The rapid proliferation of large language models (LLMs) in web-scale applications has heightened the need for robust security mechanisms. To address these challenges, various guardrail strategies have been introduced, including input filters, output moderation, and model alignment. Among them, input-side guardrails are commonly adopted as the first line of defense against adversarial prompts. However, we identify a critical architectural weakness: a representation asymmetry between input-side guardrails and the core LLMs, which creates a security gap exploitable by adversaries. Through systematic analysis, we show that guardrails are fragile when facing minor character perturbations, while LLMs remain semantically resilient and can still reconstruct malicious intent from noisy inputs. Exploiting this asymmetry, we propose RepMism, a hybrid adversarial framework that combines character injection with chain-of-thought hijacking, coordinated through hierarchical scheduling and safety continuation. Our extensive empirical evaluation across four commercial LLMs and five state-of-the-art guardrails demonstrates RepMism's strong attack capability, achieving high success rates. Importantly, we identify a ''success interval'' where perturbations effectively bypass guardrail detection yet remain interpretable to target models. These findings expose key flaws in current multi-layer security architectures and offer actionable guidance for building more resilient defenses through perturbation-aware training and cross-layer representation alignment.
论文检索
输入标题、作者或关键词，从 954 篇学术成果中精准定位
Hidden web interfaces in Internet of Things (IoT) devices pose significant security threats by unintentionally exposing inadequately protected functionalities, enabling attackers to bypass authentication, alter configurations, leak sensitive data, or execute arbitrary commands. Despite recent advancements, current detection approaches suffer from two critical challenges: 1) inadequately model the complex internal routing mechanisms of IoT firmware, leading to incomplete interface enumeration and substantial false negatives; and 2) inefficiently generate probing requests and verify unauthorized access due to limited semantic understanding of interface communication protocols. To overcome these challenges, we introduce FalconScope, a novel system combining precise firmware routing modeling and Large Language Model (LLM)-driven semantic analysis to detect hidden web interfaces effectively and efficiently. FalconScope achieves this through two key innovations: 1) a static analysis technique precisely reconstructs the device's internal routing mechanisms, enabling comprehensive enumeration of Routing Unique Identifiers and their corresponding backend handlers; and 2) an LLM-powered semantic engine automatically generates syntactically and semantically valid HTTP requests to efficiently trigger backend logic, coupled with semantic validation of device responses to accurately confirm unauthorized access. Evaluations on 11 real-world IoT devices from four major vendors demonstrate that FalconScope significantly surpasses existing state-of-the-art tools, detecting 620 hidden web interfaces—103 times more than IoTScope—while consuming only 3.6% of its analysis time. Following responsible disclosure, 50 issues have been assigned CVE IDs.
Decentralized identity (DID) is a key infrastructure for Web3, granting users sovereign control over their private identity data. While existing DID systems like FADID-TT (WWW'25) realize anonymity and traceability within a single domain, the Web3 ecosystem is a multiverse of independent domains like DeFi, GameFi, and DAO. This multi-domain reality presents critical issues for current DID solutions. First, most existing solutions are built on the monolithic committee architecture, facing severe scalability bottlenecks as the committee size grows. Second, most existing solutions cannot offer strong cross-domain anonymity, where frequent cross-domain interaction inevitably exposes the user's privacy. Third, existing methods for tracing the identities of malicious users are inefficient. To address these issues, we propose ShadowClone, a DID system that offers strong scalability, cross-domain anonymity, and efficient accountable traceability. Firstly, we introduce a sharding architecture that partitions the global system into multiple independent domain committees, enhancing system scalability. Moreover, we realize strong cross-domain anonymity, a new and stronger privacy guarantee for multi-domain DID systems. We design a domain-hiding presentation protocol based on an accountable ring signature scheme. A user can prove membership in a trusted set of domains without revealing home domain, preventing profiling based on domain affiliation. Furthermore, we design a hierarchical cross-domain tracing mechanism to ensure efficient accountable traceability. An opening committee first identifies the user's home domain and the home domain committee efficiently traces user identity within a smaller scope. Notably, the entire tracing process is distributed and publicly verifiable. Lastly, we conduct extensive experiments. The evaluation results demonstrate that ShadowClone realizes only the 10.4% and 20% registration and tracing latency compared with FADID-TT, respectively, showcasing high scalability and tracing efficiency compared with FADID-TT while providing strong cross-domain anonymity and decentralization for Web3.
