Accurate detection of third-party libraries (TPLs) is essential for securing millions of Android applications, enabling vulnerability tracking, malware detection, and supply chain security auditing. However, existing TPL detection benchmarks have limited scale and outdated coverage, which hinders a rigorous and fair evaluation of the tool’s effectiveness in real-world scenarios. To bridge this gap, we present TPL-Benchmark, a comprehensive benchmark comprising over 6,000 real-world applications with precise, version-level annotations for both remote and local dependencies. More specifically, we develop TPL-Extractor, an efficient and accurate automated framework for version-level dependency annotation, aiming to address the high labor cost and limited precision of prior ground-truth construction methods. Equipped with this benchmark, we reproduce and evaluate twelve state-of-the-art TPL detection tools, revealing optimization directions in adaptability to R8-era transitions, version resolution accuracy, candidate&–library correspondence granularity, similarity threshold robustness, and efficiency/scalability on large app or library sets. Beyond benchmarking, we further analyze how TPL characteristics influence downstream security tasks, including vulnerability detection, malware analysis, secret leakage assessment, and LLM-based evaluation. Collectively, our study advances the understanding of TPL detection and establishes a foundation for more robust, adaptive, and scalable security analyses in the Android ecosystem.
Deep Reinforcement Learning (DRL) has demonstrated remarkable capabilities in domains such as robotics, finance, and autonomous systems. With the increasing cost of training, DRL models are increasingly shared and reused via model marketplaces, cloud platforms, and open-source repositories. This trend exposes DRL systems to action-level backdoor attacks, where adversaries inject malicious behaviors into models during the training phase and later manipulate their action outputs at deployment, potentially endangering safety-critical applications (e.g., causing vehicle collisions or drone crashes). Despite demonstrating feasibility, such attacks typically rely on handcrafted, task-specific backdoor rewards, which severely limit their generality and practicality, thereby causing practitioners to underestimate the true threat they pose. In this paper, we propose ADAPDOOR, the first general attack framework for adaptive backdoor reward exploration. ADAPDOOR coarsely initializes the backdoor reward from benign reward statistics and iteratively fine-tunes it based on the performance feedback from both benign and backdoor tasks. This enables stable action-level backdoor injection across diverse tasks without relying on extensive trial-and-error and expert knowledge. We conduct comprehensive experiments across 3 DRL algorithms, 11 environments, and 53 backdoor tasks, showing that ADAPDOOR outperforms existing baselines by 42.0% to 144.2%, under varying agent counts, action spaces, and reward signal types. Our findings reveal that action-level backdoors pose a more severe and realistic threat to DRL systems than previously recognized. Furthermore, we evaluate three potential defenses to explore pathways for mitigating this threat. The source code and task configurations of our evaluation are publicly available to ensure reproducibility and facilitate further research.
Intrusion detection systems (IDS) are crucial for protecting the security of network devices. In a dynamic network environment, network attack behavior is constantly changing. IDS developed using closed datasets has limited detection capabilities and cannot effectively respond to potential unknown attacks. Existing methods exhibit poor generalization to unknown attacks and have rigid decision boundaries that struggle to adapt to evolving network attacks. To address this challenge, we propose a known/unknown attack detection method based on inter-class relationships with the collaboration of virtual class and soft labels, which includes: 1) feature space optimization, 2) quantification of uncertainty for unknown attack detection. Firstly, to construct clear decision boundaries in high-dimensional space and reserve representation space for unknown attacks, we design to adaptively insert a virtual class in the neighborhood of known attack categories, reducing the intra-class distance of known attacks and expanding the inter-class intervals. Secondly, we learn soft-label prototypes from known samples to characterize the similarity and difference relationships among known attack categories. We quantify classification uncertainty by computing the Kullback-Leibler divergence between these prototypes and the predicted outputs, after which a Gaussian Mixture Model is applied to model the divergence distribution and adaptively identify unknown attacks. Extensive experimental results on CICIDS2017, NSL-KDD, and CICIoV 2024 demonstrate that the proposed method achieves superior performance across various evaluation metrics. Compared with state-of-the-art methods, our approach improves the harmonic mean of known and unknown class detection accuracy by over 7% on NSL-KDD, while specifically boosting the unknown attack detection accuracy by approximately 1.12%,5.24% on the CICIDS2017,NSL-KDD datasets, respectively.
