Network intrusion detection systems (NIDS) are essential for web security by identifying and dropping malicious traffic. Existing in-network NIDS leverage the Tbps-level packet processing capability of programmable switches to achieve high-speed flow classification. They translate complex trained machine learning models to decision trees (DTs), where DTs are deployed on programmable switches via single-DT or multiple-DT deployment. However, they face a fundamental trade-off: single-DT deployment suffers from low classification accuracy due to over-pruning of trees, while multiple-DT deployment suffers from high overhead due to deploying multiple tree replicas. In this paper, we propose Proteus, an in-network malicious traffic detection system that achieves both high classification accuracy and low overhead. Its key idea is to split the original DT into critical and normal sub-trees, where these sub-trees have different impacts on overall accuracy. More precisely, Proteus first splits a DT into one critical and several normal sub-trees for adapting to the accuracy requirement and switch resource budgets. Second, it minimizes coordination overhead between sub-trees while ensuring full flow coverage via mixed-integer linear programming. Third, it dynamically reallocates or migrates sub-trees to adapt to changing resources by monitoring both classification accuracy and switch resource changes. Testbed experiments with 12.8 Tbps programmable switches show that Proteus improves classification accuracy, reduces switch resource consumption, and reduces classification latency.
论文检索
输入标题、作者或关键词，从 7,876 篇学术成果中精准定位
In-context learning (ICL) has become a powerful, data-efficient paradigm for text classification using large language models. However, its robustness against realistic adversarial threats remains largely unexplored. We introduce ICL-Evader, a novel black-box evasion attack framework that operates under a highly practical zero-query threat model, requiring no access to model parameters, gradients, or query-based feedback during attack generation. We design three novel attacks—Fake Claim, Template, and Needle-in-a-Haystack—that exploit inherent limitations of LLMs in processing in-context prompts. Evaluated across sentiment analysis, toxicity, and illicit promotion tasks, our attacks significantly degrade classifier performance (e.g., achieving up to 95.3% attack success rate), drastically outperforming traditional NLP attacks which prove ineffective under the same constraints. To counter these vulnerabilities, we systematically investigate defense strategies and identify a joint defense recipe that effectively mitigates all attacks with minimal utility loss (<5% accuracy degradation). Finally, we translate our defensive insights into an automated tool that proactively fortifies standard ICL prompts against adversarial evasion. This work provides a comprehensive security assessment of ICL, revealing critical vulnerabilities and offering practical solutions for building more robust systems. Our source code and evaluation datasets are publicly available at: https://github.com/ChaseSecurity/ICL-Evader ICL-Evader Repository.
Privacy-preserving data trading allows data owners to sell data to consumers through a data trading web platform, the data market, without disclosing sensitive information in raw data. It enables legitimate data transmission and aggregation, facilitating large-scale data-driven model training. However, existing differential privacy-based approaches struggle to inject precisely calibrated noise in a trustworthy manner without revealing raw data to a third party, thus making them fail in achieving strong fairness and controllable privacy simultaneously, especially when facing malicious external adversaries or a corrupted data market. To address these issues, we present Xemis, a decentralized privacy-preserving data trading scheme, which builds upon a new multi-party computation (MPC)-based batched distributed noise sharing protocol, b-DNS. b-DNS facilitates the generation of threshold secret shares of Gaussian samples with low overhead and Byzantine robustness. Leveraging our designed game-theoretic mechanism and batched bits expansion mechanism, b-DNS achieves at least 12.7× faster and saves at least 43.6× bandwidth compared to ODO (EUROCRYPT'06) and CSU19 (CCS'19). Building atop b-DNS, Xemis further enables a decentralized, Byzantine robust data market to perturb the shares of blinded data under a controllable, precise noise level, without revealing the raw data or the perturbed data to the market. Additionally, Xemis utilizes a distributed demo dataset sampling-based mechanism and a Byzantine fault tolerance consensus-based method to enable fair value assessment and payment-data delivery. Consequently, Xemis achieves controllable privacy and strong fairness with Web3 compatibility under malicious market nodes, while achieving at least 3.3× faster than ZLM+24 (TIFS'24) with a 64-node market. The utility of noise-perturbed data is evaluated through image classification tasks on CIFAR-10, and when adding noise with privacy budget \privacyBudget=1 to 63% of the training data, the model maintains an accuracy of 83%.