Federated Unlearning (FU) has emerged as a promising paradigm for effectively removing the influence of specific data of clients from the global model in federated learning. It can further enhance personal data privacy for individual clients and eliminate the impact of malicious attacks like poisoning. Due to these benefits, many FU methods have been analyzed and proposed. Yet, they largely overlook external threats against FU systems, such as gradient inversion attacks that reconstruct client data from shared gradients, posing serious privacy risks to other participating clients. Motivated by this, we propose DIARY, a Differential prIvacy IntegrAted fedeRated recoverY framework to address these dual threats. DIARY presents a privacy budget allocation method, whose insight lies in adaptively assigning appropriate privacy budgets to various training and recovery phases to fully utilize the global privacy budget of each client, balancing the trade-off between privacy and utility. Furthermore, DIARY introduces a novel Federated noise-Immune aNomaly Detection (FIND) module. The deep integration of FIND with two-level selective storage and model rollback mechanisms contributes to model recovery, while significantly reducing the associated overhead. Finally, both rigorous theoretical analysis and extensive simulations compared with state-of-the-art methods are conducted to validate the effectiveness of DIARY.
Website Fingerprinting (WF) is an emerging traffic analysis technique that enables a passive adversary to infer which websites a user visits. However, most existing studies, whether in single-tab or multi-tab settings, rely on the unrealistic assumption that users only access website homepages, diverging significantly from real-world browsing behavior. Even recent works extending WF to subpages primarily focus on website-level identification, without distinguishing which specific subpages are visited, thereby limiting the attack's granularity and scope. In this paper, we propose HiFi-WF (Hierarchical Fine-grained Website Fingerprinting), a novel framework that breaks the homepage-only assumption and extends WF to multi-tab recognition and fine-grained subpage identification. We formulate the task as a hierarchical multi-label classification problem, jointly modeling the distinctions and correlations between homepages and subpages. To this end, HiFi-WF integrates a unified CNN-based extractor and layered encoder with a Feature Interaction Module based on multi-head cross-attention to capture inter-level dependencies. An Enhanced SubHead enforces hierarchical constraints to suppress invalid subpage predictions, while a cascaded channel–spatial attention mechanism refines discriminative features for precise hierarchical identification. Experimental results demonstrate that HiFi-WF achieves state-of-the-art performance at both hierarchical levels, attaining F1-scores of 92.1% (homepage) and 81.9% (subpage), thereby validating its effectiveness in advancing WF attacks toward realistic, fine-grained, and multi-tab browsing scenarios. Related codes and datasets can be found in https://github.com/wusongyang02-blip/HiFi-WF.
While Tor's strong anonymity shields users' privacy, it also enables malicious activities, motivating attacks that bypass its protections. Website Fingerprinting (WF) has emerged as a primary threat in this domain. However, existing WF methods struggle with realistic multi-tab browsing scenarios, often relying on prior knowledge of the number of open tabs and lacking robustness against network noise and defenses. To address these challenges, we propose Forge, a robust WF attack framework inspired by the classic cocktail party problem. Specifically, Forge reframes multi-tab WF as a task of Blind Source Separation(BSS), decomposing mixed traffic into individual signals without requiring a predefined number of concurrent tabs. A robust website identifier then classifies separated components using a dual-domain attention mechanism across time and frequency, allowing Forge to effectively resist WF defenses and network noise. We evaluate our model on a comprehensive collection of datasets covering open-world, defense-enabled, and dynamic scenarios. The results demonstrate that Forge can improve Mean Average Precision by 78.6% over the state-of-the-art average in the challenging multi-tab open-world scenario.