Understanding adversarial attacks is crucial for the secure deployment of visual recognition systems. While ensemble attacks combine the strengths of transfer-based and query-based methods to generate highly transferable adversarial examples, their practicality is often limited in real-world scenarios where the number of queries is restricted. In this paper, we propose a novel frequency-driven ensemble adversarial attack, termed WPEBA, that enables efficient black-box attacks with a minimal number of queries. We first apply wavelet packet decomposition (WPD) to decompose images into frequency sub-bands. Driven by a unified ensemble loss across multiple surrogate models, we adaptively adjust frequency-band weights using internal gradient feedback and jointly generate gradient-based and block-based perturbations in the frequency domain. The perturbed components are then reconstructed into the spatial domain via inverse WPD to produce adversarial examples for querying the target model. Finally, we utilize the query feedback from the target model to dynamically update the surrogate-model weights, guiding the attack in subsequent iterations. Extensive evaluations demonstrate that WPEBA achieves an average attack success rate exceeding 99% with merely one or two queries across six distinct standard architectures. Furthermore, it maintains effective attack performance against models equipped with robust defenses and the Google Cloud Vision API. Overall, our method provides a new and practical approach for evaluating general model robustness.
As a critical task in intelligent surveillance and smart city systems, person re-identification (ReID) addresses the challenge of matching individuals across non-overlapping camera views. Although fully unsupervised learning (USL) methods based on pseudo-label training have achieved remarkable progress, they still face three persistent challenges: accumulated noise in pseudo-labels, insufficient modeling of local features, and poor adaptability of cluster-level memory banks. To this end, we present a framework named Adaptive Feature Fusion and Memory Augmentation (AF2MA), which consists of two core modules: adaptive feature fusion and memory augmentation. Specifically, the adaptive feature fusion module enhances robustness to pose and occlusion by decoupling the feature map into coarse spatial regions and recombining regional feature representations to generate predicted features, thereby deriving more reliable pseudo-labels. The memory augmentation module suppresses noise and facilitates complementary learning through independently optimized cluster-level and instance-level memory banks, effectively alleviating the stability-plasticity dilemma. Furthermore, we design a teacher-student learning strategy to provide stable, task-specific supervision and mitigate the accumulation of pseudo-label errors during iterative training. Extensive experiments validate the superiority of our proposed method.
Abstract-Weakly supervised video anomaly detection (WS-VAD) presents a significant challenge in security video surveillance, as it aims to accurately identify anomaly frames in untrimmed videos with only video-level supervision. Several recent studies exploit the vision-language pre-training models, e.g., CLIP, to take advantage of cross-modal relationships by adapting the pre-trained vision-language associations to the WS-VAD task. However, the supervision in these methods is derived solely from the coarse video-level labels. Consequently, they lack the precise supervision to understand video details comprehensively and exhibit systematic visual shortcomings, such as failure to recognize fine-grained anomaly patterns that require rich and detailed information. To address this problem, we propose a novel Reconstructive Visual Tuning (RVT) approach for the WS-VAD task. Instead of the naive exploitation of coarse video-level supervision, we enhance the WS-VAD model by reconstructing input video features to regularize the visual representations. By doing so, it capitalizes on the inherent detail and richness within the input features themselves, which are typically overlooked in previous WS-VAD approaches. Specifically, RVT employs a reconstruction objective that operates on the input video features, thereby circumventing the spatial redundancy inherent in raw RGB value regression. Furthermore, to better capture both detailed local and global temporal patterns, we design a global-local collaborative temporal modeling module (GLCT) to capture temporal dependencies from global and local perspectives. Extensive experiments demonstrate that the proposed RVT model delivers consistent and significant performance improvements across various VAD datasets. In comparison with existing state-of-the-art methods, RVT achieves competitive performance, underscoring the effectiveness of the proposed approach.
