Large Language Models (LLMs), trained on vast web corpora and now widely integrated into web services like search engines and chatbots, have raised growing concerns about their privacy and security. This has spurred the development of Machine Unlearning techniques, which aim to effectively remove the influence of specific data (such as private user information, copyrighted web content, or harmful knowledge) from trained models while preserving general performance. However, existing LLM unlearning approaches face significant challenges, including extensive parameter modifications, a heavy reliance on retain sets to preserve utility, and limited scalability for handling sequential unlearning requests, impeding their real-world deployment in dynamic web environments. In this work, we propose Semantic Redirection for Unlearning (SRU), a lightweight framework that fine-tunes only the output word embedding layer. This targeted adjustment reshapes the model's semantic-to-lexical mapping to block undesired concepts without disturbing deeper representations, thereby preserving the model's general performance and eliminating dependency on retain sets. Furthermore, SRU's modular design enables independent, sequential unlearning tasks—a vital feature for live web services handling continuous data removal requests. Experiments on the MUSE benchmark demonstrate that SRU achieves state-of-the-art efficiency, reducing computational cost by approximately 98%, while maintaining competitive unlearning performance, making it a practical and efficient solution for building compliant and trustworthy LLM-powered web applications.
论文检索
输入标题、作者或关键词，从 954 篇学术成果中精准定位
Mixing services run on blockchain trading systems, enhancing the transaction privacy of blockchain users. Yet, in recent years, the mixing services provide fertile ground for concealing illicit fund flows. Therefore, security experts make great efforts to find an effective de-anonymization of mixing services. Unfortunately, current de-anonymization technologies are constrained by a fundamental issue, i.e., the lack of a comprehensive, extensive, and reliably labeled benchmark dataset. To address this problem, we propose a new method for acquiring mixing transaction data. We design and implement a method named TGweaver, which actively executes the complete mixing workflow within a simulated blockchain environment. Furthermore, to enhance the realism of the dataset, we introduce a ''behavioral fingerprint'' mapping strategy. Ultimately, the proposed dataset includes over 891K transactions, scaling existing benchmark sizes by 2 to 4 orders of magnitude. In experiments, we use the proposed data to systematically evaluate existing de-anonymization techniques. Experimental results reveal that the current mixing address linking methods, based on heuristic rules, lacks generalization capability in complex scenarios, exhibiting low precision. In contrast, the methods utilizing supervised learning demonstrate significant advantages.
Vision–Language–Action (VLA) models underpin robotic and other embodied agents by mapping visual observations and language instructions into executable actions. Their wide adoption through open web model repositories, however, introduces new supply-chain risks: adversaries can launch adversarial attacks to manipulate the action outputs of VLAs, potentially leading to harmful real-world outcomes for embodied agents. To exploit this vulnerability, we propose MAVLA, a novel multimodal adversarial attack framework. MAVLA serves as a modular front-end that integrates seamlessly with a target VLA model, injecting perturbations into task-relevant and structure-sensitive image regions to disrupt cross-modal alignment and induce deviations in the generated action instructions. To balance attack effectiveness with stealth, we design four loss functions that jointly maximize multimodal misalignment while preserving visual stealthiness. Extensive evaluations in simulated and real-world scenarios show that at a 40% perturbation ratio, the task success rate of VLAs drops by about 70%. Compared to conventional attack baselines, MAVLA achieves superior attack effectiveness and stealthiness with low overhead. Our work reveals a practical and previously underexplored threat to embodied systems, and offers a red-team baseline to inform future defensive strategies and promote safer VLA deployment.
Artificial intelligence (AI) models are increasingly deployed directly in web browsers to enable low-latency, privacy-preserving inference. While this shift offers significant usability and scalability benefits, it also exposes model code and parameters to untrusted environments, leaving them vulnerable to theft, reverse engineering, and tampering. Our analysis demonstrates that existing JavaScript-based inference frameworks are highly susceptible to model extraction, posing serious security and intellectual property risks. To address this gap, we present WAMO, a WebAssembly-based obfuscation framework that secures browser-side AI models. WAMO introduces a comprehensive conversion pipeline that translates mainstream model formats into Wasm-native modules, applying model-specific obfuscation at the Wasm layer to target weights, operators, and computation graphs. This design shifts model execution from easily inspected JavaScript assets to hardened Wasm binaries, significantly raising the difficulty of static and dynamic analysis. Evaluation shows that WAMO increases cyclomatic complexity by 71.0% and Halstead effort by 455.57%, while incurring < 1% accuracy loss and no inference slowdown.
