Text-to-Image (T2I) models have made significant strides in visual realism and semantic consistency, yet they often perpetuate and amplify societal biases. Existing evaluation methods typically address only single-dimensional biases, lacking perspectives to uncover model biases at social-related deeper semantic levels. We introduce HoloFair, a comprehensive benchmark framework for multidimensional demographic bias analysis. Built upon our large-scale fairness-oriented dataset and the SpaFreq (Spatial-Frequency) attribute classifier, this framework proposes the Multi-attribute, Group-wise Bias Index (MGBI) metric, designed to assess both intrinsic diversity and conditional biases. Beyond evaluation, we further introduce Fair-GRPO, a reinforcement-learning-based debiasing method that alters the distribution of generative models through a designed multi-objective reward function. E.g., experiments on the SD3.5-Medium model demonstrate that Fair-GRPO significantly improves multidimensional fairness while maintaining high image quality. We also analyze potential reward hacking phenomena and provide corresponding mitigation strategies.

The extensive adoption of Self-supervised learning (SSL) has led to an increased security threat from backdoor attacks. While existing research has mainly focused on backdoor attacks in image classification, there has been limited exploration of their implications for object detection. Object detection plays a critical role in security-sensitive applications, such as autonomous driving, where backdoor attacks seriously threaten human life and property. In this work, we propose the first backdoor attack designed for object detection tasks in SSL scenarios, called Object Transform Attack (SSL-OTA). SSL-OTA employs a trigger capable of altering predictions of the target object to the desired category, encompassing two attacks: Naive Attack (NA) and Dual-Source Blending Attack (DSBA). NA conducts data poisoning during downstream fine-tuning of the object detector, while DSBA innovatively poisons both the pre-trained encoder (via a shadow dataset) and a minimal subset of the downstream data. Notably, using Faster R-CNN on the PASCAL VOC2007 dataset, our NA achieved an Attack Success Rate (ASR) of 72.56%, while our DSBA reached an ASR of 86.55%. Both results were achieved at an extremely low poisoning rate of 0.5%, and the resulting performance impact on the benign mean Average Precision (mAP) was less than 1%. The results underscore the importance of considering backdoor threats in SSL-based object detection and contribute a novel perspective to the field.

Deep Neural Networks (DNNs) are gradually becoming indispensable in various technological domains. To cater to more deployment backends and increasingly complex model architectures, deep learning compiler-driven efficient compilation modes are becoming essential components of productivity. However, this deployment method exacerbates security risks. Recent studies have shown that attackers can reverse-engineer executable files to regenerate trainable deep learning models, leading to adversarial attacks and other security breaches. Previous research indicates that such attacks pose significant threats, yet progress in implementing cost-effective mitigation strategies remains limited. Existing defense mechanisms primarily focus on Trusted Execution Environments or partial encryption to protect critical model parameters, often at the expense of compiled execution efficiency. To address this gap, we propose a schedule search based operator obfuscation method (SOOM) to defend against model extraction attacks for models compiled and executed on standard CPU and GPU backends, where low latency on device inference is required. SOOM is built on TVM, a deep learning compiler, and constructs a comprehensive obfuscation space for deep learning operators. It leverages a security aware learned cost model based on XGBoost gradient boosted trees to balance security objectives and performance requirements, and ultimately generates obfuscated executable code for various deep learning operators. Extensive experiments covered over 105 operator configurations and more than 30,000 tensor computation test cases. Our method was tested against state-of-the-art model extraction attacks, raising the operator inference failure rate to as high as 89%. We also observe up to approximately 25.4% performance gains in selected cases, while the balanced setting keeps model-level latency overhead within a modest budget.

As artificial intelligence (AI) permeates society, ensuring fairness has become a foundational challenge. However, the field faces a “Babel Tower” dilemma: fairness metrics abound, yet their underlying philosophical assumptions often conflict, hindering unified paradigms—particularly in unified multimodal large language models (UMLLMs), where biases propagate systemically across tasks. To address this, we introduce the IRIS Benchmark, to our knowledge the first benchmark designed to synchronously evaluate the fairness of both the understanding and generation in UMLLMs. Enabled by our high-fidelity demographic classifier, ARES, and four supporting large-scale datasets, the benchmark is designed to normalize and aggregate arbitrary metrics into a high-dimensional “fairness space”, integrating 60 granular metrics across three dimensions—Ideal Fairness, Real-world Fidelity, and Bias Inertia & Steerability (IRIS). Through this benchmark, our evaluation of leading UMLLMs uncovers systemic phenomena such as the “generation gap”, individual inconsistencies like “personality splits”, and the “counter-stereotype reward”, while offering diagnostics to guide the optimization of their fairness capabilities. With its novel and extensible framework, the IRIS benchmark is capable of integrating ever-evolving fairness metrics, ultimately helping to resolve the “Babel Tower” impasse.