Dynamic hand gestures encode rich physiological and behavioral characteristics, providing a promising biometric trait for reliable authentication. Existing studies primarily improve gesture authentication by designing network architectures, constructing behavioral pseudo-modalities, and optimizing loss functions. Following this paradigm, PB-Net adopts a decoupled analysis and complementary fusion strategy for the two characteristics, achieving competitive performance. However, its modeling of fine-grained identity characteristics remains limited. In this work, we revisit PB-Net and propose PB-Net v2 by rethinking the modeling requirements of physiological and behavioral characteristics. Specifically, we refine the data-tailoring strategy, including behavioral pseudo-modality design, to reduce redundancy while preserving richer identity information. We then enhance the physiological and behavioral branches to extract more complementary spatiotemporal physiological features and more stable behavioral representations, respectively. Moreover, we improve the feature fusion module to mitigate branch-specific bias and facilitate reliability-aware feature fusion. Extensive experiments on SCUT-DHGA, SCUT-DHGA-br, and SCUT-RealDHGA datasets demonstrate the effectiveness and generalizability of the proposed improvements. In particular, PB-Net v2 consistently achieves the lowest equal error rates among 22 state-of-the-art models under four evaluation protocols. Moreover, its superior performance under three imitation-oriented protocols further demonstrates improved robustness against such spoofing attacks. The code is publicly available at https://github.com/SWJTU-GDS/PB-Net-v2.
In this work, we investigate the task of Federated Generalized Category Discovery (Fed-GCD), which aims to leverage labeled data from known classes to cluster unlabeled samples from both known and unknown classes through privacy-preserving collaboration among clients. Existing Fed-GCD methods predominantly emphasize improving the performance of the global model, while largely neglecting the personalized performance of local clients—often resulting in local models that perform even worse than those trained solely on local data. Furthermore, existing methods uniformly aggregate these suboptimal local models, which inevitably degrades the global model due to knowledge conflict. To address these limitations, we propose a Personalized Contrastive Graph Learning (PCGL) framework that explicitly decouples generic and personalized knowledge, thereby achieving joint enhancement of both global and local models. Specifically, PCGL comprises two key components: local-graph contrastive learning and personalized knowledge aggregation and extraction. The former introduces a novel KNN-Former that predicts potential contrastive relationships among labeled and unlabeled samples to improve local representation learning. The latter promotes the learning of detachable knowledge via adaptive parameter masking and personalized aggregation, effectively mitigating knowledge conflicts between global and local models. Extensive experiments on six generic and fine-grained datasets demonstrate the superiority of PCGL over state-of-the-art methods, with particularly notable gains on long-tailed natural and medical image datasets by a 4.8% average margin on All ACC.
Person re-identification (Re-ID), as a core technology for target tracking and identity authentication, is widely applied in intelligent surveillance and security systems. In recent years, radio frequency sensing-based person Re-ID has attracted significant attention due to its robustness against visual interference. However, existing research mainly focuses on unobstructed and fixed-route scenarios, which restrains its applications in real world. In this work, we propose TWReID, a through-wall and free-walking person Re-ID system based on our customized multiple-input multiple-output (MIMO) radar with 4 transmitting (TX) × 16 receiving (RX) antenna array, which produces 1∼2 GHz frequency-modulated continuous wave (FMCW) signals to penetrate walls and reflect human signals. During the stage of data pre-processing, we design an additional input branch generated by Doppler-static background subtraction (DSBS) to prevent the removal of individuals with minor movements in moving average background subtraction (MABS). Then the raw polar coordinate data is converted into a world Cartesian coordinate system to mitigate the viewpoint dependence. To further characterize the gait information, TWReID presents a dual-branch feature extraction network termed statistic contextual multi-scale channel-aware network (SCMCNet), in which multi-scale channel-aware spatio-temporal attention (MCSA) is constructed to achieve adaptive spatial-temporal feature fusion. Experiments show that TWReID achieves mAP and CMC-1 of 86.8% and 96.5% on a dataset of 14 people walking freely, and mAP and CMC-1 of 64.6% and 95% on a dataset containing different behaviors, outperforming existing identity recognition and person Re-ID methods.
