Text-to-image diffusion models remain susceptible to generating undesirable or harmful content. Although concept unlearning mitigates this risk, existing methods struggle with a critical optimization dilemma: thorough semantic erasure frequently induces the catastrophic forgetting of unrelated generative capabilities. To overcome this challenge, we propose Key Step Concept Unlearning (KSCU). Serving as an integrated methodological refinement deeply motivated by information theory, KSCU explores the profound impact of step scheduling order and reveals that traditional randomized timestep sampling severely disrupts trajectory dependency. We demonstrate that indiscriminately targeting the entire diffusion process is inefficient, as the optimal step range for unlearning inherently varies across different concepts. Rather than globally fine-tuning all timesteps, KSCU explicitly integrates a sequential-scheduling-based Key Step Table, CFG-aware leakage compensation, and prompt augmentation to dynamically isolate optimization to a concept-specific active region. This localized strategy successfully eradicates the target concept while preventing the structural collapse caused by early-step over-optimization. Consequently, KSCU significantly reduces computational overhead and establishes a state-of-the-art trade-off between concept erasure and utility retention. Comprehensive evaluations demonstrate that KSCU consistently delivers superior performance across diverse unlearning tasks, including nudity, style, object classes, and mass instance concepts. For example, in nudity removal, KSCU yields a 96.5% unlearning accuracy alongside a state-of-the-art FID of 14.1. Crucially, the Key Step mechanism serves as a robust plug-and-play module. Integrating it into existing baselines inherently mitigates structural collapse while simultaneously enhancing generative preservation and computational efficiency.

While recent image editing models have made rapid progress, multi-reference editing remains challenging, particularly in maintaining visual consistency across references and ensuring overall visual harmony. Reinforcement learning has proven highly effective for text-to-image generation and single-image editing, but its extension to multi-reference editing is hindered by the absence of suitable reward models that capture multi-image relational constraints. Moreover, naively using multimodal large language models(MLLMs) as zero-shot evaluators faces a key tension between hallucination-prone long-form reasoning and the limited deductive power of short-form judgments. We address these issues with a Multi-dimensional Evaluation-Verification Reward(EVR). EVR decomposes evaluation into distinct visual criteria; for each criterion, an MLLM Evaluator generates multiple candidate hypotheses, and a Verifier grounds each claim in concrete visual evidence to accept or reject it, producing reliable and fine-grained reward signals. Together with a scalable data pipeline, our method enables RL fine-tuning of off-the-shelf editors without architectural changes. Extensive experiments show substantial gains over the base Qwen-Image-Edit, improving consistency and harmony to match or surpass NanoBanana.

Driven by the pressing demand for graph anomaly detection (GAD) in high-stakes domains, the generalist GAD paradigm, which trains a single detector transferable across new graphs, has recently gained growing attention. However, existing methods often rely on scarce and costly annotations for training and sometimes even require few-shot support at inference, which limits their robustness to diverse and unseen anomaly patterns. To address this limitation, we introduce ProMoS, the first unsupervised generalist GAD framework, which detects anomalies by modeling the abundant normality in unlabeled data. ProMoS adopts a knowledge-distillation paradigm to distill normality priors from a frozen self-supervised graph neural network (GNN) teacher to a mixture-of-students model with shared global and lightweight personalized branches, enabling efficient and expressive normality modeling without learning from scratch. We further propose prototype-guided soft-label distillation to align teacher and student in a shared prototype space, enhancing cross-graph generalizability. During inference, ProMoS performs zero-shot anomaly detection on unseen graphs via distillation bias and prototype geometric deviation. Extensive experiments show the effectiveness and efficiency of ProMoS, charting a practical path toward label-free, zero-shot generalist GAD.

