Near-duplicate image matching is crucial for trust and safety, provenance verification, copyright enforcement, and large-scale visual search. Modern platforms increasingly rely on deep perceptual hashes, which map visually similar images to nearby representations despite common image transformations. However, adversarial perturbations can cause near-duplicates to evade matching. We present DualShield, a plug-in defense that improves the robustness of existing deep perceptual hashes without retraining or modifying their underlying models. DualShield combines matching-time randomized smoothing, which aggregates decisions over perturbed reference-query pairs, with publication-time hardening, which adds an optimized imperceptible perturbation to each reference image before publication. Together, these mechanisms provide certified and empirical robustness. DualShield achieves a certified ℓ_2 radius of approximately 0.3, guaranteeing that query perturbations within this radius cannot evade matching. We further evaluate it against adaptive white-box, black-box, and image-transformation attacks. Across eight deep perceptual hashes and three datasets, DualShield substantially reduces attack success rates while preserving low collision rates. These results show that deep perceptual hashes can be strengthened without costly retraining by improving the matching procedure and hardening reference images before publication.

Unauthorized reuse of digital artworks and creative content has become a widespread concern on social media and content-sharing platforms, where copyrighted images are copied, intentionally modified, and redistributed without permission. Billions of images are estimated to be stolen each day. To protect creators, copyright monitoring services use nearduplicate matching techniques, such as perceptual hashing, to detect unauthorized reuse despite modifications. However, existing approaches remain vulnerable to adversarial perturbations, allowing unauthorized reuse to evade copyright detection and undermining the reliability of monitoring services. A recent defense, CertPHash, aims to enhance adversarial robustness, but for DCT-based perceptual hashing it offers limited robustness gains while substantially reducing hash-bit utilization, which may increase collision risk when operating at scale. This limitation likely arises because CertPHash applies a generic learning-based approach across different perceptual hashing schemes, rather than accounting for the design-specific weaknesses of DCT-based perceptual hashing. In this work, we identify the root cause that makes DCT-based perceptual hashing susceptible to adversarial perturbations, and propose RD-PHash, a robustness enhancement tailored to DCT-based hashes. Our experiments show that, for DCT-based hashes such as pHash and PDQ, RD-PHash outperforms CertPHash in both hash-bit utilization and adversarial robustness, achieving up to $2.3 \times$ higher utilization while reducing the impact of existing adversarial attacks by up to 71%.

Watermarks are increasingly embedded in AI-generated images to indicate their machine-generated origin. For reliable detection, watermarks are designed to remain robust against common image manipulations such as resizing and compression. In this paper, we uncover a previously overlooked vulnerability: the robustness property of watermarking schemes can inadvertently expose the image features that carry watermark signals. Exploiting this vulnerability, we introduce WRATH, the first watermark-agnostic black-box attack capable of both watermark removal and forgery. Our attack is practical and requires only a scheme's robustness information, which is typically public or can be obtained through simple robustness tests. When evaluated against state-of-theart watermarking schemes, including Amazon's, WRATH successfully attacks all evaluated schemes while preserving high perceptual image quality. We also discuss practical defenses to mitigate this vulnerability, and our findings call for a rethink of watermark security.

As digital drawings are increasingly shared online, reliable authorship verification has become important for protecting artists and resolving disputes. Yet when authorship is questioned, verification may have to rely only on the disputed drawing and reference drawings known to be created by the claimed artist. This setting is challenging for two reasons. First, artist-specific drawing behavior, such as pen pressure and movement speed, is informative but is not available from a completed drawing. Second, similarities in the depicted object or scene can obscure similarities arising from the artist. We propose IDraw, a framework that learns from drawings paired with tablet-pen sensor signals collected from separate training artists. This allows IDraw to infer drawing behavior from completed images during a later authorship dispute, without requiring sensor data from the artist being verified. IDraw also reduces the influence of drawing content by identifying information shared by drawings of the same object across different artists and suppressing it before comparing drawings. To support this approach, we construct the first multimodal dataset for digital drawing authorship verification, containing 1,110 drawings from 37 artists and 14 types of tablet-pen sensor signals. Evaluated on previously unseen artists across nine image-encoder backbones, IDraw consistently outperforms standard image-based verification and reduces verification error by up to 40

