Video recognition systems are increasingly being deployed in daily life, such as content recommendation and security monitoring. To enhance video recognition development, many institutions have released high-quality public datasets with open-source licenses for training advanced models. At the same time, these datasets are also susceptible to misuse and infringement. Dataset copyright auditing is an effective solution to identify such unauthorized use. However, existing dataset copyright solutions primarily focus on the image domain; the complex nature of video data leaves dataset copyright auditing in the video domain unexplored. Specifically, video data introduces an additional temporal dimension, which poses significant challenges to the effectiveness and stealthiness of existing methods. In this paper, we propose VICTOR, the first dataset copyright auditing approach for video recognition systems. We develop a general and stealthy sample modification strategy that enhances the output discrepancy of the target model. By modifying only a small proportion of samples (e.g., 1

Causal inference plays a crucial role in scientific research across multiple disciplines. Estimating causal effects, particularly the average treatment effect (ATE), from observational data has garnered significant attention. However, computing the ATE from real-world observational data poses substantial privacy risks to users. Differential privacy, which offers strict theoretical guarantees, has emerged as a standard approach for privacy-preserving data analysis. However, existing differentially private ATE estimation works rely on specific assumptions, provide limited privacy protection, or fail to offer comprehensive information protection. To this end, we introduce PrivATE, a practical ATE estimation framework that ensures differential privacy. In fact, various scenarios require varying levels of privacy protection. For example, only test scores are generally sensitive information in education evaluation, while all types of medical record data are usually private. To accommodate different privacy requirements, we design two levels (i.e., label-level and sample-level) of privacy protection in PrivATE. By deriving an adaptive matching limit, PrivATE effectively balances noise-induced error and matching error, leading to a more accurate estimate of ATE. Our evaluation validates the effectiveness of PrivATE. PrivATE outperforms the baselines on all datasets and privacy budgets.

Recommender systems play a crucial role in predicting and suggesting related options for users in different scenarios, including e-commerce, social media, and streaming services. Currently, deep reinforcement learning (DRL)-based recommendation systems have gained significant popularity in both industry and academia, e.g., Spotify, Netflix, Google, and YouTube, since DRL enables modeling long-term interactions between users and the system to enhance the recommendation experience. This paper illustrates that attackers could manipulate DRL-based recommender systems by inserting maliciously constructed interaction data between users and the system. The poisoning attack on these systems is modeled as a non-convex integer programming problem. To address this challenge, a three-phase framework (named ePARL) is proposed to maximize the hit ratio (e.g., the proportion of target items appearing in the user's recommendations) while ensuring high efficiency and evading detection. The insight of ePARL is to increase the ranking of the target item while maintaining the ranking of other items. ePARL supports generating multiple fake user records in a single round, effectively reducing attack costs. Considering the sequential decision-making characteristics of reinforcement learning, ePARL reorganizes the order of items for fake users to mimic the sequential features of normal users, a factor often overlooked in the prior literature. The experiments on several real-world datasets reveal the robustness and effectiveness of ePARL, as well as its superior stealthiness against related detection approaches.

Large language models (LLMs) acquire a large amount of knowledge through pre-training on vast and diverse corpora. While this endows LLMs with strong capabilities in generation and reasoning, it amplifies risks associated with sensitive, copyrighted, or harmful content in training data.LLM unlearning, which aims to remove specific knowledge encoded within models, is a promising technique to reduce these risks. However, existing LLM unlearning methods often force LLMs to generate random or incoherent answers due to their inability to alter the encoded knowledge precisely. To achieve effective unlearning at the knowledge level of LLMs, we propose Knowledge Unlearning by Deviating representAtion (KUDA). We first utilize causal tracing to locate specific layers for target knowledge storage. We then design a new unlearning objective that induces the model's representations to deviate from its original position in the phase of knowledge removal, thus disrupting the ability to associate with the target knowledge. To resolve the optimization conflicts between forgetting and retention, we employ a relaxation null-space projection mechanism to mitigate the disruption to the representation space of retaining knowledge. Extensive experiments on representative benchmarks, WMDP and MUSE, demonstrate that KUDA outperforms most existing baselines by effectively balancing knowledge removal and model utility retention.

