Centrality measures are fundamental tools for assessing the importance of nodes in a network, with widespread use in security analysis and the study of covert structures. Importantly, these are precisely the domains where participants may have strong incentives to mislead the analysis. In this work, we investigate Sybil attacks on centrality measures, where an adversary creates multiple identities and distributes connections among them to obscure their true importance. We show that computing an optimal hiding strategy is tractable for degree centrality but NP-complete for both closeness and betweenness centralities. Despite this hardness, we draw from the literature on community detection to design heuristic algorithms that perform well in practice. Experiments on real-world covert networks demonstrate that Sybil-based obfuscation can significantly outperform existing hiding strategies. Our results highlight the risks of relying uncritically on centrality-based methods in security-sensitive applications.
论文检索
输入标题、作者或关键词，从 954 篇学术成果中精准定位
Selfish mining attack is a well-known attack in blockchains where Byzantine validators collude to gain more revenue than their fair share. Prior studies show that selfish mining attack can be risk-free in the longest-chain variants of Proof-of-Stake (PoS) protocols, i.e., Byzantine validators will never be caught and do not take any risk of losing their revenue. However, it is still unclear whether risk-free selfish mining is possible for PoS in the non-global predictability model [EC 2019], where in the global unpredictability model, validators can predict the roles of all validators in advance. In this work, we study the nominated PoS protocol by Polkadot, a cryptocurrency with a market cap of over 7 billion USD (top 20 blockchains). Polkadot's PoS protocol falls into a hybrid predictability model (i.e., non-global predictability model) that has never been well studied before. We present the first two risk-free (and meanwhile profitable) selfish mining attacks against Polkadot's PoS protocol. In our attack, a mining pool with 33% Byzantine validators can launch risk-free selfish mining and earn 7.09% extra block rewards in expectation. Our experimental results using Polkadot's implementation show that our risk-free attacks achieve similar profit as conventional selfish mining attack, such as the well-known selfish mining against Bitcoin.
Online platforms increasingly offer ''paid'' ad-free subscriptions as an alternative to the traditional ''free'' ad-based model. The transition to ad-free models ostensibly removes advertising as a key justification for data processing under the GDPR. So, normatively, platforms should collect less user data. However, platforms may justify continued data collection as a means to provide an improved, personalized experience. This tension between privacy principles and platform incentives raises a critical underexplored question: do data collection practices vary between ad-free and ad-based subscription models? In this paper, we shed light on this important privacy issue by investigating the alignment between platform data collection practices and related user expectations. With respect to data collection process, our analyses of data exports from three major online platforms — Instagram, Facebook, and X — reveal that these platforms continue to retain or collect some ad-related data, even in ad-free subscriptions. With respect to user expectations, our survey among 255 participants on Prolific reveals that 69% of the participants normatively expect data collection to be reduced, indicating their expectation of improved digital privacy in an ad-free model. However, when asked what they think actually happens, 63% of these participants believed that platforms would still collect about the same amount of data, highlighting skepticism about platform practices. Our findings not only indicate a significant disconnect between data practices and normative user expectations, but also raise serious questions about platform compliance with core GDPR principles, such as purpose limitation, data minimization, and transparency.
A vast amount of user-generated content is uploaded on social media everyday, potentially being collected as training data for large language models, and thus poses severe threats to individual privacy. Existing approaches for protecting user-generated content often fail to detect implicit privacy leaks which are not directly given but could be inferred from the contextual text (clues). The precise detection of leaks and clues is difficult but critical in text sanitization. We propose a graph-based model for the user-generated content and build a privacy leakage detector PrivSniffer which integrates the inference capability of language models with the precise graph search, to capture the contextual privacy leakage (CPL). To evaluate the effectiveness of the framework, we create SynthLeak, a dataset of dialogues containing human-labeled implicit leaks, while featuring diversity and naturalness. Our experimental results on SynthLeak and several other benchmarks reveal PrivSniffer's superior capability in detecting implicit leaks and CPLs. Particularly in CPL detection, the state-of-the-art approach achieves only an F1 Score of 0.36, whereas PrivSniffer attains 0.59 on SynthLeak, showing great promise in real-world text sanitization.