Existing multimodal deepfake detection methods primarily rely on capturing correlations between audio-visual modalities to improve detection performance. However, in scenarios such as instant messaging and online video conferencing, network jitter often leads to audio-visual asynchrony, disrupting inter-modal associations and limiting the effectiveness of these methods. To address this issue, we propose a deepfake detection framework specifically designed for audio-visual asynchrony scenarios. First, based on the theory of open balls in metric space, we analyze the variation mechanism of joint features in both audio-visual synchrony and asynchrony scenarios, revealing the impact of audio-visual asynchrony on detection performance. Second, we design a multimodal subspace representation module that incorporates hierarchical cross-modal semantic similarity to address inconsistencies in audio-visual data distributions and representation heterogeneity. Furthermore, we formulate audio-visual feature alignment as an integer linear programming task and employ the Hungarian algorithm to reconstruct missing inter-modal associations. Finally, we introduce a self-supervised masked reconstruction mechanism to restore missing features and construct a joint correlation matrix to measure cross-modal dependencies, enhancing the robustness of detection. Theoretical analysis and experimental results show that our method outperforms baselines in audio-visual synchrony and asynchrony scenarios and exhibits robustness against unknown disturbances.

Current state-of-the-art post-deployment countermeasures for adversarial example mitigation (known as adversarial purification and detection) exhibit significant limitations: (1) insufficient generalization performance on various adversarial examples, (2) serious negative effects on benign samples (referred to as the decreased accuracy), and (3) extensive inference-time consumption, etc. These limitations considerably hinder their application in safety-critical real-world scenarios. To narrow these gaps, this paper proposes a novel post-deployment countermeasure named Random, Ensemble, and Simultaneous Purification-Detection Framework (RES-PDF). Specifically, inspired by the adversarial region migration phenomenon observed in adversarial purification, RES-PDF first extends this concept to a continuous adversarial region migration phenomenon and exploits it to establish a novel adversarial purification named Random Ensemble Adversarial Purification (REAP). Then, RES-PDF innovatively introduces a detection feature on REAP to enhance its purification performance further while simultaneously using a purification feature to improve its detection performance further. In RES-PDF, purification and detection can complement each other, achieving the effect of 1+1>2. Extensive experiments across different scenarios demonstrate that RES-PDF surpasses previous countermeasures in several key areas: (1) remarkably enhanced generalization performance on various adversarial examples, with an average improvement of >10.0%; (2) minimal negative effects on benign samples, with a reduction of <1.0%; and (3) significantly reduced inference-time consumption, reduced to the millisecond level, etc. In general, RES-PDF provides a novel and efficient post-deployment countermeasure for adversarial example mitigation in safety-critical real-world scenarios.

With the widespread use of smartphones, malware has posed serious threats to their security, making its detection of utmost concern. To combat the evolving malware attacks, deep learning-based methods have been successfully developed in practical applications due to their strong generalization and unparalleled flexibility in automatic malware detection. However, recent studies have shown that the highly complex transformations of machine learning models, the general unverifiability caused by compound structures, and the unexplainability of predictions have enabled the attackers to carry out inference of the models, which has led to the creation of adversarial samples. Therefore, recent research has concentrated on the key areas of defense against adversarial attacks such as malicious detection. This paper introduces NetAED, a framework for reactive defenses against malware attacks based on adversarial examples, which neither modifies the deployed classifier nor requires knowledge of the process for crafting adversarial examples. In NetAED, we propose a Random Cross-Region Feature Perturbation mechanism and employ non-linear quantization to alleviate the impact of adversarial examples. We further develop ARNDroid, a malware detection system against adversarial examples, which integrates the proposed NetAED. Promising experimental results based on real-world datasets demonstrate that ARNDroid typically provides superior classification performance and robustness to white-box attacks compared with state-of-the-art approaches.

Recently, multimodal large language models (MLLMs) have emerged as a unified paradigm for language and image generation. Our work shows that MLLMs pair usability with higher risks, highlighting the need for adaptive safeguards to mitigate real-world harms.Compared with diffusion models, MLLMs possess a much stronger capability for semantic understanding, enabling them to process more complex textual inputs and comprehend richer contextual meanings. However, this enhanced semantic ability may also introduce new and potentially greater safety risks.Taking diffusion models as a reference point, we systematically analyze and compare the safety risks of emerging MLLMs along two dimensions: unsafe content generation and fake image synthesis.Across multiple unsafe generation benchmark datasets, we observe that MLLMs tend to generate more unsafe images than diffusion models. This difference partly arises because diffusion models often fail to interpret abstract prompts, producing corrupted outputs, whereas MLLMs can comprehend these prompts and generate unsafe content.For current advanced fake image detectors, MLLM-generated images are also notably harder to identify. Even when detectors are retrained with MLLMs-specific data, they can still be bypassed by simply providing MLLMs with longer and more descriptive inputs.Our measurements indicate that the emerging safety risks of the cutting-edge generative paradigm, MLLMs, have not been sufficiently recognized, posing new challenges to real-world safety.

