论文检索
输入标题、作者或关键词，从 100,903 篇学术成果中精准定位
Federated Rank Learning (FRL) is a promising Federated Learning (FL) paradigm designed to be resilient against model poisoning attacks due to its discrete, ranking-based update mechanism. Unlike traditional FL methods that rely on model updates, FRL leverages discrete rankings as a communication parameter between clients and the server. This approach significantly reduces communication costs and limits an adversary's ability to scale or optimize malicious updates in the continuous space, thereby enhancing its robustness. This makes FRL particularly appealing for applications where system security and data privacy are crucial, such as web-based auction and bidding platforms. While FRL substantially reduces the attack surface, we demonstrate that it remains vulnerable to a new class of local model poisoning attack, i.e., fine-grained control attacks. We introduce the Edge Control Attack (ECA), the first fine-grained control attack tailored to ranking-based FL frameworks. Unlike conventional denial-of-service (DoS) attacks that cause conspicuous disruptions, ECA enables an adversary to precisely degrade a competitor's accuracy to any target level while maintaining a normal-looking convergence trajectory, thereby avoiding detection. ECA operates in two stages: (i) identifying and manipulating Ascending and Descending Edges to align the global model with the target model, and (ii) widening the selection boundary gap to stabilize the global model at the target accuracy. Extensive experiments across seven benchmark datasets and nine Byzantine-robust aggregation rules (AGRs) show that ECA achieves fine-grained accuracy control with an average error of only 0.224%, outperforming the baseline by up to 17×. Our findings highlight the need for stronger defenses against advanced poisoning attacks.
Website Fingerprinting (WF) attacks infer visited websites from encrypted traffic patterns, threatening the anonymity of Tor users. While deep learning has improved WF accuracy on synthetic datasets, its effectiveness on real Tor traffic remains unclear. We present RoFiRe, a novel WF model explicitly designed for real Tor exit traffic. It employs dynamic window-level augmentation and RMS-based pre-normalization tailored to irregular burst patterns and variable-length traces observed in the realistic GTT23 dataset, improving data efficiency and robustness. Across standard WF, concept-drift, and real-world open-world evaluations on GTT23, RoFiRe consistently outperforms state-of-the-art baselines by up to 9%. This study presents the first comprehensive analysis of WF on real Tor traffic, showing that WF models incorporating augmentation remain effective under realistic, data-limited conditions and can pose significant privacy risks.
Large Reasoning Models (LRMs) have rapidly gained prominence for their strong performance in solving complex tasks. Many modern black-box LRMs expose the intermediate reasoning traces through APIs to improve transparency (e.g., Gemini-2.5 and Claude-sonnet). Despite their benefits, we find that these traces can leak membership signals, creating a new privacy threat even without access to token logits used in prior attacks. In this work, we initiate the first systematic exploration of Membership Inference Attacks (MIAs) on black-box LRMs. Our preliminary analysis shows that LRMs produce confident, recall-like reasoning traces on familiar training member samples but more hesitant, inference-like reasoning traces on non-members. The representations of these traces are continuously distributed in the semantic latent space, spanning from familiar to unfamiliar samples. Building on this observation, we propose BlackSpectrum, the first membership inference attack framework targeting the black-box LRMs. The key idea is to construct a recall–inference axis in the semantic latent space, based on representations derived from the exposed traces. By locating where a query sample falls along this axis, the attacker can obtain a membership score and predict how likely it is to be a member of the training data. Additionally, to address the limitations of outdated datasets unsuited to modern LRMs, we provide two new datasets to support future research, arXivReasoning and BookReasoning. Empirically, exposing reasoning traces greatly increases the vulnerability of LRMs to MIAs, boosting attack accuracy by up to 23.8%, AUC by 29.9%, and nearly doubling TPR@5%FPR. Our findings highlight the need for LRM companies to balance transparency in intermediate reasoning traces with privacy preservation.
Centrality measures are fundamental tools for assessing the importance of nodes in a network, with widespread use in security analysis and the study of covert structures. Importantly, these are precisely the domains where participants may have strong incentives to mislead the analysis. In this work, we investigate Sybil attacks on centrality measures, where an adversary creates multiple identities and distributes connections among them to obscure their true importance. We show that computing an optimal hiding strategy is tractable for degree centrality but NP-complete for both closeness and betweenness centralities. Despite this hardness, we draw from the literature on community detection to design heuristic algorithms that perform well in practice. Experiments on real-world covert networks demonstrate that Sybil-based obfuscation can significantly outperform existing hiding strategies. Our results highlight the risks of relying uncritically on centrality-based methods in security-sensitive applications.