Machine Learning as a Service raises the joint challenge of protecting client inputs and model parameters while enabling public verification of inference results. Existing verifiable privacy-preserving approaches often incur costly online proof generation or provide limited support for nonlinear operations. We present AuditML, a publicly auditable privacy-preserving framework for machine learning inference in the semi-honest model. AuditML combines arithmetic secret sharing with commitment-based audit data and separates execution from verification: the parties generate correlated randomness offline, perform privacy-preserving inference online, and publish the opened values and associated audit data to a public bulletin board, from which anyone can verify the computation afterward. The supported inference circuits are expressed using three auditable operations, ADD, MULTIPLY, and SIGN. In particular, AuditML implements SIGN and its underlying comparison entirely over arithmetic shares, avoiding arithmetic-to-Boolean conversion while retaining commitment-based auditability. This design eliminates a separate online proof-generation procedure and keeps auditing outside the latency-critical online phase. We implement AuditML on MP-SPDZ and evaluate linear regression, fixed-threshold binary logistic classification, and linear-kernel SVM in two-party and three-party settings. At a batch size of 50, linear and fixed-threshold binary logistic inference complete online in less than one second, while the multiplication-intensive SVM requires 10.0939–40.0334 seconds; per-participant online communication is approximately twice that of the semi-honest baseline. And compared with zkCNN-MPL, AuditML has lower inference latency with the same level of security. The results demonstrate efficient online execution for the evaluated lightweight models while exposing the higher computation and audit costs of multiplication-intensive circuits.
As textual adversarial attacks pose risks to natural language processing models, adversarial training is often utilized to improve robustness of these systems. In a strict black-box scenario, most query-based textual adversarial attack methods rely on fixed or limited perturbation policies and search in the perturbation space, making it difficult to balance attack success rate (ASR), query cost and textual quality of generated adversarial examples. To address this, we propose GECOMP, a generative textual adversarial attack method that relies on policy optimization by constructing an extensible library of compositional perturbations. By adopting a large language model (LLM) based generator to rewrite an input sequence, the outputs are perturbed according to the library under constraints of semantic similarity and edit magnitude. By employing a budget-aware reinforcement learning strategy for training with respect to feedback of a victim model, the LLM-based generator learns the most effective perturbation policy for adversarial example generation. Experimental results and performance comparisons on four public datasets and across five victim models show that, compared with ten baseline methods, GECOMP generates adversarial examples with higher ASRs and better quality by using fewer queries and less edit magnitude.
Password-based cloud storage (PBCS) allows users to outsource datasets to the cloud server and synchronize the corresponding data. However, there are two key challenges. First, they lack anonymity, making user activities linkable to public identities. Although integrating anonymous password-authenticated key exchange (APAKE) can achieve anonymity, it relies on private information retrieval (PIR), which causes high communication and computation overhead. Additionally, existing APAKE protocols are vulnerable to online password-guessing attacks (PGA). Second, PBCS cannot ensure reliable synchronization, where malicious/victimized servers may roll back user data undetectably. To address these issues, we propose HRACS, a highly reliable and anonymous cloud synchronization scheme, based on our newly designed PIR-free APAKE. Specifically, PIR-free APAKE replaces PIR through a lightweight pseudonym-signature mechanism, reducing communication overhead from linear to constant. The deterministic pseudonym also enables anonymous rate-limiting, mitigating online PGA. Moreover, HRACS simultaneously supports reliable synchronization of datasets by encrypting each item with authenticated encryption and computing a fingerprint of the entire dataset. Each item carries a binding proof to the fingerprint, allowing the user to detect any unauthorized modifications (e.g., reordering or rollback). Experimental results demonstrate that our PIR-free APAKE achieves competitive computation efficiency, reducing the overhead by up to 68.29% compared with existing APAKE protocols. Regarding communication, the bandwidth requirement remains constant and is reduced by up to 99.96% relative to PIR-based APAKE protocols when scaling to 20,000 users. Moreover, HRACS strengthens security without sacrificing performance, incurring overhead comparable to existing PBCS schemes.