The proliferation of face forgery content on the Web poses a severe threat to online trust, social media security, and the credibility of digital information. Existing detection approaches often fail to generalize across diverse forgery types and unseen scenarios commonly encountered in web-scale applications. Recent studies have utilized visual large language models (VLMs) to answer not only ''Is this face a forgery?'' but also ''Why is the face a forgery?'' These studies introduced forgery-related attributes, such as forgery location and type, to construct deepfake VQA datasets and train VLMs, achieving high accuracy while providing human-understandable explanatory text descriptions. However, these methods still have limitations. For example, they do not fully leverage face quality-related attributes, which are often abnormal in forged faces, and they lack effective training strategies for forgery-aware VLMs. In this paper, we extend the VQA dataset to create DD-VQA+, which features a richer set of attributes and a more diverse range of samples. Furthermore, we introduce a novel forgery detection framework, MGFFD-VLM, which integrates an Attribute-Driven Hybrid LoRA Strategy to enhance the capabilities of Visual Large Language Models (VLMs). Additionally, our framework incorporates Multi-Granularity Prompt Learning and a Forgery-Aware Training Strategy. By transforming classification and forgery segmentation results into prompts, our method not only improves forgery classification but also enhances interpretability. To further boost detection performance, we design multiple forgery-related auxiliary losses. Experimental results demonstrate that our approach surpasses existing methods in both text-based forgery judgment and analysis, achieving superior accuracy.
Web tracking is increasingly pervasive, raising serious concerns about user privacy and security. Among existing techniques, pixel tracking is particularly stealthy and cost-effective, embedding invisible images that exfiltrate user activities to third-party servers. Current defenses, including filter list blocking and conventional machine learning, often fail to capture the cross-site associations that enable pixel tracking to evade detection. To address this limitation, we introduce TGNN, a framework that formulates pixel tracking detection as an edge classification task on a Tracking Directed Graph (TDG), which models third-party associations across websites. TGNN encodes HTTP traffic into structured quadruples and learns both semantic features and interaction patterns. To overcome the scarcity of reliable labels, we propose a large language model (LLM)-based annotation method that leverages minimal expert supervision to produce high-quality labels, significantly improving detection. Experiments conducted on traffic from the Alexa top-10K websites demonstrate that TGNN substantially outperforms existing baselines, while the LLM-based annotation achieves accuracy comparable to expert curation. Our large-scale measurement reveals that at least 16.74% of websites engage in pixel tracking via major third-party infrastructures, establishing cross-domain tracking as a pervasive practice in the wild and indicating a potential privacy threat in the modern Web ecosystem.
Pre-trained Graph Neural Networks (GNNs) have demonstrated remarkable performance in graph mining tasks, yet they often amplify societal biases against protected demographic groups. Existing fairness-aware approaches primarily address discrimination based on a single sensitive attribute (e.g., gender or race), overlooking real-world scenarios where individuals possess multiple overlapping demographic characteristics, leading to unfair treatment of underrepresented subgroups. Moreover, incorporating extra fairness constraints into pre-trained GNNs usually requires full model retraining, which is computationally expensive and often impractical. To address these limitations, we propose a novel Multi-attribute Fairness-aware Prompt Tuning framework named MultiFPT. Our approach operates in two key stages: in the graph prompt learning stage, MultiFPT injects fairness-aware structural and feature prompts into pre-trained GNN inputs; in the adapter tuning stage, a lightweight adapter regularized by the Hilbert–Schmidt Independence Criterion (HSIC) enforces statistical independence between node representations and multiple sensitive attributes. Experiments on real-world datasets demonstrate that MultiFPT significantly improves multi-attribute fairness, reducing bias by approximately 30% on average in node classification while maintaining competitive predictive performance compared to state-of-the-art baselines.