Website Fingerprinting (WF) attacks aim to infer the websites visited by Tor users by analyzing patterns in encrypted network traffic. However, most existing WF attacks are evaluated on traffic collected in controlled environments with fixed configurations, failing to reflect the complexity and variability of real-world conditions. In practice, traffic is far more dynamic and diverse due to heterogeneous network conditions, the large number of subpages within individual websites, and continuous evolution of website content. These factors increase intra-class variability and induce temporal feature drift, which ultimately degrades the long-term effectiveness of existing attacks. In this paper, we propose TraVerse, an LLM-based representation learning framework designed to achieve robust WF attacks under real-world conditions. TraVerse applies architectural adaptation and large-scale fine-tuning on diverse unlabeled traffic to learn generalizable and resilient representations that remain effective in dynamic and evolving environments. Furthermore, TraVerse integrates a lightweight classifier atop the LLM-derived representations, enabling accurate website identification and efficient few-shot adaptation with minimal model updates. We prototype TraVerse and conduct comprehensive evaluations using real-user traffic. Experimental results show that TraVerse improves Accuracy@3 by an average of 176.3% and weighted F1 by 343.3% over state-of-the-art baselines, while maintaining strong performance throughout a three-month longitudinal evaluation.
Graph Neural Networks (GNNs) have become a pivotal framework for modeling graph-structured data, enabling a wide range of applications from social network analysis to molecular chemistry. By integrating large language models (LLMs), text-attributed graphs (TAGs) enhance node representations with rich textual semantics, significantly boosting the expressive power of graph-based learning. However, this synergy introduces critical vulnerabilities in both topology and text. Although specialized attack methods have been designed for each of these aspects, no work has yet unified them into a comprehensive approach. In this work, we propose the Interpretable Multi-Dimensional Graph Attack (IMDGA), a human-centric framework orchestrating multi-level perturbations across graph structure and textual features. IMDGA utilizes three tightly integrated modules to craft attacks that balance interpretability and impact, enabling a deeper understanding of Graph-LLM vulnerabilities. Through rigorous theoretical analysis and comprehensive empirical evaluations on diverse datasets and architectures, IMDGA demonstrates superior interpretability, attack effectiveness, stealthiness, and robustness compared to existing methods. By exposing these underexplored semantic vulnerabilities, our work offers valuable insights for improving Graph-LLM resilience. Our code is available at https://github.com/bwfan-bit/IMDGA.
The security of web services increasingly relies on accurate detection of advanced, previously unseen attacks hidden within complex host activities. Provenance-based intrusion detection systems (PIDSes) offer a promising foundation for this task by capturing rich causal and structural relationships across processes, files, and network interactions. However, recent studies show that these graph-driven methods remain vulnerable to graph manipulation attacks, where adversaries subtly alter provenance graphs to evade detection, which limits their practical deployment. To address this challenge, we present ProvGuard, a robust anomaly detection framework that couples logic-aware multi-view augmentation with contrastive representation learning. Instead of applying arbitrary structural perturbations, ProvGuard employs Logic-Aware Noise Injection (LNI) to generate semantically valid graph views that preserve the causal semantics of provenance data. These views are then leveraged in a Logic-Preserving Contrastive Learning module, enabling the model to learn representations invariant to benign transformations yet sensitive to adversarial inconsistencies. Extensive evaluations on multiple provenance datasets show that ProvGuard surpasses state-of-the-art detectors in resisting graph manipulation attacks while maintaining high detection accuracy and efficiency, achieving an average F1-score above 96% with less than a 10% AUC drop.
Quantization is widely used to enable local deployment of large language models (LLMs) on resource-constrained devices. Recent work (e.g., QuRA) shows quantization can be exploited via rounding manipulation to implant backdoors. However, such an attack has been evaluated only on small models and does not directly apply to LLMs due to three key constraints: (1) limited poisoning data from small, task-agnostic calibration sets; (2) layer-wise quantization restricting adversarial access to global representations; and (3) lack of gradient access in quantization pipelines, blocking gradient-based attacks. We propose LLMQuA, a practical quantization-phase backdoor attack tailored to the LLM setting. LLMQuA (i) injects backdoors via data-efficient knowledge editing with few source–target token pairs, (ii) optimizes quantization parameters layer-locally to preserve activation distributions, and (iii) operates without gradient access by directly distorting quantized weights to reprogram token semantics. We evaluate LLMQuA on representative LLMs and two important attack scenarios: evasion of content moderation and causing systematic refusal of benign user queries. Empirically, LLMQuA reduces model moderation accuracy by up to 67.91% on correctly classified samples and induces refusal-to-answer behavior for over 90% of targeted queries, while degrading overall model utility by only a negligible margin on average. Finally, when tested against a range of deployment-phase defenses, many defenses fail to reliably detect LLMQuA or require substantially increased computational or operational costs to mitigate it. These results expose a practical, low-overhead supply-chain threat to quantized LLM deployments and motivate the need for deployment-aware integrity checks in LLM quantization workflows.