Cloud-based Large Language Model (LLM) inference services typically require users to submit plain-text inputs, thereby posing severe privacy risks. Existing privacy-preserving paradigms are mostly task-specific and often necessitate pervasive modifications to the entire server-side model. This reliance introduces substantial computational overhead, elevated deployment costs, and an inevitable privacy-utility trade-off. In this paper, we propose PI-SAFE, a novel framework enabling privacypreserving LLM inference for both text generation and classification tasks, notably without requiring any alterations to the serverside model. By partitioning a pre-trained LLM between the client and the server, PI-SAFE facilitates collaborative inference via the transmission of obfuscated intermediate representations rather than raw text. To defend against reconstruction attacks, we introduce a Dual-constraint Adversarial Fine-Tuning (AdvFT) mechanism, which empowers the client to reshape the output feature distribution by covertly inserting adapter modules. To further counter powerful adversaries equipped with massive prior data who employ Deep Neural Networks (DNNs) for inverse fitting, we propose an enhanced framework, PI-SAFE+. This framework introduces a random prefix-based feature obfuscation mechanism. By employing a locally generated, fixed secret token sequence for feature fusion, PI-SAFE+ fundamentally disrupts the topological isomorphism of the feature mapping space. Extensive experiments demonstrate that, under equivalent privacy guarantees, PI-SAFE+ significantly outperforms existing baselines in inference utility. Crucially, it reduces the success rate of optimization-based reconstruction attacks to near zero and degrades attribute inference to random-guessing levels, exhibiting exceptional empirical defense and computational efficiency.
Indoor presence detection is essential for security monitoring in smart spaces, supporting applications such as access control and anomaly detection. While Wi-Fi Channel State Information (CSI) sensing has emerged as a promising solution, most existing methods rely on fixed and stable links, an assumption rarely satisfied in real-world deployments. Indoor environments are naturally populated with opportunistic devices such as smartphones, laptops, and Internet of Things (IoT) terminals, which generate intermittent and heterogeneous CSI streams that are sensitive to environmental interference. These factors reduce sensing stability and make stationary occupants difficult to detect. To address these challenges, we present a practical CSI sensing system tailored to ambient Wi-Fi links with opportunistic connectivity. A reference-based subspace denoising method exploits unoccupied periods to model long-term background statistics and suppress persistent hardware and environmental interference. A multi-region joint sensing strategy further integrates room device-to-Access Point (AP) links with corridor AP-to-AP links, using spatial consistency to capture room states and transitions across regions. This design improves the reliability of presence decisions in security monitoring scenarios, where false alarms may trigger unnecessary responses and missed detections may hide unauthorized or stationary occupants. Evaluation in single-room and four-room university deployments shows that reference-based denoising improves room sensing and that multi-region joint sensing further improves presence inference by incorporating corridor transition cues. Ablations, baseline comparisons, and sensing-risk tests also examine the system behavior under practical deployment conditions. These results indicate that opportunistic Wi-Fi sensing can support presence detection for indoor security monitoring in practical deployments.