Web browsers store cookies to save a user's authentication status. Sharing these authentication cookies across subdomains, a common practice for user convenience, creates a critical session hijacking vulnerability. When cookies for a parent domain are sent to all subdomains, an attacker who compromises any single subdomain can intercept them. Using these stolen cookies, the attacker can impersonate users across all other services hosted on the domain. We conduct the first ethical, large-scale evaluation of authentication cookie leakage to compromised subdomains caused by insecure cookie scoping, a vulnerability we call ''CookieDrift''. We develop a novel, non-intrusive, and ethical method to detect CookieDrift by simulating a hijacked subdomain and recording all leaked cookies. From a list of over 2,500 popular domains with accounts, 57.98% (1,472) are vulnerable to cookie theft. Of these, 45.45% (669 domains) are immediately exploitable through subdomain takeover attacks. We find evidence of active, real-world hijacks affecting 186 domains and discover authentication cookies from these domains in darknet leaks using ''CookieDelta'', a new filtering technique we developed to isolate authentication-relevant cookie names. We investigate root causes of insecure cookie sharing by reviewing RFCs and major authentication frameworks and conclude: Defaults are secure, but examples encourage excessive cookie sharing caused by limitations in RFC 6265. We propose countermeasures that preserve backward-compatibility and ease-of-use while enabling finer-grained control over cookie propagation. We include two key artifacts: a locally running web application, ''DeltaInterceptor'', for testing any website's vulnerability to CookieDrift as well as computing CookieDelta, and a sanitized dataset of all recorded cookies.
The Domain Name System (DNS) plays a crucial role in modern web applications; however, manipulations such as hijacking, tampering, and censorship can disrupt domain resolution, posing significant privacy and security risks. While such manipulations are prevalent across global DNS infrastructures, their scope and mechanisms remain poorly understood. Existing studies focus on country-level censorship or rely on authoritative data and passive traffic from selected domains, which prevents a comprehensive understanding. Moreover, the dynamic nature of modern DNS resolution, in which a single domain may resolve to thousands of edge servers, further complicates the detection of manipulated responses. In this work, we propose a novel approach for measuring DNS manipulations based on resolution path analysis. Our method leverages CNAME chains and attributes of intermediate nodes in the DNS resolution process to link dynamic resolution results, enabling accurate detection of manipulation in highly dynamic DNS environments. We conduct large-scale measurements for 2,283 popular domains across global open DNS infrastructures. Measurement results reveal critical insights into DNS manipulation, uncovering the strategies and preferences of malicious manipulation operators and demonstrating how specific domains are exploited.
While the literature features a number of proposals to defend against transaction manipulation attacks, existing proposals are still not integrated within large blockchains, such as Bitcoin, Ethereum, and Cardano. Instead, the user community opted to rely on more practical but ad-hoc solutions (such as Mempool.space) that aim at detecting censorship and transaction displacement attacks by auditing discrepancies in the mempools of so-called observers. In this paper, we precisely analyze, for the first time, the interplay between mempool auditing and the ability to detect censorship and transaction displacement attacks by malicious miners in Bitcoin and Ethereum. Our analysis shows that mempool auditing can result in mis-accusations against miners with a probability larger than 25% in some settings. On a positive note, however, we show that mempool auditing schemes can successfully audit the execution of any two transactions (with an overwhelming probability of 99.9%) if they are consistently received by all observers and sent at least 30 seconds apart from each other. As a direct consequence, our findings show, for the first time, that batch-order fair-ordering schemes can offer only strong fairness guarantees for a limited subset of transactions in real-world deployments.