Selfish mining attack is a well-known attack in blockchains where Byzantine validators collude to gain more revenue than their fair share. Prior studies show that selfish mining attack can be risk-free in the longest-chain variants of Proof-of-Stake (PoS) protocols, i.e., Byzantine validators will never be caught and do not take any risk of losing their revenue. However, it is still unclear whether risk-free selfish mining is possible for PoS in the non-global predictability model [EC 2019], where in the global unpredictability model, validators can predict the roles of all validators in advance. In this work, we study the nominated PoS protocol by Polkadot, a cryptocurrency with a market cap of over 7 billion USD (top 20 blockchains). Polkadot's PoS protocol falls into a hybrid predictability model (i.e., non-global predictability model) that has never been well studied before. We present the first two risk-free (and meanwhile profitable) selfish mining attacks against Polkadot's PoS protocol. In our attack, a mining pool with 33% Byzantine validators can launch risk-free selfish mining and earn 7.09% extra block rewards in expectation. Our experimental results using Polkadot's implementation show that our risk-free attacks achieve similar profit as conventional selfish mining attack, such as the well-known selfish mining against Bitcoin.
Online platforms increasingly offer ''paid'' ad-free subscriptions as an alternative to the traditional ''free'' ad-based model. The transition to ad-free models ostensibly removes advertising as a key justification for data processing under the GDPR. So, normatively, platforms should collect less user data. However, platforms may justify continued data collection as a means to provide an improved, personalized experience. This tension between privacy principles and platform incentives raises a critical underexplored question: do data collection practices vary between ad-free and ad-based subscription models? In this paper, we shed light on this important privacy issue by investigating the alignment between platform data collection practices and related user expectations. With respect to data collection process, our analyses of data exports from three major online platforms — Instagram, Facebook, and X — reveal that these platforms continue to retain or collect some ad-related data, even in ad-free subscriptions. With respect to user expectations, our survey among 255 participants on Prolific reveals that 69% of the participants normatively expect data collection to be reduced, indicating their expectation of improved digital privacy in an ad-free model. However, when asked what they think actually happens, 63% of these participants believed that platforms would still collect about the same amount of data, highlighting skepticism about platform practices. Our findings not only indicate a significant disconnect between data practices and normative user expectations, but also raise serious questions about platform compliance with core GDPR principles, such as purpose limitation, data minimization, and transparency.
A vast amount of user-generated content is uploaded on social media everyday, potentially being collected as training data for large language models, and thus poses severe threats to individual privacy. Existing approaches for protecting user-generated content often fail to detect implicit privacy leaks which are not directly given but could be inferred from the contextual text (clues). The precise detection of leaks and clues is difficult but critical in text sanitization. We propose a graph-based model for the user-generated content and build a privacy leakage detector PrivSniffer which integrates the inference capability of language models with the precise graph search, to capture the contextual privacy leakage (CPL). To evaluate the effectiveness of the framework, we create SynthLeak, a dataset of dialogues containing human-labeled implicit leaks, while featuring diversity and naturalness. Our experimental results on SynthLeak and several other benchmarks reveal PrivSniffer's superior capability in detecting implicit leaks and CPLs. Particularly in CPL detection, the state-of-the-art approach achieves only an F1 Score of 0.36, whereas PrivSniffer attains 0.59 on SynthLeak, showing great promise in real-world text sanitization.
Graph-structured data is foundational to numerous web applications, and watermarking is crucial for protecting their intellectual property and ensuring data provenance. Existing watermarking methods primarily operate on graph structures or entangled graph representations, which compromise the transparency and robustness of watermarks due to the information coupling in representing graphs and uncontrollable discretization in transforming continuous numerical representations into graph structures. This motivates us to propose DRGW, the first graph watermarking framework that addresses these issues through disentangled representation learning. Specifically, we design an adversarially trained encoder that learns an invariant structural representation against diverse perturbations and derives a statistically independent watermark carrier, ensuring both robustness and transparency of watermarks. Meanwhile, we devise a graph-aware invertible neural network to provide a lossless channel for watermark embedding and extraction, guaranteeing high detectability and transparency of watermarks. Additionally, we develop a structure-aware editor that resolves the issue of latent modifications into discrete graph edits, ensuring robustness against structural perturbations. Experiments on diverse benchmark datasets demonstrate the superior effectiveness of DRGW.
Network protocols are the foundation of modern communication, yet their implementations often contain semantic vulnerabilities stemming from inadequate understanding of specification semantics. Existing gray-box and black-box testing approaches lack semantic modeling of protocols, making it difficult to precisely express testing intent and cover boundary conditions. Moreover, they typically rely on coarse-grained oracles such as crashes, which are inadequate for identifying deep semantic vulnerabilities. To address these limitations, we present a semantics-aware fuzzing framework, SemFuzz. The framework leverages large language models to extract structured semantic rules from RFC documents and generates test cases that intentionally violate these rules to encode specific testing intents. It then detects deep semantic vulnerabilities by comparing the observed responses with the expected ones. Evaluation on seven widely deployed protocol implementations shows that SemFuzz identified sixteen potential vulnerabilities, ten of which have been confirmed. Among the confirmed vulnerabilities, five were previously unknown and four have been assigned CVEs. These results demonstrate the effectiveness of SemFuzz in detecting semantic vulnerabilities.