Transferable adversarial images raise critical security concerns for computer vision systems in real-world, black-box attack scenarios. Although many transfer attacks have been proposed, existing research lacks a systematic and comprehensive evaluation. In this paper, we systemize transfer attacks into five categories around the general machine learning pipeline and provide the first comprehensive evaluation, with 23 representative attacks against 11 representative defenses, including the recent, transfer-oriented defense and the real-world Google Cloud Vision. In particular, we identify two main problems of existing evaluations: (1) for attack transferability, lack of intra-category analyses with fair hyperparameter settings, and (2) for attack stealthiness, lack of diverse measures. Our evaluation results validate that these problems have indeed caused misleading conclusions and missing points, and addressing them leads to new, consensus-challenging insights, such as (1) an early attack, DI, even outperforms all similar follow-up ones, (2) the state-of-the-art (white-box) defense, DiffPure, is even vulnerable to (black-box) transfer attacks, and (3) even under the same $L_{p}$Lp constraint, different attacks yield dramatically different stealthiness results regarding diverse imperceptibility metrics, finer-grained measures, and a user study. We hope that our analyses will serve as guidance on properly evaluating transferable adversarial images and advance the design of attacks and defenses.

Mobile motion sensors such as accelerometers and gyroscopes are now ubiquitously accessible by third-party apps via standard APIs. While enabling rich functionalities like activity recognition and step counting, this openness has also enabled unregulated inference of sensitive user traits, such as gender, age, and even identity, without user consent. Existing privacy-preserving techniques, such as GAN-based obfuscation or differential privacy, typically require access to the full input sequence, introducing latency that is incompatible with real-time scenarios. Worse, they tend to distort temporal and semantic patterns, degrading the utility of the data for benign tasks like activity recognition. To address these limitations, we propose the Predictive Adversarial Transformation Network (PATN), a real-time privacy-preserving framework that leverages historical signals to generate adversarial perturbations proactively. The perturbations are applied immediately upon data acquisition, enabling continuous protection without disrupting application functionality. Experiments on two datasets demonstrate that PATN substantially degrades the performance of privacy inference models, achieving Attack Success Rate (ASR) of 40.11% and 44.65% (reducing inference accuracy to near-random) and increasing the Equal Error Rate (EER) from 8.30% and 7.56% to 41.65% and 46.22%. On ASR, PATN outperforms baseline methods by 16.16% and 31.96%, respectively.

Large Language Models (LLMs) are increasingly applied in high-stakes domains such as finance, healthcare, and education, where reliable multi-turn interactions with users are essential. However, existing work on confidence estimation and calibration, a major approach to building trustworthy LLM systems, largely focuses on single-turn settings and overlooks the risks and potential of multi-turn conversations. In this work, we introduce the task of multi-turn calibration to reframe calibration from a static property into a dynamic challenge central to reliable multi-turn conversation, where calibrating model confidence at each turn conditioned on the conversation history is required. We first reveal the risks of this setting: using Expected Calibration Error at turn T (ECE@T), a new metric that tracks calibration dynamics over turns, we show that user feedback (e.g., persuasion) can degrade multi-turn calibration. To address this, we propose MTCal, which minimises ECE@T via a surrogate calibration target, and further leverage calibrated confidence in ConfChat, a decoding strategy that improves both factuality and consistency of the model response in multi-turn interactions. Extensive experiments demonstrate that MTCal achieves outstanding and consistent performance in multi-turn calibration, and ConfChat preserves and even enhances model performance in multi-turn interactions. Our results mark multi-turn calibration as one missing link for scaling LLM calibration toward safe, reliable, and real-world use. The code is available at: https://github.com/petezone/Multiturn-Calibration.