LLM-powered agents are evolving from passive recommenders into autonomous executors, leveraging tools via the Model Context Protocol (MCP) for web automation. However, this paradigm introduces a new vulnerability: tool poisoning attacks that manipulate the MCP context can corrupt an agent's reasoning. Existing methods focus on anomaly detection and lack autonomous correction mechanisms, hindering their real-world deployment. In this paper, we introduce MCPFixGen, to the best of our knowledge, the first framework to provide automated anomaly detection and correction. We tackle three fundamental challenges: (1) when to initiate anomaly inspection with minimal overhead, (2) what features effectively characterize abnormality, and (3) how to automatically execute remedial actions. MCPFixGen achieves this through a novel multi-checkpoint rollback mechanism for anomaly management. MCPFixGen proposes a multi-checkpoint rollback anomaly management mechanism. Strategically places checkpoints at high-risk operations based on the tools-calling risk distribution. Then it identifies unanticipated tool behaviors by leveraging the correlation between attention activation values and tool calls. Finally, it introduces an attention-mask-based backtracking and correction mechanism. By masking the root cause of the anomaly, the LLM is prompted to re-infer, facilitating efficient and low-cost anomaly resolution. Our evaluation on real-world datasets demonstrates that MCPFixGen reduces interruptions caused by anomalies to below 13%, decreases the success rate of tool poisoning attacks to less than 0.3%, and significantly improves the robustness, computational efficiency, and task completion rate of web intelligence applications compared to existing approaches.
The emergence of Large Language Model-enhanced Search Engines (LLMSEs) has revolutionized information retrieval by integrating web-scale search capabilities with AI-powered summarization. While these systems demonstrate improved efficiency over traditional search engines, their security implications against well-established black-hat Search Engine Optimization (SEO) attacks remain unexplored. In this paper, we present the first systematic study of SEO attacks targeting LLMSEs. Specifically, we examine ten representative LLMSE products (e.g., ChatGPT, Gemini) and construct SEO-Bench, a benchmark comprising 1,000 real-world black-hat SEO websites, to evaluate both open- and closed-source LLMSEs. Our measurements show that LLMSEs mitigate over 99.78% of traditional SEO attacks, with the phase of retrieval serving as the primary filter, intercepting the vast majority of malicious queries. We further propose and evaluate seven LLMSEO attack strategies, demonstrating that off-the-shelf LLMSEs are vulnerable to LLMSEO attacks, i.e., rewritten-query stuffing and segmented texts double the manipulation rate compared to the baseline. This work offers the first in-depth security analysis of the LLMSE ecosystem, providing practical insights for building more resilient AI-driven search systems. We have responsibly reported the identified issues to major vendors.
Privacy leakage on Web-based platform has become a critical challenge as users continually share personal information through online social networks, health tracking platforms, and other Web services. Information recipients and third-party can progressively aggregate shared content across the Web, enabling increasingly accurate profiling of individuals. However, existing studies typically treat each disclosure as independent, overlooking the cumulative privacy risks that arise in continual information sharing. In addition, the subjective cognition of both users and adversaries in Web environments, where users and adversaries can dynamically adapt based on observable actions, remains underexplored. To address these challenges, we propose a dynamic Stackelberg game model for continual information sharing scenarios, where user's sequential privacy decisions are optimized to balance privacy protection and data utility. The model explicitly captures the cognitive behaviors of both the user and the adversary, allowing their subjective perceptions to shape the Stackelberg equilibrium. Building on this formulation, we develop a reinforcement learning-based algorithm to derive approximately optimal strategies for mitigating privacy leakage in the context of continual information sharing. Experiments on real-world datasets demonstrate that our method significantly reduces cumulative privacy risks while preserving the utility of shared content. The proposed model further provides actionable insights for the design of privacy-enhancing technologies and web platform policies.
Graph unlearning (GU), which removes nodes, edges, or features from trained graph neural networks (GNNs), is crucial in Web applications where graph data may contain sensitive, mislabeled, or malicious information. However, existing GU methods lack a clear understanding of the key factors that determine unlearning effectiveness, leading to three fundamental limitations: (1) impractical and inaccurate GU difficulty assessment due to test-access requirements and invalid assumptions, (2) ineffectiveness on hard-to-unlearn tasks, and (3) misaligned evaluation protocols that overemphasize easy tasks and fail to capture true forgetting capability. To address these issues, we establish GNN memorization as a new perspective for understanding graph unlearning and propose MGU, a Memorization-guided Graph Unlearning framework. MGU achieves three key advances: it provides accurate and practical difficulty assessment across different GU tasks, develops an adaptive strategy that dynamically adjusts unlearning objectives based on difficulty levels, and establishes a comprehensive evaluation protocol that aligns with practical requirements. Extensive experiments on ten real-world graphs demonstrate that MGU consistently outperforms state-of-the-art baselines in forgetting quality, computational efficiency, and utility preservation.
