Taking photos of sensitive facilities and sensitive information in no photography area may cause sensitive information leakage if not discovered in time. Employing action recognition models to detect instances of photography can effectively prevent information leakage. Current action recognition models have shown unsatisfactory performance in detecting photo-taking actions in surveillance videos, and their reliance on GPU devices hinder their practicality. This paper presents a novel approach to address the detection of photo-taking actions. The method utilizes object detection to filter out background data and incorporates human pose estimation to extract human skeleton data. By combining these AI techniques, the method enables accurate recognition of photo-taking actions. We introduce a novel technique called self-annotation that enables the model to focus on the crucial elements associated with photo-taking actions. Additionally, we introduce a new alarm mechanism that leads to a 69 % reduction in false positives while maintaining the same level of recall by integrating the labels over a period to recognize actions. Compared with traditional action recognition approaches, our method is more flexible and lightweight in actual engineering applications. Moreover, our model is capable of running on CPU-only devices. Experimental results show that our model achieves a precision of 91 % on our dataset.

Recent studies have demonstrated that deep neural networks (DNNs) are highly vulnerable to bit-flip attacks (BFAs), where modifying only a few bits in memory can severely degrade model performance. However, existing BFA techniques typically rely on exhaustive searches over the entire parameter space and overemphasize single-bit flipping capability, leading to limited effectiveness in the presence of modern defenses. To address this challenge, we propose CritiFlip, an efficient BFA framework based on critical-weight identification. CritiFlip locates critical parameters through gradient computation and random perturbation, and performs targeted bit flips on them. By constraining the search to less than 0.1

Federated learning with LoRA is widely used for parameter-efficient fine-tuning of large language models. To address system heterogeneity, current approaches typically assign varying LoRA ranks to clients with different resources. However, these heterogeneous methods suffer from feature dilution and high communication overhead. Furthermore, they often overlook the inconsistent update directions caused by Non-IID data. To overcome these limitations, we propose a simple yet effective federated heterogeneous LoRA approach. Our method treats the LoRA’s A matrix as a fixed orthogonal encoder to pre-align low-rank subspaces. Clients exclusively learn the decoder matrix B, which enables efficient dimensionality aggregation. Experimental results demonstrate that our method significantly outperforms state-of-the-art approaches in both convergence speed and communication efficiency.

The success of Vision-Language Models (VLMs) in visual question answering and image captioning stems from their ability to align visual data with text instructions effectively. Users often upload image-text pairs to cloud-based VLMs that contain sensitive personal information, making them vulnerable to unauthorized analysis by malicious actors. Traditional data privacy protection approaches, which handle textual and visual modalities independently, are ineffective due to the inherent alignment between image and text. To address this challenge, we propose a user instruction-driven privacy-preserving framework that utilizes a surrogate model to identify and safeguard sensitive images and their associated text. Our experiments on MS-COCO and LLaVA-300K demonstrate that models trained on our privacy-preserving datasets maintain at least 96% of the task performance compared to those trained on unprotected data, while effectively defending against multiple privacy extraction attacks, including reconstruction and attribute inference attacks.

With the increasing importance of data privacy and security, federated unlearning has emerged as a novel research field dedicated to ensuring that federated learning models no longer retain or leak relevant information once specific data has been deleted. In this paper, to the best of our knowledge, we propose the first complete pipeline for federated unlearning, which includes a federated unlearning approach and an evaluation framework. Our proposed federated unlearning approach ensures high efficiency and model accuracy without the need to store historical data.It effectively leverages the knowledge distillation model alongside various optimization mechanisms. Moreover, we propose a framework named Skyeye to visualize the forgetting capacity of federated unlearning models. It utilizes the federated unlearning model as the classifier integrated into a Generative Adversarial Network (GAN). Afterward, both the classifier and discriminator guide the generator in generating samples. Throughout this process, the generator learns from the classifier's knowledge. The generator then visualizes this knowledge through sample generation. Finally, the model's forgetting capability is evaluated based on the relevance between the deleted data and the generated samples. Comprehensive experiments are conducted to illustrate the effectiveness of the proposed federated unlearning approach and the corresponding evaluation framework.

