The rapid growth of individual image generation on online platforms enables users to create personalized visual content on the Web, but also raises serious concerns about users' privacy and portrait rights. A malicious forgery attacker can exploit the technique to generate a forged individual image without the consent of the image owner. To counter this threat, researchers have developed privacy-protective perturbation techniques that degrade the quality and identity consistency of generated images to mitigate the risk of forgery attacks. Recent studies have employed red-teaming algorithms to attack these protective perturbations to highlight their vulnerabilities. In this work, we theoretically analyze why Blind Face Restoration (BFR) algorithms are suited for red-teaming privacy-protective perturbations. We also empirically demonstrate that BFR not only achieves stronger attack performance than existing red-teaming methods, but also exhibits greater robustness to PGD setting variations and significantly higher computational efficiency compared to purification-based approaches. We further propose a protective perturbation simulation scheme that leverages the trainability of BFR models to enhance attack performance under challenging PGD settings, thereby highlighting the advantage of the trainable BFR models over existing non-trainable red-teaming methods. We conduct adaptive tests in which the protector adjusts the perturbation to defend against BFR. Results show that BFR remains effective even under such defenses. These findings reveal BFR as a significant yet underexplored privacy threat to individual image generation services on the Web.
论文检索
输入标题、作者或关键词，从 3,069 篇学术成果中精准定位
Learning from graph-structured data is fundamental to many Web applications, such as recommendation systems and social network analysis. While neural networks achieve state-of-the-art performance in these tasks, training them on sensitive graph data poses privacy risks. Node-level differential privacy (node-DP) provides strong protection for individual users represented as nodes; however, achieving node-DP is challenging due to the intricate dependencies among interconnected nodes. These dependencies, in turn, complicate node-level sensitivity analysis, which is a key step in differentially private learning. To bound the sensitivity, existing approaches typically (i) rely on black-box per-sample gradient clipping, which often overestimates sensitivity and introduces an excessive amount of DP noise; and (ii) prune edges from nodes with high degrees, which leads to erroneous privacy proofs. In this work, we introduce SaGD, a rigorous node-DP framework for graph learning. Our framework consists of two stages: (i) message propagation over the original graph, where we weight edges to control sensitivity without edge pruning, enabling tight, closed-form sensitivity bounds; and (ii) neural network training on the propagated messages using perturbed gradients with explicit mathematical derivations of sensitivity, without relying on gradient clipping. This sensitivity-aware design allows SaGD to add only the necessary amount of DP noise for rigorous privacy guarantees while achieving high computational efficiency. Extensive experiments show that SaGD achieves significantly higher model utility under the same privacy budgets and up to 10× training speedup.
The advent of machine learning as a service (MLaaS) has necessitated secure multi-party computation (MPC)-based private inference (PI) to address the privacy concerns that arise when web servers offer query inference services to users. However, the formal privacy protection incurs substantial communication and latency overheads, particularly for large models such as vision transformers (ViTs). Existing methods either ignore the inherent attention dependencies or naively extend CNN optimizations to ViTs despite their structural discrepancies, resulting in sub-optimal performance. In this paper, we co-design the MPC and architectural properties of ViT and propose SecViT, an efficient and secure inference framework that automatically adapts ViTs into privacy-friendly counterparts with optimal attention configurations at different layers and tokens under MPC, balancing model capability and efficiency. SecViT features an MPC-efficient, layer-dependent and load-balancing attention representation adapter to facilitate feature reuse across multiple highly correlated layers without impacting accuracy. To further reduce the inference cost, SecViT also develops fine-grained composite attention and activation approximation algorithms to achieve superior accuracy-efficiency trade-offs. Experiments show that SecViT reduces communication by 6.0x and latency by 4.6x with iso-accuracy over MPCViT, and improves accuracy by 4.92% with 1.6x lower latency over PriViT on Tiny-ImageNet. Compared with state-of-the-art PI protocols, SecViT further achieves 10.0x communication saving and 7.9x latency reduction over BumbleBee.