The surging demand for large-scale datasets in deep learning has heightened the need for effective copyright protection, given the risks of unauthorized use to data owners. Although the dataset watermark technique holds promise for auditing and verifying usage, existing methods are hindered by inconsistent evaluations, which impede fair comparisons and assessments of real-world viability. To address this gap, we propose a two-layer taxonomy that categorizes methods by implementation (model-based vs. model-free injection; model-behavior vs. model-message verification), offering a structured framework for cross-task analysis. Then, we develop DWBench, a unified benchmark and open-source toolkit for systematically evaluating image dataset watermark techniques in classification and generation tasks. Using DWBench, we assess 25 representative methods under standardized conditions, perturbation-based robustness tests, multi-watermark coexistence, and multi-user interference. In addition to reporting the results of four commonly used metrics, we present the results of two new metrics: sample significance for fine-grained watermark distinguishability and verification success rate for dataset-level auditing, which enable accurate and reproducible benchmarking. Key findings reveal inherent trade-offs: no single method dominates all scenarios; classification and generation tasks require specialized approaches; and existing techniques exhibit instability at low watermark rates and in realistic multi-user settings, with elevated false positives or performance declines. We hope that DWBench can facilitate advances in watermark reliability and practicality, thus strengthening copyright safeguards in the face of widespread AI-driven data exploitation.

Deep reinforcement learning (DRL) has been implemented in various critical applications, including smart grids, traffic management systems, and autonomous vehicles. To safeguard intellectual property and mitigate security vulnerabilities, access to DRL models is typically restricted to a closed-box format. This means that specific details, such as the structure of the policy network and optimization processes, are not openly available to users. It is crucial to determine if hyper-parameters can be inferred from observable states and actions within these models, presenting two primary challenges: 1) limited data available from the closed-box model and 2) intertwined effects of hyper-parameters on the model behavior. Since DRL models exhibit varying behaviors in identical tasks depending on their hyper-parameter configurations, we introduce a novel hyper-parameter inference attack against DRL, named $\mathsf {HyperInfer}$HyperInfer, which allows adversaries to deduce the settings of a closed-box DRL model. In order to fully assess the risk of model hyper-parameter leakage, we design two novel state generation methods that provoke divergent responses from DRL models. We also develop an inference framework to elucidate the relationship between model behavior and hyper-parameter settings. Through comprehensive experiments involving multiple DRL models and environments, we demonstrate that model behaviors can indeed reveal hyper-parameter settings, with inference accuracy surpassing 90% in scenarios such as PPO with CartPole. We also discuss key findings relevant to practical applications and explore how knowledge of hyper-parameters can facilitate more sophisticated attacks. Lastly, we propose potential defensive strategies to minimize the risk of hyper-parameter leakage in DRL models.

In this paper, we introduce GradEscape, the first gradient-based evader designed to attack AI-generated text (AIGT) detectors. GradEscape overcomes the undifferentiable computation problem, caused by the discrete nature of text, by introducing a novel approach to construct weighted embeddings for the detector input. It then updates the evader model parameters using feedback from victim detectors, achieving high attack success with minimal text modification. To address the issue of tokenizer mismatch between the evader and the detector, we introduce a warm-started evader method, enabling GradEscape to adapt to detectors across any language model architecture. Moreover, we employ novel tokenizer inference and model extraction techniques, facilitating effective evasion even in query-only access. We evaluate GradEscape on four datasets and three widely-used language models, benchmarking it against four state-of-the-art AIGT evaders. Experimental results demonstrate that GradEscape outperforms existing evaders in various scenarios, including with an 11B paraphrase model, while utilizing only 139M parameters. We have successfully applied GradEscape to two real-world commercial AIGT detectors. Our analysis reveals that the primary vulnerability stems from disparity in text expression styles within the training data. We also propose a potential defense strategy to mitigate the threat of AIGT evaders. We open-source our GradEscape for developing more robust AIGT detectors.

As the implementation of machine learning (ML) systems becomes more widespread, especially with the introduction of larger ML models, we perceive a spring demand for massive data. However, it inevitably causes infringement and misuse problems with the data, such as using unauthorized online artworks or face images to train ML models. To address this problem, many efforts have been made to audit the copyright of the model training dataset. However, existing solutions vary in auditing assumptions and capabilities, making it difficult to compare their strengths and weaknesses. In addition, robustness evaluations usually consider only part of the ML pipeline and hardly reflect the performance of algorithms in real-world ML applications. Thus, it is essential to take a practical deployment perspective on the current dataset copyright auditing tools, examining their effectiveness and limitations. Concretely, we categorize dataset copyright auditing research into two prominent strands: intrusive methods and non-intrusive methods, depending on whether they require modifications to the original dataset. Then, we break down the intrusive methods into different watermark injection options and examine the non-intrusive methods using various fingerprints. To summarize our results, we offer detailed reference tables, highlight key points, and pinpoint unresolved issues in the current literature. By combining the pipeline in ML systems and analyzing previous studies, we highlight several future directions to make auditing tools more suitable for real-world copyright protection requirements.