Photo sharing is increasingly popular, driven by social media platforms like Instagram and services such as Flickr and Google Photos. However, this growth has been accompanied by significant issues, particularly image theft. To address this issue, we introduce CAMPrints, a robust system for detecting image theft. CAMPrints verifies whether edited images found online contain camera fingerprints matching those of user-provided reference images. The system overcomes the challenges of identifying images altered by diverse image processing operations. We select a small yet representative set of operations by categorizing them based on their impact on pixel values and locations. A deep-learning model is trained to recognize and compare camera noise patterns pre- and post-editing. We conduct real-world evaluations involving 36 cameras across eight make-and-model combinations, along with over 40 image processing operations applied to more than 4,000 images. CAMPrints achieves an average AUC of 0.92, significantly outperforming the state-of-the-art methods by up to 1.8 times.

With the rise of mobile technologies such as augmented and virtual reality (AR/VR) and wearables, as well as smart TVs, the large form factor of traditional keyboards is becoming increasingly impractical. Sensing typing on surfaces offers a potential alternative, but most current solutions rely on either expensive, custom hardware or extensive user bootstrapping and calibration. In this paper, we envision Unikey, an approach to surface-based typing that uses only a commodity smartwatch to detect finger taps on a flat surface. By seamlessly adapting to the user’s existing typing habits on conventional keyboards, Unikey eliminates the need for both specialized equipment and burdensome sensor data collection, reducing overhead for users. To demonstrate the feasibility of our approach, we implement a proof-of-concept and evaluate our technique with comprehensive real-world experiments under varying conditions. Participants were invited to type while wearing smartwatches, resulting in over 2,700 minutes of recorded typing. Our experiments show that Unikey can achieve an equivalent average top-5 word error rate of 6.45%, indicating a potential solution simple, everyday text-entry tasks.

Autoencoder model architectures are attractive approaches for implementing intelligent mobile/IoT sensing applications. This is attributed to their capability of offering efficient codings of input data, which form the basis of efficient collaborative inference systems. In this work, we present a pair of novel attacks that threaten the security of collaborative unpooling-based autoencoder systems. We first demonstrate a reconstruction attack where the attacker exploits the autoencoder model’s indices to reconstruct the original input (by hijacking the autoencoder’s index transmissions between a local sensing platform and a remote server). We also demonstrate an adversarial attack where the attacker maliciously alters the index to output inaccurate inference results. The design of an effective input reconstruction model is a core component in successfully launching these index-based attacks and we show that practical deployment characteristics of mobile/IoT software allow such model design to be possible. Through comprehensive evaluations of three case study applications, we demonstrate the feasibility and effectiveness of the proposed index-based attacks and how they outperform conventional adversarial attack methods.

In recent years, the proliferation of WiFi-connected devices and related research has led to novel techniques of utilizing WiFi as sensors, i.e., capturing human movements through channel state information (CSI) perturbations. While this enables passive occupant sensing, it also introduces privacy risks from leaked WiFi signals that attackers can intercept, leading to threats like occupancy detection, critical in scenarios such as burglaries or stalking. We propose LeakyBeam, a novel and improved occupancy detection attack that leverages a new side channel from WiFi CSI, namely beamforming feedback information (BFI). BFI retains victim's movement information, even when transmitted through walls, and is easily captured since BFI packets are unencrypted, making them a rich source of privacy-sensitive information. Furthermore, we also introduce a defense mechanism that obfuscates BFI packets, requiring minimal hardware changes. We demonstrate LeakyBeam's effectiveness through a comprehensive real-world evaluation at a distance of 20 meters, achieving true positive and negative rates of 82.7% and 96.7%, respectively.