Privacy-preserving data trading allows data owners to sell data to consumers through a data trading web platform, the data market, without disclosing sensitive information in raw data. It enables legitimate data transmission and aggregation, facilitating large-scale data-driven model training. However, existing differential privacy-based approaches struggle to inject precisely calibrated noise in a trustworthy manner without revealing raw data to a third party, thus making them fail in achieving strong fairness and controllable privacy simultaneously, especially when facing malicious external adversaries or a corrupted data market. To address these issues, we present Xemis, a decentralized privacy-preserving data trading scheme, which builds upon a new multi-party computation (MPC)-based batched distributed noise sharing protocol, b-DNS. b-DNS facilitates the generation of threshold secret shares of Gaussian samples with low overhead and Byzantine robustness. Leveraging our designed game-theoretic mechanism and batched bits expansion mechanism, b-DNS achieves at least 12.7× faster and saves at least 43.6× bandwidth compared to ODO (EUROCRYPT'06) and CSU19 (CCS'19). Building atop b-DNS, Xemis further enables a decentralized, Byzantine robust data market to perturb the shares of blinded data under a controllable, precise noise level, without revealing the raw data or the perturbed data to the market. Additionally, Xemis utilizes a distributed demo dataset sampling-based mechanism and a Byzantine fault tolerance consensus-based method to enable fair value assessment and payment-data delivery. Consequently, Xemis achieves controllable privacy and strong fairness with Web3 compatibility under malicious market nodes, while achieving at least 3.3× faster than ZLM+24 (TIFS'24) with a 64-node market. The utility of noise-perturbed data is evaluated through image classification tasks on CIFAR-10, and when adding noise with privacy budget \privacyBudget=1 to 63% of the training data, the model maintains an accuracy of 83%.
Eclipse attacks isolate blockchain nodes by monopolizing their peer-to-peer connections. The attacks were extensively studied in Bitcoin (SP'15, SP'20, CCS'21, SP'23) and Monero (NDSS'25), but their practicality against Ethereum nodes remains underexplored, particularly in the post-Merge settings. We present the first end-to-end implementation of an eclipse attack targeting Ethereum (2.0 version) execution-layer nodes. Our attack exploits the bootstrapping and peer management logic of Ethereum to fully isolate a node upon restart. We introduce a multi-stage strategy that majorly includes (i) poisoning the node's discovery table via unsolicited messages, (ii) infiltrating Ethereum's DNS-based peerlist by identifying and manipulating the official DNS crawler, and (iii) hijacking idle incoming connection slots across the network to block benign connections. Our DNS list poisoning is the first in the cryptocurrency context and requires only 28 IP addresses over 100 days. Slots hijacking raises outgoing redirection success from 45% to 95%. We validate our approach through controlled experiments on Ethereum's Sepolia testnet and broad measurements on the mainnet. Our findings demonstrate that over 80% of public nodes do not leave sufficient idle capacity for effective slots occupation, highlighting the feasibility and severity of the threat. We further propose concrete countermeasures and responsibly disclosed all findings to Ethereum's security team.
The rapid growth of individual image generation on online platforms enables users to create personalized visual content on the Web, but also raises serious concerns about users' privacy and portrait rights. A malicious forgery attacker can exploit the technique to generate a forged individual image without the consent of the image owner. To counter this threat, researchers have developed privacy-protective perturbation techniques that degrade the quality and identity consistency of generated images to mitigate the risk of forgery attacks. Recent studies have employed red-teaming algorithms to attack these protective perturbations to highlight their vulnerabilities. In this work, we theoretically analyze why Blind Face Restoration (BFR) algorithms are suited for red-teaming privacy-protective perturbations. We also empirically demonstrate that BFR not only achieves stronger attack performance than existing red-teaming methods, but also exhibits greater robustness to PGD setting variations and significantly higher computational efficiency compared to purification-based approaches. We further propose a protective perturbation simulation scheme that leverages the trainability of BFR models to enhance attack performance under challenging PGD settings, thereby highlighting the advantage of the trainable BFR models over existing non-trainable red-teaming methods. We conduct adaptive tests in which the protector adjusts the perturbation to defend against BFR. Results show that BFR remains effective even under such defenses. These findings reveal BFR as a significant yet underexplored privacy threat to individual image generation services on the Web.