Deep learning compilers such as TVM lower neural networks through intermediate representations into optimized, hardware-specific binaries. While enabling high-performance deployment via optimizations, such as operator fusion and loop tiling, they leave stable execution signatures exploitable by reverse engineering. Prior attacks often rely on a single modality, symbolic lifting, instruction classification, or side channels, each struggle under at least one realistic condition, such as deep fusion, schedule diversity, or OS noise. We present SOFAN, a side-channel oriented fingerprinting and neutralization framework for TVM-compiled DNNs. On the attack side, TCS captures timing and cache traces to recover operator boundaries via smoothing, nonmaximum suppression, and dynamic time warping. A multimodal fusion network then integrates these side-channel signals with instruction embeddings to classify deeply fused operators. On the defense side, leakage-aware schedule rewriting (LASR) selectively perturbs critical leakage via schedule diversification, access equalization, and memory remapping, under a fixed runtime budget. Evaluated across CNNs and fusion schedules, SOFAN improves segmentation and recognition over prior baselines. LASR reduces top-1 attack accuracy by up to 24 points (16 on average) under 10%-20% runtime overhead and minimal memory cost. By aligning both attack and defense with compiler boundaries, SOFAN enables practical, budget-aware protection for real-world deployments.

With the rapid development of consumer electronics and the healthcare sector, Healthcare 5.0 has emerged, integrating multiple advanced information technologies to create human-centered systemic healthcare services. Among these technologies, consumer-centric digital twins (CCDTs) provide patients with virtual models, enhancing medical risk management and health guidance, while simultaneously imposing higher requirements on data security and service efficiency. Blockchain addresses this by providing a secure, decentralized framework that eliminates trusted intermediaries. Within this framework, distributed signatures can enable consensus for collaborative multi-party processes to ensure the integrity of medical data, thereby providing a reliable data source for CCDTs in Healthcare 5.0 to a certain extent. However, existing distributed signatures for healthcare systems still struggle with low efficiency and exfiltration attacks. This is due to the unique demands of data-sensitive medical consumer electronics, which necessitate high efficiency to meet strict medical timeliness. To address these challenges, this paper proposes a non-interactive identity-based threshold signature scheme with cryptographic reverse firewalls (CRFs) for CCDTs in Healthcare 5.0 (NI-IBTS-CRF). The scheme eliminates reliance on public key infrastructure via identity-based cryptography and adopts a non-interactive signing paradigm to achieve higher signing efficiency and reduce energy consumption for medical devices. Additionally, the scheme incorporates efficient CRFs that enable fast rerandomization to mitigate exfiltration attacks inherent in existing solutions. Experimental results demonstrate that the CRFs introduce only around 10% additional overhead, while NI-IBTS-CRF still achieves leading signing efficiency compared to existing schemes, thus providing a secure and signing-efficient approach to safeguarding data integrity for CCDTs in Healthcare 5.0.

The rapid spread of large language models has made AI generated text and code increasingly pervasive, which in turn makes reliable attribution and traceability a pressing requirement. Existing watermarking methods are promising, but most rely on retraining, finetuning, or direct control over the model, assumptions that are increasingly unrealistic in the LLM era due to closed commercial deployment and the high cost of model adaptation. In this paper, we present ASLang, a compiler driven watermark injection and detection framework for traceable AI content generation. Instead of modifying the model during training, ASLang binds a keyed watermarking process directly to the compiled decode path, turning deployment compilation itself into an attribution channel from protected artifact to final output. Implemented in TVM, ASLang supports both natural language and code generation under a unified framework, and enables output only verification without requiring access to prompts, logits, or model internals. Experiments on TinyLlama and TinyStories-33 M show that ASLang consistently outperforms representative baselines in detectability on both text and code, while maintaining favorable quality retention, robustness under lightweight post processing, and low deployment overhead. These results demonstrate that compiler stage watermarking is a practical and effective path toward controllable and traceable AI generation.