Even seemingly innocuous computer usage information often leads to targeted privacy attacks. In this poster, we present mmProfiler, a novel privacy attack that aims to remotely infer user's running application. mmProfiler leveragesmmWave radar-based vibrometry to capture minute vibration induced by the victim's keystrokes. Captured data is then analyzed to extract keystroke patterns, or keystroke dynamics, used to profile the running application the user is engaged with. Our preliminary experiment demonstrates the potential of mmProfiler, with 84% accuracy in discerning between five user applications.

Physical locks are one of the most prevalent mechanisms for securing objects such as doors. While many of these locks are vulnerable to lock-picking, they are still widely used as lock-picking requires specific training with tailored instruments, and easily raises suspicion. In this paper, we propose SpiKey, a novel attack that significantly lowers the bar for an attacker as opposed to the lock-picking attack, by requiring only the use of a smartphone microphone to infer the shape of victim's key, namely bittings (or cut depths) which form the secret of a key. When a victim inserts his/her key into the lock, the emitted sound is captured by the attacker's microphone. SpiKey leverages the time difference between audible clicks to ultimately infer the bitting information, i.e., shape of the physical key. As a proof-of-concept, we provide a simulation, based on real-world recordings, and demonstrate a significant reduction in search space from a pool of more than 330 thousand keys to three candidate keys for the most frequent case.

The rise in popularity of powdered food products, from dietary supplements to specialized nutritional formulas, is driven by their convenience, cost-effectiveness, and long shelf life. For instance, infant formula, often available in powdered form, is especially important as it is designed to serve as a substitute for breast milk. As a result of these benefits, the global demand for infant formula is projected to grow significantly, with the market value expected to reach approximately 174 billion by 2032 [1].

We present Foice, a novel deepfake attack against voice authentication systems. Foice generates a synthetic voice of the victim from just a single image of the victim's face, without requiring any voice sample. This synthetic voice is realistic enough to fool commercial authentication systems. Since face images are generally easier to obtain than voice samples, Foice effectively makes it easier for an attacker to mount large-scale attacks. The key idea lies in learning the partial correlation between face and voice features, and adding to that a face-independent voice feature sampled from a Gaussian distribution. We demonstrate the effectiveness of Foice with a comprehensive set of real-world experiments involving ten offline participants and an online dataset of 1,029 unique individuals. By evaluating eight state-of-the-art systems, including WeChat's Voiceprint and Microsoft Azure, we show that all these systems are vulnerable to Foice attack.

Continuous monitoring of patients in psychiatric seclusion rooms is essential yet challenging, particularly with staff shortages that can delay responses to sudden changes in patient conditions. To this end, we propose PsiMo, a remote patient state monitoring system using mmWave Frequency Modulated Continuous Wave (FMCW) radar. Unlike existing vision-based or wearable systems, PsiMo captures patient movements without compromising privacy or risking potential self-harm. Our system continuously monitors patient's state of motion to alert medical staff in the event of abnormal conditions, such as agitation. Our preliminary evaluation shows PsiMo achieves 97.0% accuracy in patient state classification, demonstrating its potential for effective, non-contact monitoring.

Visually impaired individuals often struggle to pinpoint their location in indoor settings, hindering their ability to navigate independently. Current solutions, such as WiFi-based localization and smart canes fall short due to interference, high deployment costs, and/or imprecise localization. To address this problem, we propose ImpacTile, a novel tile-level localization system designed specifically for the visually impaired. ImpacTile determines the user's position by analyzing the distinct sound produced when their cane strikes the floor tile leveraging the underlying structural uniqueness. As a proof-of-concept, we present a preliminary evaluation with real-world experiments in three buildings on our campus, encompassing a total of over a thousand tiles to demonstrate an average tile-level localization accuracy of 94.8%.