Recent advances in generative AI have popularized synthetic content for training, offering a practical alternative to costly data curation while addressing privacy concerns. However, accumulating evidence shows that the indiscriminate reuse of synthetic data can induce model collapse—a degenerative process that contracts the learned distribution and erodes rare features. For instance, when models are iteratively trained on their own synthetic outputs, the upper tail of the perplexity distribution substantially compresses, with high-percentile values dropping by nearly half—a clear indicator of severe diversity loss. To counter this, we introduce DASGen, a Distribution-Aligned Synthetic Text Generation framework via tail-aware enhancement. Our method first identifies underrepresented regions via embedding-space mining, then steers a frozen, hosted LLM using semantically-structured prompts and a discriminative diversity objective to enrich tail features. This training-free approach enables direct deployment in existing data pipelines. Extensive evaluations on Yelp and ICLR'25 review benchmarks show that DASGen significantly outperforms competitive baselines, achieving tail coverage (98.54% on Yelp; 92.00% on ICLR'25) along with improved downstream accuracy. Overall, DASGen provides a practical path to synthesizing distribution-aligned text by explicitly enhancing tail regions, producing synthetic corpora with enhanced coverage and diversity for more reliable long-tailed applications.
Web Application Firewalls (WAFs) are widely deployed as a primary defense mechanism against injection-based web attacks by inspecting HTTP traffic for malicious patterns. However, structural inconsistencies in HTTP/2 stream parsing introduce a protocol-level attack surface that remains insufficiently examined. We propose the Stream Parser Confusion Attack (SPCA), a novel evasion technique that exploits discrepancies between WAFs and backend HTTP/2 servers in processing stream dependencies and priorities. SPCA operates without altering payload content, relying solely on RFC-compliant manipulation of stream priority weights and dependency trees to deliver unmodified malicious inputs past WAF inspection. To evaluate the feasibility and generality of SPCA, we design three well-defined stream topologies—skewed, k-ary, and unbalanced—each capturing unique structural traits observed in real-world HTTP/2 scheduling patterns. Each topology's dataset consists of 500 structurally distinct requests, derived by embedding 100 malicious test cases across five distinct priority levels. We transmit these requests against 13 commercial and open-source WAFs and 20 backend web frameworks in a black-box setting. Each topology individually achieves a bypass success rate of 49.66% for the skewed tree, 44.62% for the k-ary tree, and 46.38% for the unbalanced tree. Under the concurrent attack with three topologies, the overall success rate exceeds 89% on average against the open-source and commercial WAFs. These findings demonstrate that structure-only protocol-compliant manipulation is sufficient to systematically bypass modern WAFs, revealing critical blind spots in HTTP/2-aware traffic inspection. We responsibly disclosed the identified issues to all affected vendors and received acknowledgments of the disclosures.
Finality gadget is a critical component in modern blockchain systems. Ever since Ethereum used the Casper finality gadget, many variants of finality approaches have been adopted to make it possible to finalize blocks, i.e., when a block is finalized, its order will never be reversed. In this work, we study the finality approach by VeChainThor, the consensus protocol of VeChain blockchain. We propose greedy attack, an attack in which a block proposed by an honest sealer can be finalized with a probability of only 0.19%. We validate our results via theoretical analysis and extensive experimentation. Our findings have been disclosed and acknowledged by the VeChain team, and we are currently working with them to improve the VeChainThor protocol.
In the literature, prior research on Security-oriented Video Understanding (SVU) has predominantly focused on detecting and locating the threats (e.g., shootings, robberies) in videos, while largely lacking the effective capability to generate and evaluate the threat causes. Motivated by these gaps, this paper introduces a new chat paradigm SVU task, i.e., In-depth Security-oriented Video Understanding (DeepSVU), which aims to not only identify and locate the threats but also attribute and evaluate the causes of threatening segments in detail. Furthermore, this paper reveals two key challenges in the proposed task: 1) how to effectively model the coarse-to-fine physical-world information (e.g., human behavior, object interactions and background context) to boost the DeepSVU task, and 2) how to adaptively trade off these factors. Addressing these challenges is crucial for improving VAD, especially for identifying, locating, and attributing anomalies. To tackle these challenges, this paper proposes a new Unified Physical-world Regularized MoE (UPRM) approach. Specifically, UPRM incorporates two key components: the Unified Physical-world Enhanced MoE (UPE) Block and the Physical-world Trade-off Regularizer (PTR), to address the above two challenges, respectively. Extensive experiments conduct on our DeepSVU instructions datasets (i.e., UCF-C instructions and CUVA instructions) demonstrate that UPRM outperforms several advanced Video-LLMs as well as non-LLM approaches. such information.These justify the importance of the coarse-to-fine physical-world information in the DeepSVU task and demonstrate the effectiveness of our UPRM in capturing such information.
