing defenses are insufficient.

Systematically studies the positioning, advertised features, and monetization infrastructure of 20 popular AI undressing websites, providing data for relevant policy and technical discussions.

Systematically analyzes the economic model, victim targeting, and creation discussions of the largest sexual deepfake marketplace, finding lax rule enforcement and revealing previously undocumented attack motivations and resource acquisition methods.

Evaluating 7 open-source VLMs on understanding hateful memes, found they lack effective refusal defenses, are easily abused to generate hate speech, and some outputs were judged harmful.