Accurate computer-aided diagnosis of pediatric pneumonia remains challenging due to limited annotated data. To systematically address this challenge, a spatially transformed and adversarially realigned vision transformer (STAR-ViT) is proposed. STAR-ViT integrates spatial transformation consistency and adversarial cross-modal realignment within a single architecture. The spatial transformation module enforces feature consistency under random perturbations to enhance translation robustness, while the adversarial realignment module employs a domain discriminator to extract modality-invariant features and achieve implicit alignment between CT and X-ray images, thereby improving cross-modal generalization. During STAR-ViT training, a task-coordinated modulation (TCM) module is incorporated to stabilize multi-objective encoder optimization by dynamically adjusting task-specific optimization strengths on the shared encoder. Besides, to explicitly separate disease-related features from confounding variations, a causal feature modeling component is introduced, enabling more reliable and semantically meaningful representation learning. Experimental results show that STAR-ViT achieves an accuracy of 92.07% on a private CT dataset for pediatric pneumonia pathogen classification and 97.86% on the public ChestXRay2017 dataset for normal, bacterial pneumonia, and viral pneumonia classification, outperforming representative state-of-the-art methods.

Internet of Things (IoT) networks operate with limited defensive resources, necessitating strategic resource allocation to minimize deployment costs while ensuring robust security. However, existing defense schemes frequently ignore the heterogeneous criticality of the data stored on individual network nodes. To address these limitations, this paper proposes Draco, a prioritized defense resource allocation scheme based on Combinatorial Multi-Armed Bandits (CMAB). Unlike static defense schemes, Draco adapts to uncertain attack patterns by online learning of near-optimal resource allocation strategies. First, Draco leverages network topological characteristics to adaptively determine the defense resource threshold for each node. Second, we formulate the allocation problem as a CMAB optimization problem whose objective explicitly balances reward maximization and node criticality. Theoretical analysis establishes sublinear regret bounds for Draco under this objective, expressed as a weighted sum of Lipschitz-continuous reward functions. Finally, we conduct a set of experiments to evaluate the performance of the proposed scheme. The results indicate that, on the tested topologies, Draco can provide an effective resource allocation strategy, capable of protecting high-priority nodes under dynamic environments while maximizing the defender’s expected benefits.

With the widespread adoption of the Internet of Drones (IoD) in sectors such as logistics, power, and agriculture, its impact is steadily extending to economic, social, and technological domains, thereby accelerating the development of the low-altitude economy and low-altitude networking. However, in these application scenarios, a large volume of sensitive data must be transmitted over open or insecure wireless channels, exposing IoD to severe security and privacy threats, including key leakage, identity forgery, and physical tampering attacks. Moreover, the inherent limitations of drones in terms of computational and communication resources render conventional security mechanisms based on computationally expensive public-key cryptography impractical for low-altitude networking environments. To address these challenges, this paper proposes a lightweight and efficient intra/inter-domain authentication scheme tailored for low-altitude networks. The proposed scheme integrates fractional-order Chebyshev chaotic maps, physically unclonable functions with error-correcting code, and hash functions to achieve mutual authentication and session key establishment within a domain. Furthermore, a proxy-based credential conversion mechanism is introduced to enhance inter-domain authentication efficiency while significantly reducing the storage burden on drones. Security analysis demonstrates that the scheme can withstand various common attacks, while performance evaluation further validates its advantages in reducing computational and communication overhead.

Existing transfer-based adversarial attacks suffer from poor transferability due to limitations of the proxy dataset or inaccurate imitation of the target model by the substitute model. Thus, we propose a theft model-based black-box adversarial attack in embedding space. The substitute model acts as the discriminator of the generative adversarial network, and we introduce a diversity loss to train the generator without relying on a proxy dataset, enabling it to imitate the target model better. Furthermore, we design a combined adversarial attack method that integrates the gradient-based attack and natural evolution strategy to construct adversarial examples in the embedding space search. This ensures that the adversarial examples are compelling on both the target and the substitute models. Experimental results demonstrate that our method has good imitation ability and transferability. When using VGG16, OUR outperforms TREMBA by 14.71% in un-targeted attack success rate and shows a 13.49% improvement in targeted attacks.