Adapter-based Federated Large Language Models (FedLLMs) are widely adopted to reduce the computational, storage, and communication overhead of full-parameter fine-tuning for web-scale applications while preserving user privacy. By freezing the backbone and training only compact low-rank adapters, these methods appear to limit gradient leakage and thwart existing Gradient Inversion Attacks (GIAs). Contrary to this assumption, we show that low-rank adapters create new, exploitable leakage channels. We propose the Unordered-word-bag-based Text Reconstruction (UTR) attack, a novel GIA tailored to the unique structure of adapter-based FedLLMs. UTR overcomes three core challenges—low-dimensional gradients, frozen backbones, and combinatorially large reconstruction spaces—by: (i) inferring token presence from attention patterns in frozen layers, (ii) performing sentence-level inversion within the low-rank subspace of adapter gradients, and (iii) enforcing semantic coherence through constrained greedy decoding guided by language priors. Extensive experiments across diverse models (GPT2-Large, BERT, Qwen2.5-7B) and datasets (CoLA, SST-2, Rotten Tomatoes) demonstrate that UTR achieves near-perfect reconstruction accuracy (ROUGE-1/2 > 99), even with large batch sizes—settings where prior GIAs fail completely. Our results reveal a fundamental tension between parameter efficiency and privacy in FedLLMs, challenging the prevailing belief that lightweight adaptation inherently enhances security. Our code and data are available at https://github.com/shwksnshwowk-wq/GIA
Web tracking is increasingly pervasive, raising serious concerns about user privacy and security. Among existing techniques, pixel tracking is particularly stealthy and cost-effective, embedding invisible images that exfiltrate user activities to third-party servers. Current defenses, including filter list blocking and conventional machine learning, often fail to capture the cross-site associations that enable pixel tracking to evade detection. To address this limitation, we introduce TGNN, a framework that formulates pixel tracking detection as an edge classification task on a Tracking Directed Graph (TDG), which models third-party associations across websites. TGNN encodes HTTP traffic into structured quadruples and learns both semantic features and interaction patterns. To overcome the scarcity of reliable labels, we propose a large language model (LLM)-based annotation method that leverages minimal expert supervision to produce high-quality labels, significantly improving detection. Experiments conducted on traffic from the Alexa top-10K websites demonstrate that TGNN substantially outperforms existing baselines, while the LLM-based annotation achieves accuracy comparable to expert curation. Our large-scale measurement reveals that at least 16.74% of websites engage in pixel tracking via major third-party infrastructures, establishing cross-domain tracking as a pervasive practice in the wild and indicating a potential privacy threat in the modern Web ecosystem.
Federated knowledge graph embedding (FKGE) leverages distributed knowledge graphs (KGs) to collaboratively learn latent representations while preserving data privacy. However, this decentralized paradigm exposes vulnerabilities to client-side attacks, particularly untargeted poisoning attacks, which remain underexplored in FKGE and risk severe performance degradation. This paper presents the first systematic investigation of untargeted poisoning attacks on FKGE, unveiling their feasibility at both data and embedding levels. We design three novel poisoning attacks, among which the embedding-level attacks exhibit superior attack efficacy. To mitigate such threats, we further propose a learning-based defense mechanism that leverages embedding density for anomaly detection to identify malicious clients. Our theoretical results substantiate the effectiveness of both the attacks and the defense, and clarify why embedding-level poisoning is especially potent. Extensive experiments demonstrate that the proposed attacks induce significant performance deterioration, with core metrics dropping by up to 93%. Conversely, LDM effectively counters these attacks and restores performance to pre-attack levels or even surpasses them when mitigating embedding-level attacks.
Distributed Parameter-Efficient Fine-Tuning (PEFT) has emerged as a promising framework for personalizing Large Language Models (LLMs) by leveraging a collaboration between cloud servers and edge devices. However, this paradigm harbors a critical privacy vulnerability: the cloud can perform inversion attacks on the intermediate results (e.g., embeddings) sent from the edge to reconstruct the user's raw input prompt. Existing privacy-preserving techniques present a difficult trade-off: they are either too computationally expensive or they degrade model performance. To address this challenge, we introduce PrivSplit, a novel and lightweight protocol for prompt privacy in the Distributed PEFT framework. The core idea of PrivSplit is a ''Split and Compensate'' strategy: the edge device splits the input embedding into a public part sent to the cloud and a private part retained locally. The influence of this private part is then perfectly restored using a precise, lossless compensation mechanism during the interaction. We theoretically prove that PrivSplit is secure against both reconstruction and distinguishability attacks. Crucially, our method is perfectly lossless, ensuring that the model's performance is mathematically identical to the non-private baseline. This allows the security parameters to be arbitrarily strengthened without any impact on utility, breaking the conventional privacy-performance trade-off.
Secure manifold learning on datasets distributed among multiple data owners can benefit or even spawn many applications. For example, multiple service providers can jointly fit low-dimensional embeddings of their users' network behavior data to improve the accuracy of anomaly detection while addressing their privacy concerns about the datasets. In this paper, we focus on a classic manifold learning technique, known as isometric mapping (Isomap), and propose SIsomap, the first secure, distributed manifold learning system. We construct SIsomap based on secret sharing techniques and introduce careful optimizations. In particular, we propose two communication-efficient secure building blocks that focus on top-k and all-pairs shortest paths computation, respectively, and reduce secure operations by leveraging the characteristics of Isomap. Experimental results on both synthetic and real-world datasets demonstrate that our secure top-k and all-pairs shortest paths protocols are respectively up to 13.6× and 1818.5× faster than the state-of-the-art methods, and SIsomap as a whole is 11.1× to 28.8× faster than the baseline solution.
