Graph neural networks (GNNs) are an emerging tool for analysing graph-structured data, yet their training and inference require access to large and complex graphs. Major organisations such as Google and Facebook hold massive graph datasets (e.g., user interactions/relationships), but cannot share these directly due to their sensitive nature. We propose a secure framework, ColabGNN, for collaborative GNN training and inference that leverages Function Secret Sharing (FSS) to protect both the structure and features of private graphs. Our method ensures that raw graph data, training/inference computations and client queries remain hidden, while still enabling joint model training and secure inference across distributed parties.

Graph Neural Networks (GNNs) are highly effective for analysing interconnected data, yet collaboratively training them across distributed silos introduces severe privacy risks. While Multi-Party Computation (MPC) can secure this process, existing frameworks enforce full-graph aggregation. This triggers a ‘neighbour explosion’, generating prohibitive computational and communication bottlenecks that render secure training infeasible for large-scale graphs. To address this, we propose OblivSage, a novel framework leveraging Function Secret Sharing (FSS) to enable dynamic, oblivious subgraph sampling. OblivSage allows distributed parties to agree on and execute secure sampling, choosing between minimal shared-degree ( d_min ) and k-hop aggregation, without leaking the sampling access patterns or the underlying graph topology to the computing servers. Evaluations on standard benchmarks demonstrate that OblivSage achieves up to a 14.3× speedup and a 1024× reduction in communication overhead compared to state-of-the-art secure baselines, while incurring negligible loss in model accuracy.

Machine learning as a Service (MLaaS) has been an essential offering in recent years. Companies deploy their models to the cloud, where the clients can access the intelligent services by feeding their data through MLaaS APIs. Such a service is appealing; however, it raises growing concerns about the privacy of inputs, including the clients' sensitive personal data and the companies' proprietary models. Using secure inference based on secure multiparty computation (MPC) can protect this input privacy; however, it does not inherently defend against privacy attacks that exploit the service's outputs. There exist Membership Inference Attacks (MIAs) that can reveal whether specific data samples were used in model training by analyzing only the prediction outputs. To address this, we propose Sige, a lightweight secure MIA defense system for ensuring membership privacy. Sige integrates an MPC-friendly MIA defense mechanism, HAMP, into secure inference protocols and leverages Function Secret Sharing for reduced communication costs. Compared to SIGuard (NDSS'25), the SOTA MIA defense for secure inference, our approach significantly improves both defense performance and communication efficiency. Moreover, Sige functions as a modular component, enabling seamless integration into standard MPC-based secure inference protocols without any modifications. We show that Sige effectively protects membership privacy while maintaining practical performance. In the WAN setting, Sige reduces the worst-case MIA success rate to 0.93% (4.87% for SIGuard) with an online runtime approaching 0.1 seconds and a $10^{3} \times$ speedup.

Addressing rising connectivity demands in 6G wireless communication necessitates effective spectrum sharing for dynamic frequency access. Machine learning techniques have been shown to enhance spectrum sensing (SS), and federated learning-based SS (FLSS) is gaining prominence for its ability to train collaborative models while ensuring data privacy. This paper provides an examination of FLSS within the 6G context. It reviews recent advancements focused on practical implementation, including lightweight models, efficient communication, and frequency-domain training, acknowledging their performance improvements alongside persistent challenges like labeled data scarcity and model retraining. Furthermore, the paper investigates the evolving 6G threat landscape, focusing on AI-driven security vulnerabilities and new attack vectors relevant to FLSS. The analysis concludes by assessing attack impacts, surveying mitigation strategies, and identifying key obstacles to deploying resilient FLSS solutions in future networks.

The introduction of 5G and the Open Radio Access Network (O-RAN) architecture has enabled more flexible and intelligent network deployments. However, the increased complexity and openness of these architectures also introduce novel security challenges, such as data manipulation attacks on the semi-standardised Shared Data Layer (SDL) within the O-RAN platform through malicious xApps. In particular, malicious xApps can exploit this vulnerability by introducing subtle Unicode-wise alterations (hypoglyphs) into the data that are being used by traditional machine learning (ML)-based anomaly detection methods. These Unicode-wise manipulations can potentially bypass detection and cause failures in anomaly detection systems based on traditional ML, such as AutoEncoders, which are unable to process hypoglyphed data without crashing. We investigate the use of Large Language Models (LLMs) for anomaly detection within the O-RAN architecture to address this challenge. We demonstrate that LLM-based xApps maintain robust operational performance and are capable of processing manipulated messages without crashing. While initial detection accuracy requires further improvements, our results highlight the robustness of LLMs to adversarial attacks such as hypoglyphs in input data. There is potential to use their adaptability through prompt engineering to further improve the accuracy, although this requires further research. Additionally, we show that LLMs achieve low detection latency (under 0.07 seconds), making them suitable for Near-Real-Time (Near-RT) RIC deployments.