Due to the distributed training framework, FL is vulnerable to backdoor attacks from malicious clients. However existing backdoor attack methods have insufficient attack success rates at low attack frequencies, and the attack effects are difficult to sustain. Therefore, we propose a novel backdoor attack method in FL, named Datura. Datura firstly utilizes adversarial samples to obtain the global prediction model. It then leverages the softmax probability vector to design a trigger generation loss to optimize pattern and mask, creating a highly adaptable trigger. This stage makes it possible to achieve a high attack success rate with minimal attack frequencies. Secondly, in order to obtain the durable high attack success rate, Datura leverages the decentralization of model updates and introduces a layered poisoning strategy based on the redundancy of the model parameters, applying ‘heavy poisoning’ to parameters with high redundancy and ‘light poisoning’ to the rest. We compare Datura with five representative backdoor attack methods on six datasets. Detailed experimental results demonstrate that Datura achieves an attack success rate exceeding 95% with just 1 - 2 attack frequencies, defeating the six defense methods. The 90%-Lifespan of backdoors implanted by Datura reaches an average of 845 rounds after the attack stops.

Considering the clinical significance of brain tumor segmentation and the challenge of annotation scarcity, a self-supervised learning framework combining anatomical symmetry and cross-modal feature transfer (AnaCoMT+) is proposed. AnaCoMT+ innovatively integrates masked autoencoder and contrastive learning, which can extract biological structural features from annotated MRI images through a decoupled training strategy. AnaCoMT+ consists of a representation learning-based encoder, a self-supervised reconstruction head, a self-supervised projection head and a supervised segmentation head. The reconstruction head is employed to conduct cross-modal image reconstruction, thereby extracting the coordinated representations of multimodal images. The projection head is responsible for performing comparative learning of healthy brain regions and tumor regions, thereby enabling the model to focus on the feature expression of lesion areas. The novel design effectively resolves key limitations in current methods: (1) misalignment between pre-training targets and segmentation objectives, and (2) insufficient feature representation in semi-/self-supervised paradigms. Besides, in the construction of AnaCoMT+, in order to integrate and utilize multi-scale features, a multi-scale attention block (MSAB) and a hybrid attention block (HAB) are proposed, further improving the accuracy of brain tumor segmentation. Experimental results on the Brats 2019 dataset show that AnaCoMT+ can obtain an average Dice coefficient of 0.84, which is better than the existing methods.

Ranking a given set of items is a fundamental problem with widespread applications in information retrieval, recommendation systems, and beyond. Crowdsensing data trading (CDT) systems provide an effective means to collect opinions from distributed workers for ranking tasks. However, these systems face several challenges, including preserving privacy, maintaining ranking accuracy, optimizing worker participation, and ensuring incentive compatibility for all stakeholders. To address these challenges, we propose OPAR-IC, an integrated framework designed to enhance efficiency and privacy in CDT systems. The proposed framework integrates a multi-armed bandit (MAB) based approach to dynamically adjust ranking granularity, a hybrid privacy-preserving mechanism combining logarithmic and binary methods to safeguard worker data, and a combinatorial MAB model for efficient worker recruitment. To enhance worker participation and ensure incentive compatibility among all stakeholders, we integrate a hierarchical Stackelberg game into the framework, balancing competing incentives and achieving equilibrium. Our approach is thoroughly validated through theoretical analysis, offering theoretical guarantees for privacy, ranking accuracy, worker participation, and incentive compatibility. Extensive experiments on real-world datasets demonstrate significant improvements in adaptive ranking accuracy, privacy preservation, worker recruitment, and three-party incentive compatibility.

Federated learning often suffers from severe performance degradation and unstable convergence when clients' data are highly non-independent and non-identically distributed. This paper proposes Clustered Federated Learning with Label Semantics (LSCFL), which constructs semantic client identity vectors from label information and performs clustering to form groups of clients with similar data distributions. Clustering is carried out in a pre-training stage based solely on these identity vectors, without requiring a pre-specified number of clusters or access to model parameters or gradients. Experiments under two challenging non-IID settings show that LSCFL accurately recovers latent client clusters, and outperforms baselines significantly on complex tasks with accuracy gains ranging from 0.61% to 59.23%. Furthermore, LSCFL maintains computational time comparable to FedAvg, reduces per-round training time by 3.45% to 53.18% compared to other non-IID FL methods, and remains robust with increased local steps. We further provide an optional differential privacy mechanism, in which adding Gaussian noise to client identity vectors offers tunable privacy levels, making LSCFL suitable for privacy-sensitive applications.