Machine unlearning aims to remove the information of specific data from a trained machine learning model while retaining its utility for the remaining data, so as to meet the requirements of privacy regulations. Existing unlearning methods often assume a balanced data distribution, but neglect the real-world, long-tailed scenarios, where the decision boundaries of tail classes are frequently distorted due to insufficient sample representation, thereby reducing the unlearning efficacy. In this paper, we propose the first Long-Tailed Machine Unlearning (LTMU) framework from a unified decision-boundary perspective. Our framework begins with a directional boundary repair scheme designed to enrich the distorted decision boundary of the tail class, and then develop a novel boundary retraction approach tailored for long-tailed unlearning, dispersing both the augmented and original features throughout the feature space. This bidirectional manipulation not only offers a unified interpretation of the relationship between long-tailed learning and unlearning, but also enables flexible control over both repair and unlearning processes through the generation of augmented features, thereby effectively accomplishing the long-tailed unlearning task. Extensive experiments across multiple datasets and neural network architectures demonstrate the effectiveness of our framework in achieving complete unlearning of tail classes in long-tailed distributions.

Detecting fraudulent activities in financial and e-commerce transaction networks is crucial. One effective method for this is Densest Subgraph Discovery (DSD). However, deploying DSD methods in production systems faces substantial scalability challenges due to the predominantly sequential nature of existing methods, which impedes their ability to handle large-scale transaction networks and results in significant detection delays. To address these challenges, we introduce Dupin, a novel parallel processing framework designed for efficient DSD processing in billion-scale graphs. Dupin is powered by a processing engine that exploits the unique properties of the peeling process, with theoretical guarantees on detection quality and efficiency. Dupin provides user-friendly APIs for flexible customization of DSD objectives and ensures robust adaptability to diverse fraud detection scenarios. Empirical evaluations indicate that Dupin consistently outperforms several existing DSD methods, achieving performance improvements of up to two orders of magnitude compared to traditional approaches. On billion-scale graphs, Dupin demonstrates the potential to enhance the prevention of fraudulent transactions by approximately 49.5 basis points and reduces density error from 30.3% to below 5.0%, as supported by our experimental results.

The text-to-image models based on diffusion processes, such as DALL-E, Stable Diffusion, and Midjourney, are capable of transforming texts into detailed images and have widespread applications in art and design. As such, amateur users can easily imitate professional-level paintings by collecting an artist’s work and fine-tuning the model, leading to concerns about artworks’ copyright infringement. To tackle these issues, previous studies either add visually imperceptible perturbation to the artwork to change its underlying styles (perturbation-based methods) or embed posttraining detectable watermarks in the artwork (watermark-based methods). However, when the artwork or the model has been published online, i.e., modification to the original artwork or model retraining is not feasible, these strategies might not be viable. To this end, we propose a novel method for data-use auditing in the text-to-image generation model. The general idea of ArtistAuditor is to identify if a suspicious model has been fine-tuned using specific artists’ artworks by analyzing style-related features. Concretely, ArtistAuditor employs a style extractor to obtain the multi-granularity style representations and treats artworks as samplings of an artist’s style. Then, ArtistAuditor queries a trained discriminator to gain the auditing decisions. The experimental results on six combinations of models and datasets show that ArtistAuditor can achieve high AUC values (> 0.937). By studying ArtistAuditor’s transferability and core modules, we provide valuable insights into the practical implementation. Finally, we demonstrate the effectiveness of ArtistAuditor in real-world cases by an online platform Scenario.1 ArtistAuditor is open-sourced at https://anonymous.4open.science/r/ArtistAuditor.