The widespread proliferation of online content has intensified concerns about clickbait, deceptive or exaggerated headlines designed to attract attention. While Large Language Models (LLMs) offer a promising avenue for addressing this issue, their effectiveness is often hindered by Sycophancy, a tendency to produce reasoning that matches users' beliefs over truthful ones, which deviates from instruction-following principles. Rather than treating sycophancy as a flaw to be eliminated, this work proposes a novel approach that initially harnesses this behavior to generate contrastive reasoning from opposing perspectives. Specifically, we design a Self-renewal Opposing-stance Reasoning Generation (SORG) framework that prompts LLMs to produce high-quality ''agree'' and ''disagree'' reasoning pairs for a given news title without requiring ground-truth labels. To utilize the generated reasoning, we develop a local Opposing Reasoning-based Clickbait Detection (ORCD) model that integrates three BERT encoders to represent the title and its associated reasoning. The model leverages contrastive learning, guided by soft labels derived from LLM-generated credibility scores, to enhance detection robustness. Experimental evaluations on three benchmark datasets demonstrate that our method consistently outperforms LLM prompting, fine-tuned smaller language models, and state-of-the-art clickbait detection baselines. Our code is available in https://github.com/126541/ORCD.
With the growing importance of content safety, toxic language detection, especially in Chinese online environments, has become a key task in natural language processing. However, real-world toxic expressions often appear in obfuscated forms such as pinyin abbreviations, symbol insertion, or visually similar substitutions, making them difficult to detect using traditional rule-based or static models. To address this challenge, we propose a dynamic knowledge graph construction method for toxic text variants, named Variant-KG. This graph encodes diverse structural relations between canonical toxic terms and their variants based on phonetic similarity, visual resemblance, and contextual co-occurrence. A small amount of labeled data is further used to fine-tune large language models (LLMs), enabling initial normalization and variant recognition. On top of this, we design a collaborative detection framework that combines the Variant-KG with frozen LLMs. It performs graph augmented prompting for structure-aware reasoning and adopts a Think-Search-Generate paradigm to dynamically recover broken paths when graph connections are incomplete, enabling both data self-enhancement and knowledge completion during inference. Evaluations on multiple Chinese toxic language datasets show that our model consistently outperforms both non-knowledge-enhanced and existing knowledge-enhanced baselines, demonstrating the effectiveness of our proposed dynamic reasoning framework in handling diverse toxic expressions.
With the ubiquitous deployment of web services, ensuring data confidentiality has become a challenging imperative. Fully Homomorphic Encryption (FHE) presents a powerful solution for processing encrypted data; however, its widespread adoption is severely constrained by two fundamental bottlenecks: substantial computational overhead and the absence of a built-in automatic error correction mechanism. These limitations render the deployment of FHE in real-world, complex network environments impractical. To address this dual challenge, this work puts forward a new FHE framework that enhances computational efficiency and integrates an automatic error correction capability through new encoding techniques and an algebraic reliability layer. Our system was validated across several web workloads, including encrypted inference on MNIST and CIFAR-10, federated aggregation with non-IID data, and streaming analytics on household power consumption data. Experimental results demonstrate significant performance improvements, particularly with large polynomial modulus degrees such as N=8192, while maintaining task accuracy within 0.5% of the plaintext baseline. Furthermore, our error correction mechanism reduces the service failure rate to below 0.5% even under harsh, bursty network fault conditions.
Today, mobile super apps such as WeChat offer a wide array of services through integrated miniapps. While the miniapps provide self-contained services via JavaScript and Web interfaces, the existence of a centralized authority, i.e., super app platform, enables strong protection against malware. Among the many mechanisms, the built-in report interface is an essential security countermeasure, allowing users to report any suspicious miniapp that is released to the market. Alarmingly, our study reveals that there are malicious miniapps implementing deceptive reporting interfaces to impersonate the official ones. If users are guided to these fake reporting interfaces that discard or rerouting the reports, the platforms will never be alarmed about the malware existence, thus enabling the malware to circumvent post-vetting regulation. In response to this imminent threat, this paper identifies, analyzes, and constructs a dataset consisting of 3,587 malware with detailed information among 135,274 official-alike reporting interfaces among over 4 million miniapps. Our findings further reveal abundant variations of behavior, including discarding or redirecting reports, applying obfuscation to escape vetting, and batch registration to lower the risk of platform removal. We have reported these malware to parties of interest, and we will release this dataset to facilitate further detection and analysis for the web community.