Self-supervised learning (SSL) models are vulnerable to backdoor attacks. However, the systemic risks they pose in face representation have received little attention. The entanglement of identity features in self-supervised face learning presents unique challenges for attack stealthiness. To address this gap, we propose FIDA (Feature Instability-Driven Attack), a novel backdoor attack framework. FIDA uses subtle semantic triggers for injection, but its key innovation is a novel objective called Feature Instability Loss. It trains the encoder to increase the sensitivity of triggered features along perturbation directions sampled during attack optimization . By preventing the backdoor from exhibiting the rigid feature patterns typical of previous attacks, FIDA effectively evades the evaluated perturbation-based defenses. Experiments show that FIDA achieves a high attack success rate and generally preserves benign utility across the evaluated settings , posing a significant threat to real-world multimedia applications relying on facial analysis.

LLM-based multi-agent systems (MAS) are increasingly considered for high-stakes decision-making, yet outcome-based fairness audits can miss where risks arise within the decision trajectory. We present SCOPED-Hiring, a process-aware fairness diagnosis pipeline for LLM-based hiring MAS. SCOPED-Hiring constructs controlled resume variants, runs role-based hiring committees, logs over 311K structured decision trajectories, and converts trajectory fields into quantitative fairness signals organized by six diagnostic lenses: final outcome, counterfactual, process, pathway, dynamic, and design effects. SCOPED-Hiring reveals that balanced final hire rates can mask hidden trajectory unfairness in multi-agent decision trajectories: career gaps trigger suspicion, proxy cues shape qualification judgments, and identity cues lead to unequal investigation. Targeted repair guided by these diagnoses reduces total layered burden by 72.3

The rapid proliferation of LLM-based autonomous agents in real operating system environments introduces a new category of safety risk beyond content safety: behavior jailbreak, where an adversary induces an agent to execute dangerous OS-level operations with irreversible consequences. Existing benchmarks either evaluate safety at the semantic layer alone, missing physical-layer harms, or fail to isolate test cases, letting earlier runs contaminate later ones. We present LITMUS (LLM-agents In-OS Testing for Measuring Unsafe Subversion), a benchmark addressing both gaps via a semantic-physical dual verification mechanism and OS-level state rollback. LITMUS comprises 819 high-risk test cases organized into one harmful seed subset and six attack-extended subsets covering three adversarial paradigms (jailbreak speaking, skill injection, and entity wrapping), plus a fully automated multi-agent evaluation framework judging behavior at both conversational and OS-level physical layers. Evaluation across frontier agents reveals three findings: (1) current agents lack effective safety awareness, with strong models (e.g., Claude Sonnet 4.6) still executing 40.64% of high-risk operations; (2) agents exhibit pervasive Execution Hallucination (EH), verbally refusing a request while the dangerous operation has already completed at the system level, invisible to every prior semantic-only framework; and (3) skill injection and entity wrapping attacks achieve high success rates, exposing pronounced agent vulnerabilities. LITMUS provides the first standardized platform for reproducible, physically grounded behavioral safety evaluation of LLM agents in real OS environments.

Deep learning compilers such as TVM generate highly optimized binaries, but these transformations also expose structural cues exploitable by reverse-engineering attacks. Existing defenses are difficult to control and offer limited support for balancing security and performance. Motivated by the symbolic reasoning ability of large language models (LLMs), we ask whether LLMs can assist compiler-level obfuscation. However, because schedule obfuscation and kernel-family classification involve intertwined compiler semantics, legality constraints, and experience transfer across kernels, directly exposing raw programs to LLMs often leads to unreliable reasoning, legality violations, and poor generalization across kernels. We therefore design a language-model-friendly Program Representation Language (PRL) that links compiler-side information with LLMs and recasts kernel classification and obfuscation-experience inheritance as a constrained generation task. Our framework, PRLBridge, introduces two abstractions: a kernel-family intermediate that canonically captures legality and structural information, and PRL, a compact grammar-constrained language through which LLMs express candidate transformations. The compiler incrementally verifies generated outputs and deterministically replays legal sentences into schedules. Experiments across four models and ten LLMs show that PRL-based generation consistently improves defense effectiveness, maintains over 97% legality and 100% reproducibility, and substantially reduces compilation cost through verified and reusable schedules.