Graph contrastive learning (GCL) has become a hot topic in the field of graph representaion learning. In contrast to traditional supervised learning relying on a large number of labels, GCL exploits augmentation techniques to generate multiple views and positive/negative pairs, both of which greatly influence the performance. Unfortunately, commonly used random augmentations may disturb the underlying semantics of graphs. Moreover, traditional GNNs, a type of widely employed encoders in GCL, are inevitably confronted with over-smoothing and over-squashing problems. To address these issues, we propose GNN-Transformer Cooperative Architecture for Trustworthy Graph Contrastive Learning (GTCA), which inherits the advantages of both GNN and Transformer, incorporating graph topology to obtain comprehensive graph representations. Theoretical analysis verifies the trustworthiness of the proposed method. Extensive experiments on benchmark datasets demonstrate state-of-the-art empirical performance.

Streaming graphs are ubiquitous in daily life, such as evolving social networks and dynamic communication systems. Due to the sensitive information contained in the graph, directly sharing the streaming graphs poses significant privacy risks. Differential privacy, offering strict theoretical guarantees, has emerged as a standard approach for private graph data synthesis. However, existing methods predominantly focus on static graph publishing, neglecting the intrinsic relationship between adjacent graphs, thereby resulting in limited performance in streaming data publishing scenarios. To address this gap, we propose PSGraph, the first differentially private streaming graph synthesis framework that integrates temporal dynamics. PSGraph adaptively adjusts the privacy budget allocation mechanism by analyzing the variations in the current graph compared to the previous one for conserving the privacy budget. Moreover, PSGraph aggregates information across various timestamps and adopts crucial post-processing techniques to enhance the synthetic streaming graphs. We conduct extensive experiments on four real-world datasets under five commonly used metrics. The experimental results demonstrate the superiority of PSGraph.

Graph analytics have been effective in the data science pipeline of fraud detections. In the ever-evolving landscape of e-commerce platforms like Grab or transaction networks such as cryptos, we have witnessed the phenomenon of 'burst subgraphs,' characterized by rapid increases in subgraph density within short timeframes---as a common pattern for fraud detections on dynamic graphs. However, existing graph processing frameworks struggle to efficiently manage these due to their inability to handle sudden surges in data. In this paper, we propose RUSH ( R eal-time b U rst S ubgrap H detection framework), a pioneering framework tailored for real-time fraud detection within dynamic graphs. By focusing on both the density and the rate of change of subgraphs, RUSH identifies crucial indicators of fraud. Utilizing a sophisticated incremental update mechanism, RUSH processes burst subgraphs on large-scale graphs with high efficiency. Furthermore, RUSH is designed with user-friendly APIs that simplify the customization and integration of specific fraud detection metrics. In the deployment within Grab's operations, detecting burst subgraphs can be achieved with approximately ten lines of code. Through extensive evaluations on real-world datasets, we show RUSH's effectiveness in fraud detection and its robust scalability across various data sizes. In case studies, we illustrate how RUSH can detect fraud communities within various Grab business scenarios, such as customer-merchant collusion and promotion abuse, and identify wash trading in crypto networks.

Graph analytics have been effective in the data science pipeline of fraud detections. In the ever-evolving landscape of e-commerce platforms like Grab or transaction networks such as cryptos, we have witnessed the phenomenon of ‘burst subgraphs,’ characterized by rapid increases in subgraph density within short timeframes—as a common pattern for fraud detections on dynamic graphs. However, existing graph processing frameworks struggle to efficiently manage these due to their inability to handle sudden surges in data. In this paper, we propose RUSH (Real-time bUrst SubgrapH detection framework), a pioneering framework tailored for real-time fraud detection within dynamic graphs. By focusing on both the density and the rate of change of subgraphs, RUSH identifies crucial indicators of fraud. Utilizing a sophisticated incremental update mechanism, RUSH processes burst subgraphs on large-scale graphs with high efficiency. Furthermore, RUSH is designed with user-friendly APIs that simplify the customization and integration of specific fraud detection metrics. In the deployment within Grab’s operations, detecting burst subgraphs can be achieved with approximately ten lines of code. Through extensive evaluations on real-world datasets, we show RUSH’s effectiveness in fraud detection and its robust scalability across various data sizes. In case studies, we illustrate how RUSH can detect fraud communities within various Grab business scenarios, such as customer-merchant collusion and promotion abuse, and identify wash trading in crypto networks.