Black-box adversarial attacks on single object tracking face several inherent challenges. Generating effective perturbations often requires multiple queries to the victim model, which is impractical in real-world scenarios due to bandwidth and real-time constraints. Moreover, perturbations crafted on specific surrogate models tend to overfit, resulting in poor generalization across different trackers and datasets. To address these limitations, we propose a Local Cross-Modal Collaborative (LCMC) black-box adversarial attack that enhances attack effectiveness while maintaining zero-query access to the victim model. Specifically, an adaptive fusion strategy is designed to perturb video frames by modifying multi-layer intermediate feature representations across multiple image models, thereby degrading the victim model’s ability to extract discriminative features. In addition, a local temporal decoupling mechanism is introduced to weaken frame-wise similarity and efficiently disrupt short-term temporal consistency. Extensive experiments demonstrate that our method achieves state-of-the-art performance in zero-query adversarial attacks, exhibiting high attack efficiency and strong cross-model generalization. Evaluations on six benchmark datasets show that our approach outperforms four leading black-box attack methods in perturbation generation efficiency without querying the victim model. Notably, on the NFS30 dataset, our method reduces success rate by 55.5% and precision by 57.8%, and generalizes effectively across five widely used SOT models.

Deep learning-based intelligent diagnosis of melanoma in dermoscopic images remains challenging because melanoma is a rare disease, resulting in few available samples and pronounced class imbalance. To address this problem, an adversarial diffusion network (AdveDiffNet) based on adversarial learning and diffusion learning is proposed in this paper. AdveDiffNet uses EfficientNet as the backbone network, which is mainly composed of a diffusion network (Diffu-Net), a color generative adversarial network (Color-GAN), and a classification network (Class-Net). In AdveDiffNet, Diffu-Net is used to generate minority class (melanoma) samples and expand the feature space of melanoma class, which is conducive to suppressing the prediction attribute deviation problem under class imbalance condition. Color-GAN is used to colorize gray dermoscopic images to enhance the feature extraction accuracy of the encoder under small sample condition. Class-Net is a binary-classification model used to identify melanoma. In order to achieve the feature regularization, Class-Net and Color-GAN are designed to share an encoderand accept the information gain transmitted from the encoder of Diffu-Net, which is beneficial to enhance the classification accuracy of Class-Net. Moreover, AdveDiffNet can achieve end-to-end training through collaborative learning of Diffu-Net, Color-GAN and Class-Net. The binary classification experimental results on the public ISIC 2019 dataset show that, without conventional offline data augmentation, AdveDiffNet can achieve an accuracy of 88.28% and an f1score of 0.657.

Existing personalized federated learning methods struggle with non-IID data due to their limited adaptability in client model aggregation. Most approaches either rely on simplistic global-local model combinations or static layer partitioning, failing to capture the complex relationships between clients’ data distributions and model parameters. To overcome these limitations, we propose FedACo, an adaptive federated learning framework that introduces three key innovations: First, a dynamic multi-criteria weighting system that automatically balances parameter similarity, data distribution overlap, and sample size differences during model aggregation. Second, a hierarchical parameter adaptation strategy where early network layers maintain global knowledge while deeper layers progressively specialize for client-specific patterns through intelligent parameter blending. Third, an optimized training objective that jointly preserves model stability and personalization. Experimental results on four benchmarks demonstrate FedACo’s superiority over ten state-of-the-art methods, showing consistent improvements in accuracy. The framework’s design effectively addresses critical limitations in current approaches while maintaining practical deployment feasibility. In addition, the code will be made public after it is accepted.

Graph backdoor attacks can significantly degrade the performance of graph neural networks (GNNs). Specifically, during the training phase, graph backdoor attacks inject triggers and target class labels into poisoned nodes to create a backdoored GNN. During the testing phase, triggers are added to target nodes, causing them to be misclassified as the target class. However, existing graph backdoor attacks lack sufficient imperceptibility and can be easily resisted by random edge dropping-based defense, limiting their effectiveness. To address these issues, we propose Dual Triggers Graph Backdoor Attack (DTGBA). Initially, we deploy an imperceptible injected trigger generator and multiple discriminators, driving the imperceptibility of the injected triggers through adversarial game between them. Additionally, we introduce a feature mask learner to extract the high-impact and low-impact feature dimensions of the target class's nodes, and then create feature-based triggers by modifying the key feature dimensions of poisoned/target nodes, ensuring that the backdoor implantation can still be effective even if the injected triggers are removed by random edge dropping. Finally, we conduct extensive experiments to demonstrate that DTGBA achieves superior performance. Our code is available at https://github.com/SnowStone-DingLi/DTGBA-main.