Learning from graph-structured data is fundamental to many Web applications, such as recommendation systems and social network analysis. While neural networks achieve state-of-the-art performance in these tasks, training them on sensitive graph data poses privacy risks. Node-level differential privacy (node-DP) provides strong protection for individual users represented as nodes; however, achieving node-DP is challenging due to the intricate dependencies among interconnected nodes. These dependencies, in turn, complicate node-level sensitivity analysis, which is a key step in differentially private learning. To bound the sensitivity, existing approaches typically (i) rely on black-box per-sample gradient clipping, which often overestimates sensitivity and introduces an excessive amount of DP noise; and (ii) prune edges from nodes with high degrees, which leads to erroneous privacy proofs. In this work, we introduce SaGD, a rigorous node-DP framework for graph learning. Our framework consists of two stages: (i) message propagation over the original graph, where we weight edges to control sensitivity without edge pruning, enabling tight, closed-form sensitivity bounds; and (ii) neural network training on the propagated messages using perturbed gradients with explicit mathematical derivations of sensitivity, without relying on gradient clipping. This sensitivity-aware design allows SaGD to add only the necessary amount of DP noise for rigorous privacy guarantees while achieving high computational efficiency. Extensive experiments show that SaGD achieves significantly higher model utility under the same privacy budgets and up to 10× training speedup.
The proliferation of face forgery content on the Web poses a severe threat to online trust, social media security, and the credibility of digital information. Existing detection approaches often fail to generalize across diverse forgery types and unseen scenarios commonly encountered in web-scale applications. Recent studies have utilized visual large language models (VLMs) to answer not only ''Is this face a forgery?'' but also ''Why is the face a forgery?'' These studies introduced forgery-related attributes, such as forgery location and type, to construct deepfake VQA datasets and train VLMs, achieving high accuracy while providing human-understandable explanatory text descriptions. However, these methods still have limitations. For example, they do not fully leverage face quality-related attributes, which are often abnormal in forged faces, and they lack effective training strategies for forgery-aware VLMs. In this paper, we extend the VQA dataset to create DD-VQA+, which features a richer set of attributes and a more diverse range of samples. Furthermore, we introduce a novel forgery detection framework, MGFFD-VLM, which integrates an Attribute-Driven Hybrid LoRA Strategy to enhance the capabilities of Visual Large Language Models (VLMs). Additionally, our framework incorporates Multi-Granularity Prompt Learning and a Forgery-Aware Training Strategy. By transforming classification and forgery segmentation results into prompts, our method not only improves forgery classification but also enhances interpretability. To further boost detection performance, we design multiple forgery-related auxiliary losses. Experimental results demonstrate that our approach surpasses existing methods in both text-based forgery judgment and analysis, achieving superior accuracy.
The advent of machine learning as a service (MLaaS) has necessitated secure multi-party computation (MPC)-based private inference (PI) to address the privacy concerns that arise when web servers offer query inference services to users. However, the formal privacy protection incurs substantial communication and latency overheads, particularly for large models such as vision transformers (ViTs). Existing methods either ignore the inherent attention dependencies or naively extend CNN optimizations to ViTs despite their structural discrepancies, resulting in sub-optimal performance. In this paper, we co-design the MPC and architectural properties of ViT and propose SecViT, an efficient and secure inference framework that automatically adapts ViTs into privacy-friendly counterparts with optimal attention configurations at different layers and tokens under MPC, balancing model capability and efficiency. SecViT features an MPC-efficient, layer-dependent and load-balancing attention representation adapter to facilitate feature reuse across multiple highly correlated layers without impacting accuracy. To further reduce the inference cost, SecViT also develops fine-grained composite attention and activation approximation algorithms to achieve superior accuracy-efficiency trade-offs. Experiments show that SecViT reduces communication by 6.0x and latency by 4.6x with iso-accuracy over MPCViT, and improves accuracy by 4.92% with 1.6x lower latency over PriViT on Tiny-ImageNet. Compared with state-of-the-art PI protocols, SecViT further achieves 10.0x communication saving and 7.9x latency reduction over BumbleBee.
Large Language Models (LLMs) have achieved remarkable progress in understanding and generation tasks, yet they remain highly susceptible to adversarial prompt attacks that bypass safety safeguards and induce the generation of harmful content. Existing pre-generation and post-generation defense methods typically rely on intent recognition, surface-level features, or external classifiers, rendering them vulnerable to evasion via subtle prompt perturbations while incurring substantial computational overhead. In this paper, we propose PADD (Prefix-based Attention Divergence Detector), a lightweight pre-generation defense mechanism that leverages internal model signals for robust attack detection. At its core, PADD prepends a lightweight safety prefix to the input prompt and compares attention distributions between the original and prefixed prompts. By transforming cross-prompt comparisons into self-comparisons via composite signals of attention divergence and attention plasticity, PADD achieves strong separability between adversarial and benign prompts with low-latency detection, without requiring modifications or fine-tuning of the base model. Extensive experiments across four mainstream open-source LLMs and multiple public benchmarks demonstrate that PADD significantly reduces attack success rates (0.4--3.0%) while maintaining low false rejection rates (0--5.2%). These results position PADD as a scalable, efficient, and practical safeguard for LLM safety.