Large code language models (LCLMs) have revolutionized code-related tasks, yet their deployment in real-world software engineering introduces critical security challenges. As LCLMs increasingly interact with adversarial environments, understanding their vulnerabilities and developing robust defenses becomes imperative. This review systematically examines emerging adversarial threats and countermeasures, aligning with the CIA triad—confidentiality, integrity, and availability. We categorize attacks into three key frontiers: poisoning attacks (compromising integrity availability), adversarial attacks (undermining integrity), and privacy attacks (breaching confidentiality). Our study synthesizes 100+ papers spanning AI, security, and software engineering, offering the most extensive analysis to date on LCLM adversarial risks. We dissect threat models, attack methodologies, and mitigation strategies while introducing novel insights on explainable AI (XAI) and the interplay between risk categories. Finally, we highlight unresolved challenges and future research directions to advance secure LCLM adoption. By bridging theoretical and practical security gaps, this work provides a foundational roadmap for developing resilient LCLMs in adversarial settings.

Text-to-image (T2I) models are increasingly optimized for following user instructions faithfully. However, we find that this capability introduces a safety vulnerability we call Multi-Concept Compositional Unsafety (MCCU). MCCU occurs when multiple individually safe concepts, if combined in a single generation request, lead to harmful or sensitive visual outputs. Unlike prior jailbreak settings, MCCU does not rely on adversarial prompts, model access, or explicitly disallowed content. Instead, the risk emerges from how the model composes multiple safe visual concepts into a single scene. To systematically measure this threat, we build TwoHamsters, a large-scale evaluation framework consisting of 20k prompts, 51 curated concept pairs, and six risk categories. We evaluate 13 T2I models under a black-box setting. Our results show a clear conflict between instruction-following and safety: models that follow prompts more faithfully tend to produce more MCCU failures. For example, FLUX.1 achieves a 99.35

The exponential growth of deep learning models, especially Large Language Models (LLMs), has dramatically increased computational demands. To meet these demands, modern deep learning systems increasingly depend on specialized hardware accelerators, such as NVIDIA GPUs. The performance of deep learning workloads ultimately depends on the efficiency of computational kernels, the fundamental operators underlying these accelerators. However, these kernels are notoriously difficult to manually generate and optimize due to complex, hardware-dependent design constraints. Recent advances in LLMs are unlocking new opportunities for automated kernel generation and optimization, offering a compelling alternative to traditional laborintensive and expert-driven approaches. This paper presents the first comprehensive survey of deep learning kernel generation and optimization using LLMs. Moreover, we provide a systematic roadmap for improving benchmarking and generation techniques in this field.

To address the trade-off between robustness and performance for robust VLM, we observe that function words could incur vulnerability of VLMs against cross-modal adversarial attacks, and propose Function-word De-Attention (FDA) accordingly to mitigate the impact of function words. Similar to differential amplifiers, our FDA calculates the original and the function-word cross-attention within attention heads, and differentially subtracts the latter from the former for more aligned and robust VLMs. Comprehensive experiments include 2 SOTA baselines under 6 different attacks on 2 downstream tasks, 3 datasets, and 3 models. Overall, our FDA yields an average 18/13/53\% ASR drop with only 0.2/0.3/0.6% performance drops on the 3 tested models on retrieval, and a 90\% ASR drop with a 0.3\% performance gain on visual grounding. We demonstrate the scalability, generalization, and zero-shot performance of FDA experimentally, as well as in-depth ablation studies and analysis. Code will be made publicly available.

Jamming attacks pose a significant threat to the security of air-ground communications, where the challenge becomes more severe when involving multiple unmanned aerial vehicles (UAVs) incurring complex interference. To address this issue, this paper proposes a graph attention-based reinforcement learning strategy for anti-jamming UAV communications. Specifically, we consider the multi-UAV transmission and deployment in the presence of jamming attacks. Then, we formulate a zero-sum game with the legitimate side and adversary to maximize and minimize the overall transmission rate, respectively. Given the complicated structure of the game, we decompose it into two layers, tackled in a hierarchical learning framework. Particularly, the inner layer addresses the legitimate beamforming, for which we establish the graph attention network (GAT) to track the complicated interference and jamming relationship based on the graph representation of the UAV network. The outer layer address the legitimate UAV deployment and adversarial jamming policy, which is reinterpreted in a multi-agent deep reinforcement learning framework to obtain the strategies of both sides. The inner GAT is then nested within the outer multi-agent learning framework in a hierarchical manner to approximate the equilibrium of the original game model. Simulation results demonstrate the convergence and the performance superiority of the proposed learning scheme in terms of anti-jamming transmission rate. Also, the results exhibit significant generalization capability to cover different network configurations and parameters with reliable communication performance.