Graph-structured data is foundational to numerous web applications, and watermarking is crucial for protecting their intellectual property and ensuring data provenance. Existing watermarking methods primarily operate on graph structures or entangled graph representations, which compromise the transparency and robustness of watermarks due to the information coupling in representing graphs and uncontrollable discretization in transforming continuous numerical representations into graph structures. This motivates us to propose DRGW, the first graph watermarking framework that addresses these issues through disentangled representation learning. Specifically, we design an adversarially trained encoder that learns an invariant structural representation against diverse perturbations and derives a statistically independent watermark carrier, ensuring both robustness and transparency of watermarks. Meanwhile, we devise a graph-aware invertible neural network to provide a lossless channel for watermark embedding and extraction, guaranteeing high detectability and transparency of watermarks. Additionally, we develop a structure-aware editor that resolves the issue of latent modifications into discrete graph edits, ensuring robustness against structural perturbations. Experiments on diverse benchmark datasets demonstrate the superior effectiveness of DRGW.
Network protocols are the foundation of modern communication, yet their implementations often contain semantic vulnerabilities stemming from inadequate understanding of specification semantics. Existing gray-box and black-box testing approaches lack semantic modeling of protocols, making it difficult to precisely express testing intent and cover boundary conditions. Moreover, they typically rely on coarse-grained oracles such as crashes, which are inadequate for identifying deep semantic vulnerabilities. To address these limitations, we present a semantics-aware fuzzing framework, SemFuzz. The framework leverages large language models to extract structured semantic rules from RFC documents and generates test cases that intentionally violate these rules to encode specific testing intents. It then detects deep semantic vulnerabilities by comparing the observed responses with the expected ones. Evaluation on seven widely deployed protocol implementations shows that SemFuzz identified sixteen potential vulnerabilities, ten of which have been confirmed. Among the confirmed vulnerabilities, five were previously unknown and four have been assigned CVEs. These results demonstrate the effectiveness of SemFuzz in detecting semantic vulnerabilities.
Recent advances in generative AI have popularized synthetic content for training, offering a practical alternative to costly data curation while addressing privacy concerns. However, accumulating evidence shows that the indiscriminate reuse of synthetic data can induce model collapse—a degenerative process that contracts the learned distribution and erodes rare features. For instance, when models are iteratively trained on their own synthetic outputs, the upper tail of the perplexity distribution substantially compresses, with high-percentile values dropping by nearly half—a clear indicator of severe diversity loss. To counter this, we introduce DASGen, a Distribution-Aligned Synthetic Text Generation framework via tail-aware enhancement. Our method first identifies underrepresented regions via embedding-space mining, then steers a frozen, hosted LLM using semantically-structured prompts and a discriminative diversity objective to enrich tail features. This training-free approach enables direct deployment in existing data pipelines. Extensive evaluations on Yelp and ICLR'25 review benchmarks show that DASGen significantly outperforms competitive baselines, achieving tail coverage (98.54% on Yelp; 92.00% on ICLR'25) along with improved downstream accuracy. Overall, DASGen provides a practical path to synthesizing distribution-aligned text by explicitly enhancing tail regions, producing synthetic corpora with enhanced coverage and diversity for more reliable long-tailed applications.
Web Application Firewalls (WAFs) are widely deployed as a primary defense mechanism against injection-based web attacks by inspecting HTTP traffic for malicious patterns. However, structural inconsistencies in HTTP/2 stream parsing introduce a protocol-level attack surface that remains insufficiently examined. We propose the Stream Parser Confusion Attack (SPCA), a novel evasion technique that exploits discrepancies between WAFs and backend HTTP/2 servers in processing stream dependencies and priorities. SPCA operates without altering payload content, relying solely on RFC-compliant manipulation of stream priority weights and dependency trees to deliver unmodified malicious inputs past WAF inspection. To evaluate the feasibility and generality of SPCA, we design three well-defined stream topologies—skewed, k-ary, and unbalanced—each capturing unique structural traits observed in real-world HTTP/2 scheduling patterns. Each topology's dataset consists of 500 structurally distinct requests, derived by embedding 100 malicious test cases across five distinct priority levels. We transmit these requests against 13 commercial and open-source WAFs and 20 backend web frameworks in a black-box setting. Each topology individually achieves a bypass success rate of 49.66% for the skewed tree, 44.62% for the k-ary tree, and 46.38% for the unbalanced tree. Under the concurrent attack with three topologies, the overall success rate exceeds 89% on average against the open-source and commercial WAFs. These findings demonstrate that structure-only protocol-compliant manipulation is sufficient to systematically bypass modern WAFs, revealing critical blind spots in HTTP/2-aware traffic inspection. We responsibly disclosed the identified issues to all affected vendors and received acknowledgments of the disclosures.