Recommender systems predict and suggest relevant options to users in various domains, such as e-commerce, streaming services, and social media. Recently, deep reinforcement learning (DRL)-based recommendation systems have become increasingly popular in academics and industry since DRL can characterize the long-term interaction between the system and users to achieve a better recommendation experience, e.g., Netflix, Spotify, Google, and YouTube. This paper demonstrates that an adversary can manipulate the DRL-based recommender system by injecting carefully designed user-system interaction records. The poisoning attack against the DRL-based recommender system is formulated as a non-convex integer programming problem. To solve the problem, we proposed a three-phase mechanism (called PARL) to maximize the hit ratio (the proportion of recommendations that result in actual user interactions, such as clicks, purchases, or other relevant actions) while avoiding easy detection. The core idea of PARL is to improve the ranking of the target item while fixing the rankings of other items. Considering the sequential decision-making characteristics of DRL, PARL rearranges the items' order of the fake users to mimic the normal users' sequential features, an aspect usually overlooked in existing work. Our experiments on three real-world datasets demonstrate the effectiveness of PARL and better concealment against the detection techniques. PARL is open-sourced at https://github.com/PARL-RS/PARL.

In this demonstration, we introduce Spade, a sophisticated real-time fraud detection framework adept at navigating the complex transaction graph. Unlike conventional methods that are limited by performance and lack incremental update capabilities, Spade leverages advanced incremental updates in dense subgraph peeling algorithms to enhance efficiency, usability, and reduce latency, achieving a significantly better fraud prevention ratio. The demo showcases an interactive GUI prototype, allowing users to customize and explore dense subgraphs with various metrics and algorithms. This interacto unearth fraudulent transactions within varied settings, including Grab's services and cryptocurrency transactions.

This paper looks into the voltage stability and network scalability of self-contained converter-based direct current (DC) microgrids (MG) under an innovative control approach, namely a nonlinear adaptive droop-based controller with overcurrent protection, devised for hybrid electric aircraft (HEA) applications. Apart from guaranteeing tight voltage regulation and accurate adaptive distribution of load power across parallel batteries proportional with their current state of charge (SoC), the controller features an inherent overcurrent protection. Notably, the applied nonlinear adaptive droop-based controller introduces a virtual voltage and a constant virtual resistance, placed in series with the inductance and parasitic resistance of each DC/DC bidirectional boost converter. Moreover, the voltage stability for the n-dimensional system is subsequently investigated, providing valuable insights into the voltage dynamic behaviour, followed by a network scalability study based on the system's passivity properties. Finally, numerical simulations replicating various in-flight scenarios align with and validate our theoretical developments in the pursuit of minimising emissions, environmental impact, and operational costs.

Graph data is used in a wide range of applications, while analyzing graph data without protection is prone to privacy breach risks. To mitigate the privacy risks, we resort to the standard technique of differential privacy to publish a synthetic graph. However, existing differentially private graph synthesis approaches either introduce excessive noise by directly perturbing the adjacency matrix, or suffer significant information loss during the graph encoding process. In this paper, we propose an effective graph synthesis algorithm PrivGraph by exploiting the community information. Concretely, PrivGraph differentially privately partitions the private graph into communities, extracts intra-community and inter-community information, and reconstructs the graph from the extracted graph information. We validate the effectiveness of PrivGraph on six real-world graph datasets and seven commonly used graph metrics.

The practical needs of the ``right to be forgotten'' and poisoned data removal call for efficient \textit{machine unlearning} techniques, which enable machine learning models to unlearn, or to forget a fraction of training data and its lineage. Recent studies on machine unlearning for deep neural networks (DNNs) attempt to destroy the influence of the forgetting data by scrubbing the model parameters. However, it is prohibitively expensive due to the large dimension of the parameter space. In this paper, we refocus our attention from the parameter space to the decision space of the DNN model, and propose Boundary Unlearning, a rapid yet effective way to unlearn an entire class from a trained DNN model. The key idea is to shift the decision boundary of the original DNN model to imitate the decision behavior of the model retrained from scratch. We develop two novel boundary shift methods, namely Boundary Shrink and Boundary Expanding, both of which can rapidly achieve the utility and privacy guarantees. We extensively evaluate Boundary Unlearning on CIFAR-10 and Vggface2 datasets, and the results show that Boundary Unlearning can effectively forget the forgetting class on image classification and face recognition tasks, with an expected speed-up of $17\times$ and $19\times$, respectively, compared with retraining from the scratch.