Bit-flip attacks (BFAs) pose a serious threat to deep neural networks (DNNs) deployed in edge environments, where limited physical protection and constrained resources expose model weights to hardware fault injections. By flipping only a small number of carefully selected bits, an adversary can severely degrade model accuracy or even induce targeted misbehavior. Existing defenses typically follow one of two paradigms: increasing the attack cost through robustness enhancement or attempting post-attack recovery through redundancy or weight reconstruction. However, these approaches either lack recovery capability or incur prohibitive overhead for resource-constrained edge devices. In this paper, we propose BFA-Shield, a resilient and collaborative defense framework that integrates pre-deployment robustness enhancement with lightweight runtime detection and exact post-attack recovery. The key insight of BFA-Shield is that binary weight determinism enables efficient anomaly localization and precise bit-level recovery, which is fundamentally difficult to achieve in multi-bit quantized models. Specifically, we adopt robustness-enhanced binary neural network training to reduce the attack surface, employ checksum-based runtime monitoring to detect and localize bit flips, and perform direct bit correction without retraining or model reloading. We evaluate BFA-Shield against both random and gradient-guided bit-flip attacks on ResNet and VGG architectures using the CIFAR-10 and ImageNet datasets. Experimental results demonstrate that BFA-Shield substantially increases the attack difficulty while maintaining low storage and runtime overhead. Compared with the INT8 model, BFA-Shield significantly reduces model storage requirements while preserving high post-attack accuracy, making it a practical and effective defense solution for edge-deployed DNNs.

With the rapid development of the data economy, the demand for effective data copyright protection has become increasingly pressing. Digital watermarking is considered one of the most promising techniques for verifying the ownership of digital data, and various relational database watermarking methods have been proposed. However, most existing schemes embed information into numerical attributes through slight perturbations, which are difficult to extend to categorical attributes whose values are discrete and subject to strict semantic constraints. To overcome this limitation, we propose a novel and robust database watermarking scheme designed for categorical data in relational databases. It employs mutual information to quantify inter-attribute dependency strength and embeds watermarks via semantically consistent substitutions under the joint distribution constraints of the k most relevant attributes associated with each target attribute. This design preserves attribute-level semantic consistency while effectively minimizing data utility loss. Experimental results on real-world datasets demonstrate that the proposed scheme exhibits strong robustness against various attack scenarios, while exerting negligible influence on the performance of downstream classification tasks and exhibiting high efficiency. These findings indicate that our method provides a reliable mechanism for copyright verification and traceability in databases containing categorical attributes.

Graph data has emerged as a critical resource due to its rich structural and semantic information. Anonymization is essential for preventing node re-identification during graph data sharing or publishing. Different users have diverse privacy requirements, motivating research on personalized anonymization. In practice, multiple data analysts may demand different levels of privacy protection for the same graph, requiring regeneration of anonymized graphs for distinct privacy requirements. Existing personalized anonymization methods suffer from high computational overhead when supporting diverse, scenario-specific requirements. To address this inefficiency, we formulate a personalized k2-anonymity model to protect both node degrees and attribute information. Then we design a Hierarchical Personalized Graph Anonymization (HPGA) algorithm to efficiently generate multi-scenario anonymized graphs under varying privacy requirements. HPGA constructs a reusable hierarchical structure and incorporates an efficient privacy requirement matching mechanism for anonymization. It applies edge modification and attribute generalization strategies to generate anonymized graphs. Experimental results on real-world datasets show that HPGA significantly reduces 99% computation time compared to the existing method. In addition, HPGA maintains good data utility.