Misinformation and fake news have become a pressing societal challenge, driving the need for reliable automated detection methods. Prior research has highlighted sentiment as an important signal in fake news detection, either by analyzing which sentiments are associated with fake news or by using sentiment and emotion features for classification. However, this poses a vulnerability since adversaries can manipulate sentiment to evade detectors especially with the advent of large language models (LLMs). A few studies have explored adversarial samples generated by LLMs, but they mainly focus on stylistic features such as writing style of news publishers. Thus, the crucial vulnerability of sentiment manipulation remains largely unexplored. In this paper, we investigate the robustness of state-of-the-art fake news detectors under sentiment manipulation. We introduce AdSent, a sentiment-robust detection framework designed to ensure consistent veracity predictions across both original and sentiment-altered news articles. Specifically, we (1) propose controlled sentiment-based adversarial attacks using LLMs, (2) analyze the impact of sentiment shifts on detection performance. We show that sentiment change heavily impacts the performance of detection models, indicating biases towards neutral articles being real, while non-neutral articles are often classified as fake. (3) We introduce a novel sentiment-agnostic training strategy that enhances robustness against such perturbations. Extensive experiments on three benchmark datasets demonstrate that AdSent significantly outperforms competitive baselines in both accuracy and robustness, while also generalizing effectively to unseen datasets and adversarial scenarios.
Visual data from the Web power image classifiers, which underpin web services, including recommendation and moderation. However, Web data contain spurious correlations and social biases, and neural networks tend to learn biases in data. This can reinforce unfairness in web services and the web data, leading to a vicious cycle. In image classification, networks learn bias attributes for a specific class when most images contain the same attribute for a given class. Hence, training a fair and debiased classifier from a biased dataset demands handling imbalance between a majority of images with bias attributes (bias-aligned samples) and a minority without (bias-conflict samples). In this work, we introduce BiasEdit, a modular framework that automatically detects bias attributes from the original dataset and edits them to construct a debiased dataset. Specifically, BiasEdit first detects unknown bias attributes via statistical dependence and mutual information analysis of visual–linguistic representations, and then explicitly edits those attributes using text-guided image editing to generate realistic bias-conflict samples. Unlike prior works that assume known bias attributes or rely on synthetic mixing, our method operates without manual annotations and leverages off-the-shelf vision–language and editing models. BiasEdit addresses a fundamental challenge in Web-sourced visual AI, mitigating dataset-induced bias and achieving state-of-the-art debiasing performance even when training data are fully biased.
Single-expert fake news detectors, such as Graph Neural Networks (GNNs) and Large Language Models (LLMs), increasingly struggle to counter the diversifying camouflage tactics of modern adversaries, which range from semantic (e.g., mimicking writing styles) to structural (e.g., manipulating propagation paths). To address this, existing methods attempt to build a hybrid model by sequentially incorporating GNNs and LLMs; however, such hybridization blurs the distinction between experts and prevents critical cross-validation. In addition, existing methods rely heavily on vast labeled data, which is costly to acquire, particularly for fake news samples. In this paper, we propose a Semi-supervised Mixture of Experts framework for Fake news detection, namely S2MOE-F. The core idea of S2MOE-F is to establish a robust defense against multifaceted camouflage by cross-validating the complementary judgments of two independent experts, GNN and LLM. On the one hand, S2MOE-F drives experts' judgments by using a One-Class Classification (OCC) objective, which constrains true news within a compact hypersphere and identifies samples outside this boundary as fake, reducing reliance on scarce fake news labels. On the other hand, S2MOE-F generates high-confidence pseudo-labels based on consensus or divergence between experts to exploit abundant unlabeled data. In addition, we propose a novel reinforcement learning (RL)-based routing policy that dynamically determines the dominant expert for input samples without explicit supervision. Finally, we design a disentangled masked Transformer to ensure experts' specialization by reducing inter-expert redundancy. Extensive experiments on real-world datasets sourced from Web platforms and social media demonstrate the superior performance of S2MOE-F.