Compiler toolchains such as TVM are now a standard substrate for deploying deep neural networks, but the optimized executables also expose structures that attackers can leverage. Existing mitigations are commonly applied as global composite defense, which is effective yet costly because it disrupts performance-critical regularity everywhere. We present VulnSketch, the first LLM-driven vulnerability analysis system for compiled DNNs, and introduce an evidence-bounded formulation of vulnerability analysis that is both auditable and actionable. VulnSketch extracts a Minimal Evidence Interface (MEI) from TVM TIR, scores each operator location along three attacker-aligned vulnerability faces (Segmentation, Regularity, and Lifting), and routes only ambiguous gray locations to bounded LLM triage that must cite MEI fields and propose a pre-approved, semantics-preserving schedule knob. Every proposal is executed under compiler-side legality guards and accepted only if a single micro validation confirms the expected one-step movement on the prioritized face. Across five representative attacks, VulnSketch attains strong operator-level overlap at small budgets (top 5% recall 0.71-0.80; top 10% recall 0.84-0.91) and high global ranking quality (AUROC 0.85-0.89; AUPRC 0.51-0.62). Applying micro-validated knobs causally reduces attack success by 33-38% and recovered footprint by 38-40%. Operationally, VulnSketch yields 5.9 seconds amortized per verified note under default gray exposure.

Multi-agent reinforcement learning (MARL) has been widely used in wireless security such as data encryption and authentication, in which each wireless device shares its observed network security status as observations to improve the security policy optimization efficiency. However, the shared observation information during transmission may be wiretapped by inference attackers that can infer the observation from which specific devices, resulting in privacy leakage. In this paper, we propose a privacy-preserving MARL framework for wireless security against a designed attacker who can tamper observations and impersonate legitimate devices to broadcast falsified observations, with a stronger attack ability than typical inference attackers. Therefore, we design an optimized unary encoding (OUE)-based lightweight privacy mechanism for each wireless device to perturb observations before being transmitted to neighboring devices to balance data utility and privacy protection. By incorporating the underlying network status and the perturbed observations shared by other devices, each device owns a policy network that determines the privacy budget used in OUE and the corresponding security policies to maintain security performance as well as prevent privacy leakage against inference attacks. A case study in a multi-agent cargo transportation secure transmission scenario is performed to evaluate the effectiveness of the framework against a decision tree-based inference attacker. Experimental results demonstrate that the proposed framework significantly reduces the attack success rate compared with existing benchmarks.

Current Transferable Adversarial Examples (TAE) are primarily generated by adding Adversarial Noise (AN). Recent studies emphasize the importance of optimizing Data Augmentation (DA) parameters along with AN, which poses a greater threat to real-world AI applications. However, existing DA-based strategies often struggle to find optimal solutions due to the challenging DA search procedure without proper guidance. In this work, we propose a novel DA-based attack algorithm, GADT. GADT identifies suitable DA parameters through iterative antagonism and uses posterior estimates to update AN based on these parameters. We uniquely employ a differentiable DA operation library to identify adversarial DA parameters and introduce a new loss function as a metric during DA optimization. This loss term enhances adversarial effects while preserving the original image content, maintaining attack crypticity. Extensive experiments on public datasets with various networks demonstrate that GADT can be integrated with existing transferable attack methods, updating their DA parameters effectively while retaining their AN formulation strategies. Furthermore, GADT can be utilized in other black-box attack scenarios, e.g., query-based attacks, offering a new avenue to enhance attacks on real-world AI applications in both research and industrial contexts.

Vehicle platoon (VP), as a typical form of traffic cooperation, can significantly enhance traffic efficiency and safety in Vehicular Ad hoc Networks (VANETs). However, malicious vehicles in VP poses a severe threat to the security of entire VP, requiring to be efficiently traced by identity authentication. In this paper, we propose a lattice-based efficient and traceable privacy-preserving batch authentication scheme for vehicle platoon in VANETs, named LETA. First, we design a dynamic VP identity structure VPD-Tree which is constructed based on hash tree and pseudonyms of vehicles to preserve privacy. Then, an aggregate signature is constructed based on VPD-tree and modular lattice for secure and efficient batch authentication of VP. Finally, Zero-Knowledge Proofs (ZKP) is applied on the VPD-Tree structure to anonymously and efficiently trace the malicious vehicles of VP. Security analysis shows that LETA achieves stronger security guarantees, thereby offering a more secure solution than existing approaches. Moreover, performance evaluations show that LETA achieves lower computation and communication overheads through the VPD-tree structure and efficient batch authentication scheme.