Finality gadget is a critical component in modern blockchain systems. Ever since Ethereum used the Casper finality gadget, many variants of finality approaches have been adopted to make it possible to finalize blocks, i.e., when a block is finalized, its order will never be reversed. In this work, we study the finality approach by VeChainThor, the consensus protocol of VeChain blockchain. We propose greedy attack, an attack in which a block proposed by an honest sealer can be finalized with a probability of only 0.19%. We validate our results via theoretical analysis and extensive experimentation. Our findings have been disclosed and acknowledged by the VeChain team, and we are currently working with them to improve the VeChainThor protocol.
In the literature, prior research on Security-oriented Video Understanding (SVU) has predominantly focused on detecting and locating the threats (e.g., shootings, robberies) in videos, while largely lacking the effective capability to generate and evaluate the threat causes. Motivated by these gaps, this paper introduces a new chat paradigm SVU task, i.e., In-depth Security-oriented Video Understanding (DeepSVU), which aims to not only identify and locate the threats but also attribute and evaluate the causes of threatening segments in detail. Furthermore, this paper reveals two key challenges in the proposed task: 1) how to effectively model the coarse-to-fine physical-world information (e.g., human behavior, object interactions and background context) to boost the DeepSVU task, and 2) how to adaptively trade off these factors. Addressing these challenges is crucial for improving VAD, especially for identifying, locating, and attributing anomalies. To tackle these challenges, this paper proposes a new Unified Physical-world Regularized MoE (UPRM) approach. Specifically, UPRM incorporates two key components: the Unified Physical-world Enhanced MoE (UPE) Block and the Physical-world Trade-off Regularizer (PTR), to address the above two challenges, respectively. Extensive experiments conduct on our DeepSVU instructions datasets (i.e., UCF-C instructions and CUVA instructions) demonstrate that UPRM outperforms several advanced Video-LLMs as well as non-LLM approaches. such information.These justify the importance of the coarse-to-fine physical-world information in the DeepSVU task and demonstrate the effectiveness of our UPRM in capturing such information.
The widespread proliferation of online content has intensified concerns about clickbait, deceptive or exaggerated headlines designed to attract attention. While Large Language Models (LLMs) offer a promising avenue for addressing this issue, their effectiveness is often hindered by Sycophancy, a tendency to produce reasoning that matches users' beliefs over truthful ones, which deviates from instruction-following principles. Rather than treating sycophancy as a flaw to be eliminated, this work proposes a novel approach that initially harnesses this behavior to generate contrastive reasoning from opposing perspectives. Specifically, we design a Self-renewal Opposing-stance Reasoning Generation (SORG) framework that prompts LLMs to produce high-quality ''agree'' and ''disagree'' reasoning pairs for a given news title without requiring ground-truth labels. To utilize the generated reasoning, we develop a local Opposing Reasoning-based Clickbait Detection (ORCD) model that integrates three BERT encoders to represent the title and its associated reasoning. The model leverages contrastive learning, guided by soft labels derived from LLM-generated credibility scores, to enhance detection robustness. Experimental evaluations on three benchmark datasets demonstrate that our method consistently outperforms LLM prompting, fine-tuned smaller language models, and state-of-the-art clickbait detection baselines. Our code is available in https://github.com/126541/ORCD.
With the growing importance of content safety, toxic language detection, especially in Chinese online environments, has become a key task in natural language processing. However, real-world toxic expressions often appear in obfuscated forms such as pinyin abbreviations, symbol insertion, or visually similar substitutions, making them difficult to detect using traditional rule-based or static models. To address this challenge, we propose a dynamic knowledge graph construction method for toxic text variants, named Variant-KG. This graph encodes diverse structural relations between canonical toxic terms and their variants based on phonetic similarity, visual resemblance, and contextual co-occurrence. A small amount of labeled data is further used to fine-tune large language models (LLMs), enabling initial normalization and variant recognition. On top of this, we design a collaborative detection framework that combines the Variant-KG with frozen LLMs. It performs graph augmented prompting for structure-aware reasoning and adopts a Think-Search-Generate paradigm to dynamically recover broken paths when graph connections are incomplete, enabling both data self-enhancement and knowledge completion during inference. Evaluations on multiple Chinese toxic language datasets show that our model consistently outperforms both non-knowledge-enhanced and existing knowledge-enhanced baselines, demonstrating the effectiveness of our proposed dynamic reasoning framework in handling diverse toxic expressions.