Network intrusion detection systems (NIDS) are essential for web security by identifying and dropping malicious traffic. Existing in-network NIDS leverage the Tbps-level packet processing capability of programmable switches to achieve high-speed flow classification. They translate complex trained machine learning models to decision trees (DTs), where DTs are deployed on programmable switches via single-DT or multiple-DT deployment. However, they face a fundamental trade-off: single-DT deployment suffers from low classification accuracy due to over-pruning of trees, while multiple-DT deployment suffers from high overhead due to deploying multiple tree replicas. In this paper, we propose Proteus, an in-network malicious traffic detection system that achieves both high classification accuracy and low overhead. Its key idea is to split the original DT into critical and normal sub-trees, where these sub-trees have different impacts on overall accuracy. More precisely, Proteus first splits a DT into one critical and several normal sub-trees for adapting to the accuracy requirement and switch resource budgets. Second, it minimizes coordination overhead between sub-trees while ensuring full flow coverage via mixed-integer linear programming. Third, it dynamically reallocates or migrates sub-trees to adapt to changing resources by monitoring both classification accuracy and switch resource changes. Testbed experiments with 12.8 Tbps programmable switches show that Proteus improves classification accuracy, reduces switch resource consumption, and reduces classification latency.
Despite its practical impact, closed-box fuzzing on web applications remains understudied. This paper investigates two fundamental limitations of closed-box web fuzzing: (1) limited input space exploration due to the lack of a feedback mechanism, and (2) ineffective exploitation strategies caused by the shallow vulnerability identification. We propose Zelda, a novel closed-box web fuzzer designed to address these limitations. Specifically, we infer feedback signals from web responses in a closed-box testing environment, thereby deriving a feedback mechanism to guide the fuzzing process. We then coordinate two distinct input generation strategies for path exploration and exploitation, based on the exploration stage, which facilitates both in-page code coverage and vulnerability identification. Our evaluation across 15 real-world applications and nine benchmark sets demonstrates that Zelda's feedback mechanism and strategies are effective in practical web vulnerability discovery. Zelda uncovered 182 vulnerabilities, outperforming six state-of-the-art web fuzzers. In the wild, Zelda further discovered previously unreported vulnerabilities that received 29 CVE assignments.
Wireless sensor network (WSNs) stands out as a burgeoning and promising domain in intelligent sensing. Owing to various factors such as sudden sensor malfunctions or deliberate shutdown of partial nodes to save energy, the collected sensing signals from WSNs commonly have massive missing data, leading to adverse effects on subsequent analysis or decision-making. Latent factor learning (LFL) has proven to be highly effective in recovering the missing data for WSNs. However, the existing LFL models require the collected sensing signals to be maintained in one central place like a central server, which is becoming unacceptable for data owners who are getting increasingly privacy-sensitive. To address this issue, this paper innovatively proposes a f ederated l atent f actor l earning (FLFL) model for privacy-preserving spatio-temporal signal recovery. Its main idea is two-fold: 1) it designs a sensor-level federated learning framework based on LFL, where each sensor only needs to upload gradient information rather than raw data for training a privacy-preserving recovery model, and 2) it incorporates the spatio-temporal correlation into the designed federated learning framework as the regularization constraint to improve its recovery accuracy. With such designs, FLFL can not only accurately recover the missing data of WSNs but also ensure data owners' privacy-preserving of raw data. To evaluate the proposed FLFL model, extensive experiments have been conducted on four real-world WSNs datasets. The results demonstrate that FLFL significantly outperforms five state-of-the-art federated signal recovery models in terms of recovery accuracy with privacy-preserving.