Advanced Persistent Threats (APTs) represent sophisticated cyberattacks that evade detection through stealthy, multistage operations, posing severe risks to critical infrastructure and organizational security. Due to their ability to effectively capture contextual information of attack behaviors, provenance graphs have emerged as a promising approach for APT detection. However, traditional binary edges in provenance graphs fail to represent the collaborative nature of APT attacks, where multiple entities coordinate in single operations, and local graph structures cannot capture the long-range dependencies across attack stages. To address these challenges, we propose HyperDetector, a novel hypergraph-based method for APT detection. First, we introduce hypergraph representation for provenance data, where hyperedges naturally connect multiple entities involved in system events, preserving the higher-order relational structures that characterize APT behaviors. Second, we employ block self-attention mechanisms that enable global reasoning across distant hypergraph regions, effectively linking dispersed attack indicators throughout the system. Through the synergistic integration of these approaches, HyperDetector achieves comprehensive understanding of both localized multi-entity collaborative behaviors and system-wide attack propagation patterns. Extensive evaluations across multiple prominent datasets demonstrate that HyperDetector outperforms state-of-the-art methods, showcasing its effectiveness for robust and holistic APT detection. Additionally, we make our code and datasets publicly available to facilitate reproducibility and foster further research in this critical area.
While retrieval-augmented generation systems partially address the hallucination issues in large language models, it also introduces new vulnerabilities to knowledge corruption attacks. Adversaries exploit these vulnerabilities by poisoning documents provided by RAG system to manipulate LLM outputs. To counter this threat, we propose SecureCollaRAG, a Byzantine-tolerant collaborative RAG framework leveraging Multi-source Knowledge Validation Mechanism. Our approach enables agent system to securely verify document provenance through dynamic GNN-based credibility scoring, effectively preventing stealthy knowledge corruption attacks while preserving essential domain knowledge integrity. Through extensive evaluations and formal analysis, we demonstrate that SecureCollaRAG maintains robustness against attackers under non-IID data distributions. Content warning: This paper contains unfiltered content generated by LLMs that may contain malicious contents.
Large language models (LLMs) have been widely integrated into critical automated workflows, including contract review and job application processes. However, LLMs are susceptible to manipulation by fraudulent information, which can lead to harmful outcomes. Although advanced defense methods have been developed to address this issue, they often exhibit limitations in effectiveness, interpretability, and generalizability, particularly when applied to LLM-based applications. To address these challenges, we introduce FraudShield, a novel framework designed to protect LLMs from fraudulent content by leveraging a comprehensive analysis of fraud tactics. Specifically, FraudShield constructs and refines a fraud tactic–keyword knowledge graph to capture high-confidence associations between suspicious text and fraud techniques. The structured knowledge graph augments the original input by highlighting keywords and providing supporting evidence, guiding the LLM toward more secure responses. Extensive experiments show that FraudShield consistently outperforms state-of-the-art defenses across four mainstream LLMs and five representative fraud types, while also offering interpretable clues for the model's generations.
The InterPlanetary File System (IPFS) is the largest decentralized content-centric storage network. While its architecture enables resilient, distributed content delivery, it can be abused to host and disseminate malicious content. Public IPFS HTTP gateways further expand this threat surface, enabling attackers to deploy phishing websites and leverage gateway reputation to evade detection. This model can keep content available even after attackers go offline and challenges traditional phishing detection systems. We present a framework for monitoring and characterizing phishing on IPFS, leveraging a measurement platform that integrates multi-source data, including IPFS traffic and passive DNS. Over 11 months, we detect 10,489 phishing CIDs, grouped into 448 phishing clusters. 80% of detected CIDs originate from only 69 clustered campaigns indicating that targeting a small number of dominant clusters could yield high mitigation leverage. We also identify 588 gateways involved in dissemination, including 573 outside public gateway lists, and show that attackers can exploit caching across reputable gateways to amplify attacks and extend content availability. Finally, we find that traditional Web phishing countermeasures and IPFS blocklists provide insufficient protection. Our findings support practical mitigation and offer broader insights for trust and safety in decentralized web infrastructures.