With the ubiquitous deployment of web services, ensuring data confidentiality has become a challenging imperative. Fully Homomorphic Encryption (FHE) presents a powerful solution for processing encrypted data; however, its widespread adoption is severely constrained by two fundamental bottlenecks: substantial computational overhead and the absence of a built-in automatic error correction mechanism. These limitations render the deployment of FHE in real-world, complex network environments impractical. To address this dual challenge, this work puts forward a new FHE framework that enhances computational efficiency and integrates an automatic error correction capability through new encoding techniques and an algebraic reliability layer. Our system was validated across several web workloads, including encrypted inference on MNIST and CIFAR-10, federated aggregation with non-IID data, and streaming analytics on household power consumption data. Experimental results demonstrate significant performance improvements, particularly with large polynomial modulus degrees such as N=8192, while maintaining task accuracy within 0.5% of the plaintext baseline. Furthermore, our error correction mechanism reduces the service failure rate to below 0.5% even under harsh, bursty network fault conditions.
Today, mobile super apps such as WeChat offer a wide array of services through integrated miniapps. While the miniapps provide self-contained services via JavaScript and Web interfaces, the existence of a centralized authority, i.e., super app platform, enables strong protection against malware. Among the many mechanisms, the built-in report interface is an essential security countermeasure, allowing users to report any suspicious miniapp that is released to the market. Alarmingly, our study reveals that there are malicious miniapps implementing deceptive reporting interfaces to impersonate the official ones. If users are guided to these fake reporting interfaces that discard or rerouting the reports, the platforms will never be alarmed about the malware existence, thus enabling the malware to circumvent post-vetting regulation. In response to this imminent threat, this paper identifies, analyzes, and constructs a dataset consisting of 3,587 malware with detailed information among 135,274 official-alike reporting interfaces among over 4 million miniapps. Our findings further reveal abundant variations of behavior, including discarding or redirecting reports, applying obfuscation to escape vetting, and batch registration to lower the risk of platform removal. We have reported these malware to parties of interest, and we will release this dataset to facilitate further detection and analysis for the web community.
Social engineering attacks delivered via email, commonly known as phishing, represent a persistent cybersecurity threat leading to significant organizational incidents and data breaches. Although many organizations train employees on phishing, often mandated by compliance requirements, the real-world effectiveness of this training remains debated. Past work has demonstrated the ineffectiveness of training, but reproduction across different organizations, training approaches, and with a standardized threat assessment will help the generalizability of this phenomenon. To contribute to evidence-based cybersecurity policy, we conducted a large-scale reproduction study (N=12,511) at a US-based financial technology firm. Our design refined prior work by comparing training modalities in operational environments, applying NIST's standardized phishing difficulty measurement, and introducing novel organizational-level temporal resilience metrics. Echoing prior work, training interventions showed no significant main effects on click rates (p=0.450) nor reporting rates (p=0.417), with negligible effect sizes. However, we found that the NIST Phish Scale predicted user behavior, with click rates increasing from 7.0% (easy lures) to 15.0% (hard lures). Our organizational-level resilience result was mixed: 36-55% of campaigns achieved ''inoculation'' patterns where reports preceded clicks, but training did not significantly improve organizational-level temporal protection. Our results confirm the ineffectiveness of current phishing training approaches and offer a refined study design for future work.
Malicious agents pose significant threats to the reliability and decision-making capabilities of Multi-Agent Systems (MAS) powered by Large Language Models (LLMs). Existing defenses often fall short due to reactive designs or centralized architectures which may introduce single points of failure. To address these challenges, we propose SentinelNet, the first decentralized framework for proactively detecting and mitigating malicious behaviors in multi-agent collaboration. SentinelNet equips each agent with a credit-based detector trained via contrastive learning on augmented adversarial debate trajectories, enabling autonomous evaluation of message credibility and dynamic neighbor ranking via bottom-k elimination to suppress malicious communications. To overcome the scarcity of attack data, it generates adversarial trajectories simulating diverse threats, ensuring robust training. Experiments on MAS benchmarks show SentinelNet achieves near-perfect detection of malicious agents, close to 100% within two debate rounds, and recovers 95% of system accuracy from compromised baselines. By exhibiting strong generalizability across domains and attack patterns, SentinelNet establishes a novel paradigm for safeguarding collaborative MAS.