Using hyperscale surveillance cameras, seamless target tracking can be accomplished in urban security scenarios, significantly enhancing public security and emergency response capabilities. In spite of the advantage of edge computing, tracking multiple targets using multiple cameras would incur prohibitive high computation costs. Based on the deployment of real-world cameras, this research finds that existing tracking scheduling is inefficient as a result of redundant and excessive activation of cameras. As a follow-up, the research proposes a hierarchical tracking framework called CityTrac that leverages fine-grained target movement predictions to provide efficient tracking in hyperscale cameras. First, CityTrac uses a specially designed camera selection strategy that ensures accurate tracking with a minimum number of cameras. After that, CityTrac constructs a probabilistic target movement graph by using historical tempo-spatial correlation information. Using the graph as a model, the tracking scheduling and camera selection problem are formulated as an optimization problem with efficiency-accuracy tradeoff constraints. The research addresses this NP-hard problem using greedy optimization. The experiments conducted with the Cityflow and Geolife datasets demonstrate that, compared with two baselines, CityTrac requires significantly fewer computation resources (over 90%) in order to track the same number of targets with the same level of accuracy.

Dynamic graph neural networks (DGNNs) have achieved excellent performance in various real-world applications. However, the intrinsic vulnerability of DGNNs cannot be ignored, and the addition of small perturbations to the model can degrade model performance significantly. The existing attack methods against graph neural network focus on static graph field, and the direct migration to the dynamic graph is poor. In this paper, we focus on dynamic graph neural networks and first propose the Topological Vulnerability-based Node Injection Attack against Dynamic Graph Neural Network, named TVIA. TVIA firstly uses the interval selection method to locate the target moment and allocate the injection budget. Secondly, the topological vulnerability edge selection strategy is designed to determine the target nodes. Finally, a smoothing mapping function is introduced to generate adversarial features. In particular, we propose a Dynamic Homogeneity Constraint, named DHC. DHC further improves the imperceptibility of TVIA by regularizing the homogeneity distribution shift. Experiments show that when injecting only 1% of the total number of nodes into the graph, TVIA decreased the target DGNN link prediction Recall by 13.8%. In addition, TVIA combined with DHC decreases the amount of integral change to the original graph homogeneity distribution curve by 12%.

Split Federated Learning (SFL) enables organizations such as healthcare to collaborate to improve model performance without sharing private data. However, SFL is currently susceptible to model inversion (MI) attacks, which create a serious problem of risk for private data leakage and loss of accuracy. Therefore, this paper proposes an innovative framework called Knowledge Distillation Resistance Transfer for Split Federated Learning (KDRSFL). The KDRSFL framework combines one-shot distillation techniques with adjustment strategies optimized for attackers, aiming to achieve knowledge distillation-based resistance transfer. KDRSFL enhances the classification accuracy of feature extractors and strengthens their resistance to adversarial attacks. First, a teacher model with strong resistance to MI attacks is constructed, and then this capability is transferred to the client models through knowledge distillation. Second, the defense of the client models is further strengthened through attacker-aware training. Finally, the client models achieve effective defense against MI through local training. Detailed experimental validation shows that KDRSFL performs well against MI attacks on the CIFAR100 dataset. KDRSFL achieved a reconstruction mean squared error (MSE) of 0.058 while maintaining a model accuracy of 67.4% for the VGG11 model. KDRSFL represents a 16% improvement in MI attack error rate over ResSFL, with only 0.1% accuracy loss.

Graph neural networks (GNNs) have achieved impressive results in various graph learning tasks. Backdoor attacks pose a significant threat to GNNs, with a focus on dirty-label attacks. However, these attacks often necessitate the inclusion of blatantly incorrect inputs into the training set, rendering them easily detectable through simple filtering. In response to this challenge, we introduce Clean-Label Graph Backdoor Attack (CGBA). The majority of features in the generated poisoned nodes align with their true labels, significantly enhancing the difficulty of detecting the attack. Firstly, leveraging the uncertainty inherent in the GNNs, we develop a low-budget strategy for selecting poisoned nodes. This approach focuses on nodes in the target class with uncertain and low-degree classifications, allowing for efficient attacks within a limited budget while mitigating the impact on other clean nodes. Secondly, we present an innovative strategy for generating feature triggers. By boosting the confidence of poisoned samples in the target class, this tactic establishes a robust association between the trigger and the target class, even without modifying the labels of poisoned nodes. Additionally, we incorporate two constraints to reduce disruption to the graph structure. In conclusion, comprehensive experimental results unequivocally showcase CGBA's exceptional attack performance across three benchmark datasets and four GNNs models. Notably, the attack targeting the GraphSAGE model attains a 100% success rate, accompanied by a marginal benign accuracy drop of no more than 0.5%.