Sharing relational databases is essential in today's data-driven world for fostering collaboration, enhancing efficiency, and enabling real-time data access. However, privacy and copyright issues arise when sharing privacy-sensitive or valuable data. Additionally, high utility is required in shared data to enable accurate data mining and analysis. Entry-level differentially private fingerprinting schemes (DPFS) could address these concerns. In a DPFS, data can be securely shared without leaking original values while still supporting accurate analysis. Moreover, detectable fingerprints can deter unauthorized redistribution. However, existing DPFSs often lack utility-due to format changes and entry-wise bias-or robustness, as fingerprints can be removed undetected. In this paper, we propose an unbiased and robust differential privacy-based fingerprinting scheme (DPFS), which ensures that the fingerprinted copy remains an unbiased estimate of the original data. By incorporating differential privacy noise, our scheme effectively mitigates alteration, collusion, and hybrid attacks. Our DPFS satisfies is an element of-entry-level differential privacy, enabling clients to conduct unbiased analysis. To improve robustness, we design group-based fingerprint detection, which estimates the mean of injected noise per group with error tolerance. We provide a theoretical robustness analysis and propose a method for achieving optimal robustness. Experiments on four real-world databases show that our scheme consistently detects fingerprints and improves accuracy by up to 20% on machine learning tasks compared to existing DPFSs.

Federated fine-tuning of Large Language Models (LLMs) faces significant challenges due to system heterogeneity across participating clients. While existing heterogeneous Low-Rank Adaptation (LoRA) methods attempt to address resource disparities by allocating variable ranks, they typically rely on zero-padding and truncation strategies. These approaches often suffer from aggregation noise and computational inefficiency. To overcome these limitations, we propose ProRes-LoRA, a Progressive Orthogonal Residual Decomposition framework. Unlike traditional dimension alignment approaches, ProRes-LoRA reformulates heterogeneous aggregation as a sequence of homogeneous residual learning subproblems. The training process is decoupled into two stages: "universal skeleton knowledge" and "refined texture learning". This mechanism effectively eliminates the optimization instability induced by sparse gradients in zero-padding and ensures feature space non-redundancy via orthogonal regularization. Extensive experiments demonstrate that ProRes-LoRA matches or exceeds the performance of HetLoRA while significantly reducing communication and computational overhead, achieving a 65.5% reduction compared to HetLoRA and 93.7% against FLoRA.

Fully homomorphic encryption (FHE) supports privacy-preserving machine learning (PPML) by enabling computation on encrypted data in distributed environments such as cloud computing. However, practical deployment is challenged by high computational costs and limited parallelism, where a single multiplication may require millions of unit operations. At the core of polynomial multiplication in lattice-based cryptography lies the Number Theoretic Transform (NTT). To address this bottleneck, we propose a multiplier-free NTT scheme based on a Fermat-number modulus, which replaces multiplications with shift operations. We further introduce an optimized radix-4 butterfly architecture to accelerate Fermat-NTT computation. On-chip and off-chip memory optimization and data reuse strategies are incorporated to improve throughput for encrypted polynomial multiplication. The design was assessed on an Xilinx Alveo U55C FPGA using a pre-trained MNIST CNN, achieving significant speed-ups of 1029.6× over a CPU and 8× over a GPU compared to state-of-the-art implementations.