The real-time demand for web security makes Security Information and Event Management (SIEM) platforms and their applied security rule an integral part of the intrusion detection life-cycle. However, the heterogeneity of vendor-specific rules (e.g., Splunk SPL, Microsoft KQL, IBM AQL, Google YARA-L, and RSA ESA) makes cross-platform rule reuse extremely difficult, requiring deep domain knowledge for reliable conversion. As a result, an autonomous and accurate rule conversion framework can significantly lead to effort savings, preserving the value of existing rules. In this paper, we propose ARuleCon, an agentic SIEM-rule conversion approach. Using ARuleCon, the security professionals do not need to distill the source rules' logic and re-map it to target vendors, instead, they provide the source rules, the documentation of the target rules and ARuleCon can purposely convert to the target vendors without more intervention. To achieve this, ARuleCon is equipped with intermediate representation (IR) that aligns core detection logic into vendor-neutral layer, agentic RAG pipeline that retrieves authoritative official vendor documentation to address the convension/schema mismatches, and Python-based consistency check that running both source and target rules in controlled test environments to mitigate subtle semantic drifts. We present a comprehensive evaluation of ARuleCon ranging from textual alignment between the source and target rules, and the execution success of target rules, showcasing ARuleCon can convert rules with higher fidelity, outperforming the baseline LLM models by 15% averagely. Finally, we perform a case study and interview with our industry collaborators 1, which showcases that ARuleCon can significantly save the expert's time on understanding the cross-SIEM's documentation and remapping the logic.
Large web-scale datasets have driven the rapid advancement of pre-trained language models (PLMs), but unauthorized data usage has raised serious copyright concerns. Existing dataset ownership verification (DOV) methods typically assume that watermarks remain stable during inference; however, this assumption often fails under natural noise and adversary-crafted perturbations. We propose the first certified dataset ownership verification method for PLMs under a gray-box setting (i.e., the defender can only query the suspicious model but is aware of its input representation module), based on dual-space smoothing (i.e., DSSmoothing). To address the challenges of text discreteness and semantic sensitivity, DSSmoothing introduces continuous perturbations in the embedding space to capture semantic robustness and applies controlled token reordering in the permutation space to capture sequential robustness. DSSmoothing consists of two stages: in the first stage, triggers are collaboratively embedded in both spaces to generate norm-constrained and robust watermarked datasets; in the second stage, randomized smoothing is applied in both spaces during verification to compute the watermark robustness (WR) of suspicious models and statistically compare it with the principal probability (PP) values of a set of benign models. Theoretically, DSSmoothing provides provable robustness guarantees for dataset ownership verification by ensuring that WR consistently exceeds PP under bounded dual-space perturbations. Extensive experiments on multiple representative web datasets demonstrate that DSSmoothing achieves stable and reliable verification performance and exhibits robustness against potential adaptive attacks. Our code is available at https://github.com/NcepuQiaoTing/DSSmoothing.
Deep neural networks (DNNs) have achieved remarkable success across various domains, but their reliance on large datasets often containing sensitive information raises significant privacy concerns. In response to stringent privacy regulations such as GDPR and CCPA, machine unlearning (MUL) has emerged as a critical technique to remove the influence of specific data samples from trained models. However, existing unlearning methods face two major challenges: privacy deficiencies in the remaining datasets and significant instability of the model after unlearning. To address these issues, we propose DeepUL, a deep unlearning algorithm that leverages model sparsity to enhance both privacy and stability. DeepUL follows a two-step process: first pruning and then unlearning. The pruning step not only sparsifies the model but also decouples the model parameters from the original training data, thereby improving privacy. The unlearning step employs gradient projection to eliminate dependencies on the data to be deleted while maintaining the model stability. Additionally, we introduce a hierarchical weight pruning strategy to achieve differential pruning across network layers, preventing layer collapse and ensuring robustness. Extensive experiments on benchmark datasets demonstrate that DeepUL outperforms existing methods in utility, unlearning efficacy, privacy guarantee, and stability, making it a practical and effective solution for machine unlearning.
WebAssembly (Wasm) enables execution of memory-unsafe languages like C/C++ in the browser, but its monolithic linear memory leaves modules vulnerable to high-impact attacks such as cross-site scripting. Existing defenses are unsuitable for commercial-off-the-shelf (COTS) binaries, requiring either source code, non-standard runtimes, or introduce high-overhead instrumentation. We present Bento, the first static binary rewriter that automatically hardens COTS Wasm modules. Bento uses whole-program pointer analysis to partition memory into logical regions (stack, heap, globals) and rewrites the binary to map each region to an isolated instance using the standard Wasm multi-memory feature. This creates a software-based MMU that provides architectural hardening without adding instructions or costly runtime checks. Our evaluation shows that Bento mitigates real-world exploits in prominent applications, including Libpng and PDFAlto, while preserving program semantics, as confirmed by differential testing. Since our architectural approach adds no new instructions, Bento only induces 3% runtime slowdown and a 1% startup overhead.