Oscillatory Graph Neural Networks (OGNNs) are an emerging class of physics-inspired architectures designed to mitigate oversmoothing and vanishing gradient problems in deep GNNs. In this work, we introduce the Complex-Valued Stuart-Landau Graph Neural Network (SLGNN), a novel architecture grounded in Stuart-Landau oscillator dynamics. Stuart-Landau oscillators are canonical models of limit-cycle behavior near Hopf bifurcations, which are fundamental to synchronization theory and are widely used in e.g.\ neuroscience for mesoscopic brain modeling. Unlike harmonic oscillators and phase-only Kuramoto models, Stuart-Landau oscillators retain both amplitude and phase dynamics, enabling rich phenomena such as amplitude regulation and multistable synchronization. The proposed SLGNN generalizes existing phase-centric Kuramoto-based OGNNs by allowing node feature amplitudes to evolve dynamically according to Stuart-Landau dynamics, with explicit tunable hyperparameters (such as the Hopf-parameter and the coupling strength) providing additional control over the interplay between feature amplitudes and network structure. We conduct extensive experiments across node classification, graph classification, and graph regression tasks, demonstrating that SLGNN outperforms existing OGNNs and establishes a novel, expressive, and theoretically grounded framework for deep oscillatory architectures on graphs. The code and hyperparameters for SLGNN are available at https://github.com/kevvzhang/StuartLandauGNN
Graph-level classification involves analyzing the property of the whole graph, which is typically solved by using graph neural networks (GNNs). Existing efforts generally assume a balanced class distribution. However, real-world data often exhibit long-tailed distributions, i.e., tail classes have significantly fewer samples than head classes, and thus directly applying GNNs is eventually biased toward the head classes, resulting in limited generalization over the tail classes. Moreover, the predictions of existing algorithms are usually not trustworthy, and the trained classifiers remain ignorant to their predictive confidence. Towards this end, in this paper we develop a principled framework called GraphEVER for long-tailed graph-level classification. Technically, GraphEVER incorporates the beliefs of multiple experts and leverages the idea of subjective logic within the Dempster-Shafer Evidence Theory (DST). It can provide the evidence and uncertainty estimation for each expert, where the evidence is parameterized by a Dirichlet distribution to model class probability distribution, and the uncertainty is quantified via a well-defined theoretical framework. In this way, diverse experts can be integrated under DST to endow the classifier with both reliability and robustness. Moreover, we propose an evidence-based routing mechanism to dynamically assign experts, such that the tail classes can receive more attention, while the head classes can reduce redundant engaged experts, further cutting down the computational cost and improving the efficiency. Extensive experiments on seven datasets verify the superiority of our proposed framework.
Many real-world datasets, such as citation networks, social networks, and molecular structures, are naturally represented as heterogeneous graphs, where nodes belong to different types and have additional features. For example, in a citation network, nodes representing ''Paper'' or ''Author'' may include attributes like keywords or affiliations. A critical machine learning task on these graphs is node classification, which is useful for applications such as fake news detection, corporate risk assessment, and molecular property prediction. Although Heterogeneous Graph Neural Networks (HGNNs) perform well in these contexts, their predictions remain opaque. Existing post-hoc explanation methods lack support for actual node features beyond one-hot encoding of node type and often fail to generate realistic, faithful explanations. To address these gaps, we propose DiGNNExplainer, a model-level explanation approach that synthesizes heterogeneous graphs with realistic node features via discrete denoising diffusion. In particular, we generate realistic discrete features (e.g., bag-of-words features) using diffusion models within a discrete space, whereas previous approaches are limited to continuous spaces. We evaluate our approach on multiple datasets and show that DiGNNExplainer produces explanations that are realistic and faithful to the model's decision-making, outperforming state-of-the-art methods.