As a foundational primitive for collaborative computing, Dynamic Searchable Symmetric Encryption (DSSE) enables efficient and confidential keyword-based queries and updates over outsourced encrypted data. However, despite extensive cryptographic hardening, leakage-abuse Query Recovery Attacks (QRAs) remain a persistent threat, especially those leveraging volumetric leakages such as response volume and response file volume. In this work, we revisit this long-standing challenge and formalize two new security notions for QRA mitigation in DSSE: (d, ϵ, δ)-privacy and (ϵ, δ)-differential privacy, ensuring native and complete compatibility with dynamic operations. We also present a theorem establishing the connection between the two notions. We then apply these notions to the mitigation of volumetric-leakage-abuse QRAs and develop DVPO: a non-lossy differential volume pattern obfuscation framework for DSSE schemes. DVPO introduces a novel differentially private padding mechanism that effectively mitigates system-wide volumetric leakages, avoiding the dependence on client-side caching and clustering for efficient padding. DVPO provides quantified security guarantees against adversaries with arbitrary background knowledge, as well as a tunable security-overhead trade-off and compatibility with diverse DSSE schemes and leakage suppression mechanisms. We evaluate DVPO against two state-of-the-art padding-based solutions: ShieldDB (Vo et al., TKDE 2023) and SWiSSSE (Gui et al., PETS 2024). Experimental results show that DVPO’s protection is comparable to SWiSSSE’s but with a much lower padding cost, and significantly superior to ShieldDB’s with reduced overhead, which also highlights the practical utility of our proposed security notions.

The rapid development of Diffusion Language Models (DLMs) raises concerns about watermarking for DLM-generated detection. However, existing sequential LLM watermarking cannot be directly applied to DLMs, as DLMs’ generation order is arbitrary. While emerging studies adapt biased LLM watermarking to DLMs by temporarily predicting the watermark prefix, they suffer from degraded quality and unstable watermarking due to bias accumulation and prediction errors. Besides, they cannot carry multi-bit watermarks. In this paper, we propose unbiased multi-bit watermarking for DLMs. We introduce a stability-aware constraint that allows watermarking only in stable contexts and a bit-controlled, unbiased modulation to preserve the original DLM output distribution, achieving stable watermarking with minimal quality impact. To enhance detection robustness, we design a Regret-based Remasking , which grants a “second chance” for unwatermarked tokens to be regenerated. It can seamlessly integrate into DLM inference with no added diffusion steps and latency. Experiments across DLMs and various tasks show that our scheme is effective, achieving superior generation quality compared to baselines while maintaining high detection accuracy and multi-bit capacity. Our code is available here https://github.com/iieSKLCSDsg/UMR.

With the increasing importance of data privacy and security, federated unlearning emerges as a new research field dedicated to ensuring that once specific data is deleted, federated learning models no longer retain or disclose related information. In this paper, we propose a zero-shot federated unlearning scheme, named Jellyfish. It distinguishes itself from conventional federated unlearning frameworks in four key aspects: synthetic data generation, knowledge disentanglement, loss function design, and model repair. To preserve the privacy of forgotten data, we design a zero-shot unlearning mechanism that generates error-minimization noise as proxy data for the data to be forgotten. To maintain model utility, we first propose a knowledge disentanglement mechanism that regularises the output of the final convolutional layer by restricting the number of activated channels for the data to be forgotten and encouraging activation sparsity. Next, we construct a comprehensive loss function that incorporates multiple components, including hard loss, confusion loss, distillation loss, model weight drift loss, gradient harmonization, and gradient masking, to effectively align the learning trajectories of the objectives of “forgetting" and “retaining". Finally, we propose a zero-shot repair mechanism that leverages proxy data to restore model accuracy within acceptable bounds without accessing users' local data. To evaluate the performance of the proposed zero-shot federated unlearning scheme, we conducted comprehensive experiments across diverse settings. The results validate the effectiveness and robustness of the scheme.

Abstract Recent breakthroughs in genome sequencing have revolutionized genetic diagnostics, yet secure sharing of sensitive genomic data remains a critical barrier to clinical collaboration.We address this challenge through Threshold Labeled Private Set Intersection (TLPSI), a novel cryptographic protocol without using computation-heavy homomorphic encryption. enabling confidential diagnostic label exchange between a client with private variants and a server hosting pathogenic variant databases–disclosing labels only when matched variants surpass clinical threshold t. TLPSI integrates three key innovations: threshold-bound label recovery via (t, n)-Shamir sharing, genomic marker protection through VOLE-based oblivious polynomial evaluation, and optimized O(n) complexity operations. Provably secure under the Decisional Diffie–Hellman assumption in semi-honest settings, TLPSI guarantees no leakage of unmatched variants or labels. In BRCA1/2 breast cancer testing, TLPSI processes 65k comparisons in 1.35 s with 53.5% (16-Thread) lower computational overhead than sequential threshold-plus-labeled PSI baselines, confirming clinical readiness. Our source code is available at https://anonymous.4open.science/r/TLPSI-CD5B .