Graph Neural Networks (GNNs) have been widely used in multiple fields, but they exhibit vulnerable performance when faced with adversarial attacks. Therefore, researching more robust GNN defenses has garnered widespread attention. However, existing GNN defenses ignore the inherent contradiction between increasing the knowledge domain of GNNs and enhancing the uniqueness of embeddings, which leads to the suboptimal robustness of GNNs. To address these limitations, we propose a multi-graph and dual-view adversarial defense for GNNs, called Graph Optimization of Latent Distance (GOLD). Initially, from the mutual information perspective, GOLD utilizes a multi-graph generator to produce multiple graphs with different semantics, namely modified graph, damaged graph (with corrupt-semantic) and refined graph (with unique- semantic). Next, using local-view information bottleneck and global-view link reconstruction, GOLD forms a dual-view contrastive loss, and then optimizes the latent embeddings. Through iterative execution of the above process, GOLD extends the knowledge domain of GNNs and enhances the uniqueness of embeddings, thus improving the robustness of GNNs. Ultimately, we validate the effectiveness of GOLD through extensive experiments, demonstrating its superior performance across three benchmark datasets and four large-scale attack scenarios.

Speaker recognition models are now widely used in daily life, with their precise recognition capabilities being applied extensively in identity recognition tasks. Recent studies have demonstrated that speaker recognition models are vulnerable to adversarial attacks, which raise significant security concerns. However, these threats have primarily been explored within the white-box attack domain, leaving a gap in the research on black-box attacks. In this paper, we propose a universal adversarial perturbation for black-box scenarios that can generate a single perturbation applicable to a wide range of attacker audio inputs, causing misclassification in speaker recognition models even with limited model information. Specifically, we employ an optimization-based method to generate adversarial examples, introducing constraints on the adversarial perturbation’s confidence and maximum distortion to balance its effectiveness and imperceptibility. Additionally, we present a novel threshold estimation algorithm to estimate the unknown model thresholds in open-set identification (OSI) tasks and speaker verification (SV) tasks. We attacked state-of-the-art models, and extensive experimental results demonstrate that our proposed black-box universal perturbation exhibits strong attack capabilities, with excellent generalization that significantly enhances attack efficiency.

With the development of the Internet of Things (IoT), Federated Learning (FL) is extensively employed in smart cities and industrial IoT, involving numerous heterogeneous devices with varying computational and storage capabilities. Traditional FL assumes that clients have enough resources to train a unified global model from the beginning to the end of training. However, it ignores the problem of uneven and real-time changes in client resources. Additionally, there are aggregation difficulties between heterogeneous client models and global model. To address these challenges, we propose an Adaptive Federated Learning Framework for Heterogeneous Devices (AdaptFL). In AdaptFL, we employ a resource-aware neural architecture search method, which searches for models based on each client’s resource conditions. It enables AdaptFL to automatically assign customized models tailored to each client’s specific resource conditions in the current round. Additionally, we employ a staged knowledge distillation strategy to facilitate efficient distribution and aggregation between the heterogeneous global model and the client models. Experimental results demonstrate that, compared to state-of-the-art model-level heterogeneous ablation methods, AdaptFL improves global test accuracy by 4% to 15% on the SVHN dataset and enhances accuracy by 5% to 14% in scenarios with heterogeneous data. Additionally, AdaptFL effectively reduces communication overhead by over 50% across all datasets. Furthermore, it offers a degree of resilience against model poisoning attacks.

large language models (LLMs), with their powerful natural language processing capabilities, can provide more advanced intelligent services for edge devices. However, deploying LLMs at the edge is vulnerable to jailbreak attacks, which can cause the model to generate unsafe content. Meanwhile, current jailbreak attack schemes are inefficient in generating highly stealthy jailbreak prompts. To address this, we propose a fast and controllable bias-guided jailbreak attack (FCB) scheme. First, to improve attack efficiency, we optimize the bias of the model's output layer to guide the model in generating low-energy jailbreak prompts by directly adjusting the output layer's logits, thereby accelerating the decoding process. Second, to enhance the stealthiness of the generated jailbreak prompts, we design token stop selection and bias normalization methods to constrain the perturbations during the iterative process, preventing the generation of jailbreak prompts without meaningful semantics. Finally, extensive experimental results demonstrate that FCB can generate highly stealthy jailbreak prompts within a short time. Specifically, compared to the current state-of-the-art controllable attack generation scheme, COLD Attack, FCB achieves up to a 8% improvement in attack success rate, reduces perplexity by up to 181.171, and shortens generation time by as much as 28 s.