Contrastive learning has strong generalization ability and the capability to learn automatically without labeled information. However, it still faces challenges such as insufficient feature diversity, a lack of multi-level semantics, and the balance between tolerance and consistency. To address these challenges, This study propose a Multi-view Hierarchical Graph Contrastive Learning method. First, a new view is generated through a diffusion matrix to provide multi-view data for contrastive learning. Then, these multi-view data are fed into an asynchronous asymmetric network structure, specifically using graph network models to learn diversified features. Next, we adopt a self-designed hierarchical contrastive learning framework, constructing a three-level contrastive loss for joint optimization of nodes, subgraphs, and global graphs. Meanwhile, we introduce alignment and consistency and appropriately adjust the loss function through a temperature coefficient. Ultimately, the model achieves excellent classification performance on multiple datasets through node classification and graph classification tasks.
Heterophily in graphs is a key challenge for Graph Neural Networks (GNNs). By proposing various homophily measures, recent work has provided insights into how heterophily affects node classification. However, while both graph homophily and heterophily can be further refined into diverse connection patterns, previous work has largely overlooked the role of connection pattern inconsistency. In this paper, we delve deeper into heterophily and homophily by shifting from coarse-grained heterophily ratios to a unified, fine-grained formulation based on connection patterns, and we further reveal an uneven distribution and a train–test gap of these patterns. Empirical studies indicate that this inconsistency leads to severe performance disparity. To address this issue, we propose a novel two-stage method named IVQ-GNN. In the pre-training phase, IVQ-GNN encodes diverse connection patterns into a codebook that serves as an orthogonal basis for the representation space. In the fine-tuning phase, a self-attention module linearly combines these orthogonal bases to expand the learned token space of connection patterns, thereby improving adaptation to rare and out-of-distribution (OOD) patterns. Experimental results on multiple datasets demonstrate that IVQ-GNN significantly improves model performance and validate that the proposed method effectively addresses the connection pattern inconsistency. Our code is available at https://github.com/Duyx5149/IVQ-GNN.
Graph Transformer has demonstrated impressive capabilities in the field of graph representation learning. However, existing approaches face two critical challenges: (1) most models suffer from exponentially increasing computational complexity, making it difficult to scale to large graphs; (2) attention mechanisms based on node-level operations limit the flexibility of the model and result in poor generalization performance in out-of-distribution (OOD) scenarios. To address these issues, we propose VecFormer (the Vec tor Quantized Graph Transformer ), an efficient and highly generalizable model for node classification, particularly under OOD settings. VecFormer adopts a two-stage training paradigm. In the first stage, two codebooks are used to reconstruct the node features and the graph structure, aiming to learn the rich semantic Graph Codes. In the second stage, attention mechanisms are performed at the Graph Token level based on the transformed cross codebook, reducing computational complexity while enhancing the model's generalization capability. Extensive experiments on datasets of various sizes demonstrate that VecFormer outperforms the existing Graph Transformer in both performance and speed.
Semi-supervised graph anomaly detection confronts the fundamental challenge of identifying anomalous nodes that exhibit deviations from normal graph patterns in node attributes or structure connectivity, using a small set of labeled normal nodes. Existing methods fall short in modeling the spectrum of anomaly severity, as they generate anomalies in a single, undifferentiated step. This oversight restricts the detection of complex anomalies. In this paper, we propose a progressive anomaly generation network (PAGE) to overcome this limitation. PAGE enhances complex anomaly detection through progressive attribute-structure perturbation: It first injects attribute noise into selected normal nodes to generate pseudo-anomalous nodes. Then it applies progressive structure perturbation to create hybrid anomalies that simulate the evolution from mild to complex perturbations. Importantly, the proposed anomaly progressive constraint loss enforces that hybrid anomalies exhibit a higher degree of abnormality than primary anomalies, enhancing the model's anomaly quantification capability. PAGE further integrates deviation constraint loss and classification loss to optimize node representations and improve prediction. Extensive experiments on benchmark datasets demonstrate that PAGE significantly outperforms state-of-the-art methods, demonstrating its effectiveness for graph anomaly detection.