The deployment of self-hosted large language models (LLMs) has experienced unprecedented growth for enhanced data privacy and control. Yet, such deployment relies on diverse web services, whose vulnerabilities, although mentioned in a few studies, are largely underexplored, conflicting with the security tenet. From a systematic perspective, we propose LENS, a framework that explores and exploits vulnerabilities in self-hosted LLM services for comprehensive security evaluation. LENS integrates profiling and filtering, endpoint knowledge construction, and attack graph modeling for the automatic discovery, probing, and exploitation of public-facing LLM deployment targets, respectively. We conducted extensive empirical evaluation on real-world self-hosted LLM services across 16 mainstream platforms, 71,249 discovered deployment targets, and 307 API endpoints. Both quantitative and qualitative evidence reveal the prevalence of security vulnerabilities across different self-hosted LLM services. Notably, 75% of responsive targets allow web API interactions without authentication, rendering exploitation such as injection attacks (97% for Ollama), unauthenticated access (20.2% for AnythingLLM), and default credential abuse (60.6% for Dify). We have responsibly reported the findings to the relevant community and obtained 7 CVE IDs, including 4 critical vulnerabilities (CVSS > 9.0) and 2 high-severity ones.
Since the first online ad in 1994, advertising has grown into a vast ecosystem delivering billions of ads daily. Advertisements are everywhere on the Web: search engines promote results, most websites display ads, some require users to accept ads as a condition for access, video streaming services fund their infrastructure through an increasing volume of ads, and much of the gaming industry has adopted ad-based revenue models. In exchange for free access to a wide range of content, web users sacrifice their privacy and pay with personal data to enable targeted marketing, a trade-off widely studied in literature. We argue that the ad ecosystem imposes an additional, overlooked, cost on web users: energy consumption. In this paper, we present a large-scale analysis of the client-side energy consumption of ads, including their associated tracking mechanisms. We design a robust methodology aimed at realistically modeling user behavior and monitoring CPU activity. Through measurements of 724,994 website visits across diverse devices, we study the energy implications of consenting to tracking and of blocking ads through browser and network-based software. We find that consent via cookie banners increases energy consumption by a median 2.57% across all websites and devices. We also show that websites relying on real-time bidding increase median energy consumption by 33.98%. Finally, although ad-blocking solutions consume energy due to their filtering processes, we observe a median reduction of 9.62% in client-side energy consumption when using uBlock Origin.
Doxing refers to the disclosure of personal information without consent, has evolved from sporadic acts of online vigilantism into a structured and commodified practice. In Chinese cyberspace, this shift has produced Doxing-as-a-Service (DaaS), a commercial model in which personal data is retrieved, organized, and traded as on-demand products. This industrialization of privacy violation lowers the barriers to doxing and amplifies its social harms, posing new challenges for building a responsible and safe web. Yet little is known about how DaaS operates or sustains itself, motivating our systematic, data-driven examination of its ecosystem and practices. This paper provides the first systematic study of the Chinese DaaS ecosystem. Analyzing 25,972 messages and 13.22 million subscriber links from 100 major channels on Telegram, we demystify its organization, operations, and user engagement. We find that the DaaS ecosystem operates through a three-tier supply chain linking data providers, service operators, and end users. Operators sustain illicit businesses through six major service categories, persistent advertising, and crypto-based payments, while users interact via specialized group spaces that enable real-time matching, large-scale identity exposure, and community-driven fraud mitigation. Our findings reveal a mature, resilient underground data market operating within mainstream messaging platforms, highlighting new challenges for online privacy and exposing critical vulnerabilities in platform governance and content moderation. This study provides empirical evidence for developing effective regulatory frameworks and accountability mechanisms to mitigate commodified online harms on encrypted messaging services.
Federated graph-level clustering (FGC) provides an effective solution for analyzing decentralized graph data with privacy protection. Existing methods typically assume that all clients have the same number of clusters. This assumption simplifies the learning task and has achieved preliminary success. However, this assumption rarely holds in practice, as clients often exhibit substantial heterogeneity in both data distributions and semantic granularity. As a result, cluster-specific knowledge becomes misaligned during server-side aggregation, which ultimately degrades the overall clustering performance. To address this challenge, we propose a novel Federated Graph Clustering under Inter-Client Cluster Number Discrepancy (FedCND) framework, which aligns inter-client heterogeneous distributions by decoupling graph data into public and private patterns. Specifically, after initial local training and clustering on each client, we design a public learner and a private learner to model public and private graph data, respectively. Only anonymized, cluster-level public information is uploaded to the server, while private information remains local. On the server, cluster-level public prototypes are aggregated based on affinities between reconstructed cluster-level graphs, enabling privacy-preserving prototype alignment across clients with heterogeneous cluster numbers and mitigating interference from misaligned information during global aggregation. Finally, private subgraphs derive client-specific prototypes through local relearning, which are subsequently fused with globally oriented public prototypes for better clustering. Extensive experiments demonstrate that the proposed FedCND achieves an average of 4.9% accuracy improvement against current state-of-the-art methods.