The cumulative distribution function (CDF) is fundamental for characterizing random variables, making it essential in applications that require privacy-preserving data analysis. This paper introduces a novel framework for constructing differentially private CDFs inspired by functional analysis and the functional mechanism. We develop two variants: a polynomial projection method, which projects the empirical CDF into a polynomial space, and a sparse approximation method via matching pursuit, which projects it into arbitrary function spaces constructed from dictionaries. In both cases, the empirical CDF is approximated within the chosen space, and the corresponding coefficients are privatized to guarantee differential privacy. Compared with existing approaches such as histogram queries, tree-based methods, and adaptive quantiles, our approach achieves comparable or superior performance. Our methods are particularly well-suited to decentralized settings and scenarios where CDFs must be efficiently updated with newly collected or streaming data. They are also readily extensible to multivariate distributions while remaining effective. In addition, we investigate the influence of parameters such as dictionary size and systematically evaluate different dictionary constructions, including Legendre polynomials, B-splines, and distribution-based functions. Overall, our contributions advance the development of practical and reliable methods for privacy-preserving CDF estimation.
The transport layer is a critical component of the Internet protocol stack, providing reliable data delivery and securing the communication channel between clients and servers. TLS 1.3, the de facto standard protocol for this layer, is deployed on billions of devices and provides the confidentiality and integrity of most web traffic. Yet the very standardization and protocol transparency that make TLS so successful also enable mandatory network auditing and censorship. Network intermediaries can require disclosure of session keys or perform deep packet inspection (DPI) to verify that the communication complies with local policies, effectively breaking the promise of end-to-end encryption. Existing countermeasures either deviate from standard TLS or introduce non-compliant traffic patterns, rendering them detectable by modern censors. In this paper, we propose CCCC, a covert communication scheme that is fully compliant with standard TLS 1.3. Our key insight is twofold: (i) we efficiently construct collision ciphertexts, which allow a single AES ciphertext-tag pair to be decrypted successfully; (ii) we reduce the transmission of a covert message to the transmission of an innocuous vector, which is embedded within a standard EdDSA signature during the TLS handshake without undermining public verifiability. For a compulsory auditor who holds only the session key, every message—the handshake with its valid signature and all subsequent application records—appears perfectly normal and decrypts to a harmless overt message. The intended receiver, who holds a pre-shared secret key, recovers the vector from the signature and reconstructs the hidden message via the collision ciphertext. We formally define the security properties of collision ciphertexts, provide an efficient instantiation using AES-GCM and EdDSA, and implement a full prototype. Comprehensive performance evaluation demonstrates practical efficiency of our scheme, with only moderate overhead compared to standard TLS 1.3.
Optical Coherence Tomography (OCT) has emerged as a powerful technique for capturing subcutaneous internal fingerprints (IF) and internal sweat pores (ISP), offering enhanced security over surface biometrics. However, existing methods typically rely on slice-by-slice B-scan segmentation, which are computationally intensive, sensitive to speckle noise, and incapable of simultaneously extracting IF and ISP. To address these limitations, this paper proposes REI-Net, a novel end-to-end network designed for the rapid and joint extraction of binarized IF and ISP directly from raw 3D OCT volumes. Unlike traditional extraction methods based on contour segmentation, REI-Net employs depth projection to shift the processing direction from B-scan to en-face. The architecture features a two-stage design: a Depth Compressor and a Plane Refiner. The Compressor incorporates a novel Depth-Breadth Separation Block (DBSB), which decouples volumetric feature extraction into a structural depth stream and a topological breadth stream based on Mamba. Subsequently, the Plane Refiner reconstructs fine-grained details via full-scale skip connections. Extensive experiments on the ZJUT-EIFD dataset demonstrate that REI-Net achieves state-of-the-art performance, yielding the highest NFIQ 2.0 quality scores for IF and the lowest false detection rates for ISP. Notably, the total inference time is reduced to just 605ms, which is orders of magnitude faster than existing methods, thereby constitutes a critical step toward practical, real-time OCT-based biometric systems.