Hyperspectral image (HSI) classification models commonly analyze fixed-size patches or rely on predefined scales in multi-scale approaches. This rigidity prevents them from adaptively selecting the optimal field of view, which varies for different ground objects. To overcome this limitation, this paper proposes a novel HSI classification framework named dynamic scale and graph optimal transport (DSGO). DSGO features two synergistic branches: an adaptive scale vision transformer (AS-ViT) branch and a dynamic graph optimal transport (DGOT) branch. In AS-ViT, which integrates multi-scale information, a learnable scale selector (LSS) dynamically updates the spatial sampling range for each input. The DGOT branch simultaneously learns the optimal graph structure by updating both nodes and their adjacency matrix. To effectively fuse features from these branches and mitigate potential conflicts, DSGO incorporates a dual-channel graph optimal transport module (DGOM). Inspired by domain alignment and graph comparison theory, DGOM facilitates gradual and compatible feature fusion by optimizing cross-domain optimal transport distances between the graph Laplacian matrices of the two branches. Extensive experiments on four benchmark HSI datasets (Pavia University, Houston, Salinas Valley, and Indian Pines) demonstrate that DSGO achieves state-of-the-art performance, with overall accuracies of 99.43%, 98.50%, 99.42 %, and 98.82 %, respectively, representing improvements of about 1-2 % over existing methods. Future work will explore advanced lightweight strategies and structural optimization techniques to enhance the efficiency and deployability of DSGO.

Relational databases are crucial for data publication and dissemination. Database watermarking techniques are applied for copyright protection. However, (i) Key exposure of existing watermarking schemes compromises security by making watermarks visible and vulnerable to removal. (ii) The watermarking scheme frameworks lack the flexibility for multi-party scenarios, restricting their ability to adapt watermark information for diverse tasks. In this paper, we present an asymmetric and robust watermarking scheme called TSALockMark. It supports a many-to-many configuration to allocate multiple keys, facilitates multi-party watermarking detection, supports ownership authentication and approval dissemination, and resists key exposure and malicious attacks. Moreover, we introduce the number control of the least significant bits and particle swarm optimization algorithm to preserve semantics and statistics. Experiments on three real-world datasets demonstrate the proposed scheme’s functionality, robustness, and performance, offering effective solutions to data dissemination challenges.

Federated learning decentralizes the training process across clients, allowing clients that do not trust each other to collaboratively train machine learning models without sharing private local data. However, this decentralized approach makes federated learning vulnerable to Poisoning Attacks. Recently, some studies have proposed a new paradigm called Federated Rank Learning (FRL), which uses ranking updates instead of parameter or gradient updates in federated learning. This change transforms the space of updates from continuous to discrete, making the federated learning framework more robust to poisoning attacks.However, we found that some simple and direct poisoning attack methods can easily cause FRL to fail to converge, contrary to the intuition that reducing the update space should limit attackers. This led us to re-examine the security of FRL. We first analyzed the robustness guarantees of FRL and confirmed its vulnerability to poisoning attacks from both theoretical and experimental perspectives. Next, we revisited the impact of changing the update space from continuous to discrete in the framework and found that the advantage of this change does not lie in directly defending against poisoning attacks, but in greatly limiting the attacker’s ability to implement stealthy poisoning attacks. Based on this, we added appropriate defense strategies to FRL, further shrinking the discrete update space into a secure range, and limiting the effectiveness and stealthiness of attacks. Experiments show that this approach significantly improves the ability of FRL to resist poisoning attacks.