Reinforcement learning-based recommendation systems (RLRS) are increasingly favored for their ability to leverage online interactive feedback, enabling adaptive and personalized decision-making. In this setting, user feedback serves as both a behavioral signal and an optimization target, making it essential for policy learning. However, collecting such feedback, e.g., clicks, ratings, and engagement traces, raises serious privacy concerns, posing critical challenges for value estimation, online adaptation, and privacy protection. In this paper, we propose FeedGuard, a critic-guided reinforcement learning framework with privacy-preserving feedback. FeedGuard enhances trajectory modeling via critic guidance, enables joint online fine-tuning with effective exploration–exploitation tradeoffs, and enforces end-to-end privacy protection across the feedback lifecycle via split federated learning and differential privacy. We further provide a formal analysis of its differential privacy guarantees. Extensive experiments on four public recommendation datasets and the VirtualTB platform show that FeedGuard performs well in both offline and online settings, while maintaining rigorous privacy guarantees with minimal degradation.
Graph rationalization methods aim to improve the explainability of Graph Neural Networks by identifying critical subgraphs (rationales) for task prediction. Motivated by increasing concerns over data privacy, federated graph rationalization has recently gained traction as a novel research area. However, in federated settings, data heterogeneity across clients exacerbates shortcut learning, where models rely on spurious and client-specific features rather than invariant causal rationales. Existing solutions, such as environment-aware data augmentation, suffer from low-quality environment representations. To address this, we propose DiffGR, a Diff erence-based sample selection strategy for federated Graph Rationalization. DiffGR selects samples where local and global models exhibit the highest prediction discrepancies, as these likely reflect strong shortcut reliance, enabling more accurate environment representations. Additionally, we introduce a mutual information (MI) inspired environment-conditioned data augmentation method that minimizes MI between environments and predictions while maximizing MI between rationales and predictions. Experiments on real-world and synthetic datasets demonstrate the effectiveness of DiffGR in improving rationale quality and model robustness in federated settings. Code is available at https://github.com/yuelinan/Codes-of-DiffGR.
We often treat data as an infinitely reusable resource: a single dataset can support many analyses, train multiple models, and be shared widely without apparent cost. This talk argues that in important ways, data is not endlessly reusable. Instead, in certain contexts, data behaves like a consumable resource that degrades with use. The clearest example arises in the presence of privacy concerns. Fundamental results show that any informative public analysis of personal data inevitably leaks some information about the underlying individuals, and that these privacy losses accumulate across repeated uses of the same or overlapping datasets [1]. If some level of privacy is to be preserved, this imposes intrinsic limits on how many times data can be used. In joint work under submission, we connect this perspective to the mosaic effect from legal scholarship, arguing that privacy risks arise not only from combining data pieces, but also from combining seemingly innocuous data uses [6]. This view suggests regulatory and technical approaches that treat data use itself as a rival good [4]. Data can also degrade with use even when privacy is not at stake. A line of work on adaptive data analysis shows that repeatedly querying the same dataset can lead to overfitting: results that appear valid on the dataset but fail to generalize to the underlying distribution, even when the dataset is very large [2, 3, 5]. In both privacy and generalization, each interaction with a dataset consumes part of a limited resource, constraining future computations. Recognizing data degradation opens a range of research directions, including systems for tracking and budgeting data use, algorithmic techniques to mitigate degradation, the role of synthetic data and data curators, and new models of non-worst-case adaptive computation. Together, these directions work towards a data ecosystem that explicitly accounts for data degradation.
The integration of Large Language Model (LLM)-based code assistants into IDEs has boosted developer productivity, but cloud‑based solutions pose severe privacy risks for enterprises handling proprietary code. Existing on‑premise alternatives lack semantic code retrieval, multi‑GPU optimization, and rigorous productivity validation. We present an enterprise‑oriented, customizable IDE plugin that uses internally hosted LLMs, combining client‑side tiered retrieval (Personal CodeRAG with SiamBERT/CodeSage) and vLLM‑optimized inference on dedicated hardware. No code leaves the organization. Our benchmark of four inference frameworks shows vLLM and LMDeploy achieve $\approx$20 ms time‑to‑first‑token on LLaMA‑3‑8B, suitable for real‑time interaction. In a three‑month study with 100 developers, the plugin reduced mean cycle time by 15.4\%, with perceived productivity gains of 50-70\% for tasks like code explanation and unit test generation. This work provides the first systematic evaluation of on‑premise LLM‑assisted coding that quantifies both objective and subjective productivity impacts.