Texture binding is widely used in computer graphics for surface detailing, traditionally relying on expert-intensive 3D modeling. As an alternative, we explore purely 2D-based texture binding using personalized text-to-image generation. While fine-tuning diffusion models can embed specific textures into the modifier of text conditions, existing methods struggle on unseen objects. To overcome this, we propose Texture-Object Decoupling (TOD), which incorporates a multi-view texture rendering module to learn explicit object-texture mappings. To prevent catastrophic forgetting, we augment fine-tuning with images generated without the reference texture. TOD can be seamlessly combined with various condition guidance, such as ControlNet conditions and object boxes. With only 0.4% of parameters fine-tuned, it achieves a 1.4 ∼ 2.8× improvement in texture score over state-of-the-art methods.

Large language model (LLM) agents are increasingly built on agent frameworks that provide reusable abstractions for workflow orchestration, state management, tool integration, and execution control. However, the quality of this infrastructure layer remains insufficiently understood, particularly its functionality challenges and usability concerns, as existing studies have mainly examined traditional deep learning (DL) frameworks or model-level agent failures. Therefore, we conduct an empirical study of 5,669 bug reports and 809 feature requests from five mainstream agent frameworks: AutoGen, CrewAI, LangChain, LangGraph, and MetaGPT. We construct a four-dimensional taxonomy covering 22 root causes, seven symptoms, 11 motivations, and six requirements, and map them to the five-stage agent lifecycle. Across the four RQs, results show an execution centered quality pattern shaped by semantic interface boundaries. Reported bugs mainly manifest as Incorrect Functionality (76.00

Multi-hop logical reasoning is crucial for numerous real-world applications, including recommendation systems, question answering, and medical diagnosis. Multi-hop logical query answering on incomplete knowledge graphs has received significant interest as it explores the model's capabilities for complex query reasoning, which encompasses queries leveraging logical conjunctions (boolean AND), disjunctions (boolean OR), negation (-'), and existential quantification (3). Previous embedding-based methods struggle to adapt to out-of-distribution query structures and require training with complex queries. To generate answers for complicated queries, some research efforts have focused on end-to-end optimization, while others have leveraged pre-trained neural link predictors. However, the plausibility scores of triplets in neural link predictors fluctuate significantly. Moreover, the search space grows exponentially. These two factors pose significant challenges that traditional optimization techniques struggle to overcome. In this work, we propose an adapting nucleus sampling method for multi-hop logical query answering, namely NSCLQ. By traversing the knowledge graph within the query computation graph, NSCLQ is capable of reasoning over query answers and solving combinatorial optimization problems through adaptive dynamic sampling. Specifically, by utilizing an adaptive scoring function to determine the likelihood that entities ei and e are linked through relationship r, the reasoning process of NSCLQ not only enhances interpretability but also effectively reduces the search space. Experiments performed on three datasets demonstrate that NSCLQ achieves statistically significant improvements over state-of-the-art methods in complex logical query answering.

Transferable adversarial examples raise critical security concerns in real-world, black-box attack scenarios. However, in this work, we identify two main problems in common evaluation practices: (1) For attack transferability, lack of systematic, one-to-one attack comparison and fair hyperparameter settings. (2) For attack stealthiness, simply no comparisons. To address these problems, we establish new evaluation guidelines by (1) proposing a novel attack categorization strategy and conducting systematic and fair intra-category analyses on transferability, and (2) considering diverse imperceptibility metrics and finer-grained stealthiness characteristics from the perspective of attack traceback. To this end, we provide the first large-scale evaluation of transferable adversarial examples on ImageNet, involving 23 representative attacks against 9 representative defenses. Our evaluation leads to a number of new insights, including consensus-challenging ones: (1) Under a fair attack hyperparameter setting, one early attack method, DI, actually outperforms all the follow-up methods. (2) A state-of-the-art defense, DiffPure, actually gives a false sense of (white-box) security since it is indeed largely bypassed by our (black-box) transferable attacks. (3) Even when all attacks are bounded by the same $L_p$ norm, they lead to dramatically different stealthiness performance, which negatively correlates with their transferability performance. Overall, our work demonstrates that existing problematic evaluations have indeed caused misleading conclusions and missing points, and as a result, hindered the assessment of the actual progress in this field.