In the absence of node attributes, Graph Neural Networks (GNNs) often fail to distinguish locally isomorphic nodes, leading to suboptimal performance. To compensate for this, Positional Information (PI) augmentation has emerged as a powerful technique, which generates attributes by selecting representative nodes as anchors and encoding node-to-anchor distances to other nodes. However, the performance of PI-based methods hinges on two graph-dependent choices: 1) the structural measures used for anchor selection and distance metrics, and 2) the anchor-count K. To obviate manual selections, we propose SCOUT, a model-agnostic augmentation framework that learns a graph-level selector to identify the optimal structural measure and adaptively determines the anchor-count K tailored to each graph and task. Subsequently, leveraging the heavy-tailed distribution typically observed in node centrality, SCOUT utilizes an elbow detection method on the ranked centrality curve to adaptively determine the K most representative nodes as anchors. SCOUT is model-agnostic and enhances various GNNs across downstream tasks. It achieves an improvement of 26.88% in Hits@20 for link prediction on ogbl-ddi and 4.52% accuracy points for node classification on ogbn-arxiv without original attributes; with original attributes, it also brings additional gains of 6.15% AUC on Cora and 11.69% accuracy points on ogbn-arxiv. The source code of SCOUT is available at https://github.com/seinkim01/SCOUT.git.
How can we accurately classify graphs using only positive and unlabeled instances? This setting commonly arises in real-world tasks. For example, in drug side effect prediction, each drug is represented as a graph based on its chemical structure, and only those observed to cause adverse effects are labeled as positive. The remaining drugs are left unlabeled—not because they are confirmed safe, but because such side effects have not yet been discovered or reported. A challenge is that positive and negative graphs often share similar substructures, making it difficult for models to capture the subtle structural differences that distinguish true positives among unlabeled ones. This difficulty is further exacerbated by the absence of explicit negative labels, which leaves the model without clear guidance on how to separate informative from non-informative patterns. We propose Delta-PU, an accurate method for PU graph classification. Delta-PU performs dual reweighting: hop-level reweighting to emphasize informative substructures during pooling, and graph-level reweighting to suppress ambiguous unlabeled graphs. This dual mechanism allows the model to progressively focus on discriminative patterns while reducing the uncertainty introduced by unlabeled instances. Extensive experiments demonstrate that Delta-PU achieves the state-of-the-art performance in PU graph classification.
Linear attention mechanisms have emerged as efficient alternatives to full self-attention in Graph Transformers, offering linear time complexity. However, existing linear attention models often suffer from a significant drop in expressiveness due to low-rank projection structures and overly uniform attention distributions. We theoretically prove that these properties reduce the class separability of node representations, limiting the model's classification ability. To address this, we propose a novel hybrid framework that enhances both the rank and focus of attention. Specifically, we enhance linear attention by attaching a gated local graph network branch to the value matrix, thereby increasing the rank of the resulting attention map. Furthermore, to alleviate the excessive smoothing effect inherent in linear attention, we introduce a learnable log-power function into the attention scores to reduce entropy and sharpen focus. We theoretically show that this function decreases entropy in the attention distribution, enhancing the separability of learned embeddings. Extensive experiments on both homophilic and heterophilic graph benchmarks demonstrate that our method achieves competitive performance while preserving the scalability of linear attention.
Open-set node classification (OSNC) allows unlabeled test data to contain novel classes previously unseen in the labeled data. The goal is to classify in-distribution (ID) nodes into corresponding known classes and reject out-of-distribution (OOD) nodes as unknown class. Despite recent notable progress in OSNC, two challenges remain less explored, i.e., how to enhance generalization to OOD nodes, and promote intra-class compactness and inter-class separability. To tackle such challenges, we propose a novel Negative Mixup with Cross-Layer Graph Contrastive Learning (negMIX) model. Firstly, we devise a novel negative Mixup method purposefully crafted for the open-set scenario with theoretical justification, to enhance the model's generalization to OOD nodes and yield clearer ID/OOD boundary. Additionally, a unique cross-layer graph contrastive learning module is developed to maximize the prototypical mutual information between the same class nodes across different topological distance neighborhoods, thereby facilitating intra-class compactness and inter-class separability. Extensive experiments validate significant outperformance of the proposed negMIX over state-of-the-art methods in various scenarios and settings.