The rapid development of blockchain technology has driven the widespread use of smart contracts, but the ensuing security issues have attracted widespread attention. Smart contract vulnerabilities have led to hundreds of millions of dollars of property losses, while existing detection methods are less effective in terms of validity and difficult to effectively explain the causes of vulnerabilities. To this end, this paper proposes a novel Token-Graph model, which extracts function semantic features by pre-training the model and constructs the graph structure by combining the function call relationships. In addition, we trace suspicious functions and their calling relationships to present the risk propagation due to function calls. We compare with 9 vulnerability detection tools on 2,893 contracts. The experimental results show that the Token-Graph model significantly outperforms existing methods in terms of accuracy (86.4

As a promising subdomain of intelligent transportation systems (ITS), Internet of Vehicles (IoV) can be empowered by digital twin (DT) technology for real-time traffic simulation and artificial intelligence (AI)-driven predictive analytics in evolutionary trend projection, demonstrating significant potential in dynamic transportation optimization. Among various machine learning paradigms, federated learning (FL) not only aligns well with IoV, but also provides it with privacy protection. Traditional FL faces single point of failure due to the existence of an aggregation center, so blockchain-based FL with multiple aggregators is utilized to mitigate this issue. Nevertheless, in such distributed environments, both aggregators and model parameters exposed to network are vulnerable to attacks, impeding the normal operation of FL. In this paper, for blockchain-enabled FL with multiple aggregators in IoV, we propose CLTSwNI&IA, the first non-interactive certificateless threshold signature with identifiable abort. This scheme eliminates certificate management and key escrow, adopts a blockchain-oriented approach by utilizing a fully distributed signing paradigm. Additionally, the proposed signing scheme is capable of identifying malicious FL aggregators during the entire process through distributed fine-grained verification and ensuring the integrity of aggregation results. Finally, theoretical and experimental comparisons with related literature demonstrate the advanced functionality and the acceptable efficiency of our approach.

Deep neural networks (DNNs) are widely deployed across applications, but growing model sizes and performance demands on edge devices necessitate aggressive compiler-based acceleration, as enabled by frameworks like TVM. Compiling models into standalone executables, however, introduces new security risks, reverse-engineering these binaries can reveal core architectures and enable unauthorized model cloning or tampering. Existing defenses largely rely on trusted execution or encryption, which target weight confidentiality but fail to protect architectural details or operator attributes, often with high runtime costs. To address these gaps, we propose MACO, a multi-tier obfuscation framework built atop TVM, spanning high-level graph rewriting and low-level IR transformations. MACO integrates three transformation categories: operator attribute obfuscation, memory layout perturbation, and dummy branching, covering the full compilation stack. A tiered design enables flexible trade-offs between security and performance. We evaluate MACO on eight common models and three attack types: side-channel, symbolic execution, and deep learning-based extraction. Results show up to 85.8% reduction in attribute inference success and 99% reduction in topology reconstruction, with the lightest tier incurring only 1.036x overhead over the unobfuscated baseline.

Self-supervised learning (SSL) is demonstrating its powerful learning capabilities and significant transferability across various industries. The training process of commercially deployed SSL encoders usually requires the collection of large amounts of unlabeled data and consumes huge computing resources. Nevertheless, many research works have revealed that SSL encoders may face various threats, such as stealing attacks and backdoor attacks. Protecting the intellectual property of pre-trained encoders is essential. Our proposed robust encoder watermarking method, BlackMark, offers a solution for identifying unauthorized copies of commercial pre-trained encoders. BlackMark generates a watermark using a selected key image and embeds it into the encoder via a joint loss function. By analyzing the encoder's output on watermarked data, we can identify whether the current encoder is a stolen version under the black-box conditions. Comprehensive evaluations across various downstream tasks demonstrate the effectiveness and robustness of Black-Mark.

Adversarial training (AT) is widely considered the state-of-the-art technique for improving the robustness of deep neural networks (DNNs) against adversarial examples (AE). Nevertheless, recent studies have revealed that adversarially trained models are prone to unfairness problems, restricting their applicability. In this paper, we empirically observe that this limitation may be attributed to serious adversarial confidence overfitting, i.e., certain adversarial examples with overconfidence. To alleviate this problem, we propose HAM, a straightforward yet effective framework via adaptive Hard Adversarial example Mining.HAM concentrates on mining hard adversarial examples while discarding the easy ones in an adaptive fashion. Specifically, HAM identifies hard AEs in terms of their step sizes needed to cross the decision boundary when calculating loss value. Besides, an early-dropping mechanism is incorporated to discard the easy examples at the initial stages of AE generation, resulting in efficient AT. Extensive experimental results on CIFAR-10, SVHN, and Imagenette demonstrate that HAM achieves significant improvement in robust fairness while reducing computational cost compared to several state-of-the-art adversarial training methods. The code will be made publicly available.