Recent progress in adversarial attacks on 3D point clouds, particularly in achieving spatial imperceptibility and high attack performance, presents significant challenges for defenders. Current defensive approaches remain cumbersome, often requiring invasive model modifications, expensive training procedures or auxiliary data access. To address these threats, in this paper, we propose a plug-and-play and non-invasive defense mechanism in the spectral domain, grounded in a theoretical and empirical analysis of the relationship between imperceptible perturbations and high-frequency spectral components. Building upon these insights, we introduce a novel purification framework, termed PWAVEP, which begins by computing a spectral graph wavelet domain saliency score and local sparsity score for each point. Guided by these values, PWAVEP adopts a hierarchical strategy, it eliminates the most salient points, which are identified as hardly recoverable adversarial outliers. Simultaneously, it applies a spectral filtering process to a broader set of moderately salient points. This process leverages a graph wavelet transform to attenuate high-frequency coefficients associated with the targeted points, thereby effectively suppressing adversarial noise. Extensive evaluations demonstrate that the proposed PWAVEP achieves superior accuracy and robustness compared to existing approaches, advancing the state-of-the-art in 3D point cloud purification. Code and datasets are available at https://github.com/a772316182/pwavep
In-context learning (ICL) has become a powerful, data-efficient paradigm for text classification using large language models. However, its robustness against realistic adversarial threats remains largely unexplored. We introduce ICL-Evader, a novel black-box evasion attack framework that operates under a highly practical zero-query threat model, requiring no access to model parameters, gradients, or query-based feedback during attack generation. We design three novel attacks—Fake Claim, Template, and Needle-in-a-Haystack—that exploit inherent limitations of LLMs in processing in-context prompts. Evaluated across sentiment analysis, toxicity, and illicit promotion tasks, our attacks significantly degrade classifier performance (e.g., achieving up to 95.3% attack success rate), drastically outperforming traditional NLP attacks which prove ineffective under the same constraints. To counter these vulnerabilities, we systematically investigate defense strategies and identify a joint defense recipe that effectively mitigates all attacks with minimal utility loss (<5% accuracy degradation). Finally, we translate our defensive insights into an automated tool that proactively fortifies standard ICL prompts against adversarial evasion. This work provides a comprehensive security assessment of ICL, revealing critical vulnerabilities and offering practical solutions for building more robust systems. Our source code and evaluation datasets are publicly available at: https://github.com/ChaseSecurity/ICL-Evader ICL-Evader Repository.
While the web interfaces of remotely managed devices offer convenience, their unstructured content can inadvertently leak geographic locations, posing a significant security risk. We aim to assess the feasibility of automatically exploiting this leakage, serving as a clear warning to cybersecurity regulators. To this end, we propose WebGeoInfer, a framework that does not rely on page structure. It extracts clues through page clustering and differential analysis to overcome the challenge of information heterogeneity. It also leverages search engines and large language models to augment sparse clues and infer precise coordinates, addressing the challenge of information sparsity. In large-scale experiments, WebGeoInfer successfully located 5,435 devices across 94 countries and 2,056 cities, achieving accuracy rates as high as 96.96% at the country level, 88.05% at the city level, and 79.70% at the street level. These findings provide the first conclusive evidence of the reality and scale of this threat. Furthermore, our analysis offers new insights and mitigation strategies for affected devices, establishing a key benchmark for future security research.
The value of NFTs (Non-Fungible Tokens) is built on the promise of decentralization, permanence, and immutability. However, a significant gap exists between this perception and reality. In this paper, we collect over 16 million real-world NFTs and systematically analyze their storage locations. Our results reveal a widespread reliance on fragile off-chain storage and uncover a ''Blue-chip Trap'' where high-value assets depend heavily on centralized infrastructure, rendering the promise of decentralization largely misleading. Consequently, we propose the first taxonomy of NFT storage defects, classifying eight distinct vulnerabilities into access failure, tamperability, and forgeability. Through a large-scale empirical analysis, we map real-world assets to this taxonomy, confirming the widespread prevalence of these defects across the ecosystem. Finally, we analyze the impact of these defects on assets, users, and the ecosystem, and systematically quantify their severity using the Common Vulnerability Scoring System (CVSS). Our assessment reveals that all identified defects pose substantial risks, providing a reference for developers to design more secure storage strategies.