Advancements in wireless and mobile technologies, including 5G advanced and the envisioned 6G, are driving exponential growth in wireless devices. However, this rapid expansion exacerbates spectrum scarcity, posing a critical challenge. Dynamic spectrum allocation (DSA)–which relies on sensing and dynamically sharing spectrum–has emerged as an essential solution to address this issue. While machine learning (ML) models hold significant potential for improving spectrum sensing, their adoption in centralized ML-based DSA systems is limited by privacy concerns, bandwidth constraints, and regulatory challenges. To overcome these limitations, distributed ML-based approaches such as Federated Learning (FL) offer promising alternatives. This work addresses two key challenges in FL-based spectrum sensing (FLSS). First, the scarcity of labeled data for training FL models in practical spectrum sensing scenarios is tackled with a semi-supervised FL approach, combined with energy detection, enabling model training on unlabeled datasets. Second, we examine the security vulnerabilities of FLSS, focusing on the impact of data poisoning attacks. Our analysis highlights the shortcomings of existing majority-based defenses in countering such attacks. To address these vulnerabilities, we propose a novel defense mechanism inspired by vaccination, which effectively mitigates data poisoning attacks without relying on majority-based assumptions. Extensive experiments on both synthetic and real-world datasets validate our solutions, demonstrating that FLSS can achieve near-perfect accuracy on unlabeled datasets and maintain Byzantine robustness against both targeted and untargeted data poisoning attacks, even when a significant proportion of participants are malicious.

The growing adoption of Graph Neural Networks (GNNs) in Machine Learning as a Service (MLaaS) has introduced critical privacy challenges, as both graph features and structural information are exposed to untrusted environments. To mitigate these risks, recent efforts have focused on integrating secure computation into GNNs. However, existing privacy-preserving GNN frameworks often incur substantial computational and communication overhead, and remain susceptible to model-based inference attacks even when built on secure multi-party computation (MPC). While differential privacy (DP) offers an alternative defense, it typically results in significant utility degradation, underscoring a fundamental trade-off between privacy, utility, and efficiency. In this paper, we propose SPG, a secure GNN framework that addresses these challenges by integrating tailored Replicated Secret Sharing (RSS) with a lightweight model architecture that enforces edge-level differential privacy. SPG achieves formal privacy guarantees on graph edges through a novel design that carefully regulates the use of structural information during training. With this design, SPG achieves significantly improved efficiency while maintaining strong privacy guarantees. Specifically, it reduces the runtime cost by 3.11 - 16.55x during training and 16 - 56x during inference, compared to state-of-the-art secure GNN designs. In terms of communication overhead, SPG achieves a reduction of 254 - 575x for training and 1032 - 3720x for inference. Extensive experiments on real-world datasets demonstrate that SPG consistently outperforms existing privacy-preserving GNNs (e.g., DPGCN), offering a superior trade-off between privacy, utility, and efficiency.

Secure inference is designed to enable encrypted machine learning model prediction over encrypted data. It will ease privacy concerns when models are deployed in Machine Learning as a Service (MLaaS). For efficiency, most of recent secure inference protocols are constructed using secure multiparty computation (MPC) techniques. They can ensure that MLaaS computes inference without knowing the inputs of users and model owners. However, MPC-based protocols do not hide information revealed from their output. In the context of secure inference, prediction outputs (i.e., inference results of encrypted user inputs) are revealed to the users. As a result, adversaries can compromise output privacy of secure inference, i.e., launching Membership Inference Attacks (MIAs) by querying encrypted models, just like MIAs in plaintext inference. We observe that MPC-based secure inference often yields perturbed predictions due to approximations of nonlinear functions like softmax compared to its plaintext version on identical user inputs. Thus, we evaluate whether or not MIAs can still exploit such perturbed predictions on known secure inference protocols. Our results show that secure inference remains vulnerable to MIAs. The adversary can steal membership information with high successful rates comparable to plaintext MIAs. To tackle this open challenge, we propose SIGuard, a framework to guard the output privacy of secure inference from being exploited by MIAs. SIGuard's protocol can seamlessly be integrated into existing MPC-based secure inference protocols without intruding on their computation. It proceeds with encrypted predictions outputted from secure inference, and then crafts noise for perturbing encrypted predictions without compromising inference accuracy; only the perturbed predictions are revealed to users at the end of protocol execution. SIGuard achieves stringent privacy guarantees via a co-design of MPC techniques and machine learning. We further conduct comprehensive evaluations to find the optimal hyper-parameters for balanced efficiency and defense effectiveness against MIAs. Together, our evaluation shows SIGuard effectively defends against MIAs by reducing the attack accuracy to be around the random guess with overhead (1.1s), occupying similar to 24.8% of secure inference (3.29s) on widely used ResNet34 over CIFAR-10.

As applications increasingly rely on vector search to find semantically similar content in large-scale databases, preserving user query privacy is of paramount importance. Existing solutions based on advanced cryptography, such as Fully Homomorphic Encryption (FHE) or Private Information Retrieval (PIR), often incur prohibitive computational or communication overheads, limiting their practical deployment. This paper introduces PrivANN, a fully oblivious system for private approximate nearest neighbor (ANN) search that leverages Trusted Execution Environments (TEEs). PrivANN employs a read-optimized Oblivious RAM (ORAM) protocol to defend against side-channel leakage, introduces a novel shuffling mechanism that decouples costly offline preparation from fast online operations and incorporates a novel oblivious Top-k selection algorithm. We formally prove PrivANN’s security guarantees and demonstrate its real-world performance. Our evaluation shows that PrivANN improves throughput by 2.4x over state-of-the-art FHE-based systems while achieving superior search quality, and reduces client-side communication overhead from gigabytes to kilobytes compared to PIR-based approach.

The quality and experience of mobile communication have significantly improved with the introduction of 5G, and these improvements are expected to continue beyond the 5G era. However, vulnerabilities in control-plane protocols, such as Radio Resource Control (RRC) and Non-Access Stratum (NAS), pose significant security threats, such as Blind Denial of Service (DoS) attacks. Despite the availability of existing anomaly detection methods that leverage rule-based systems or traditional machine learning methods, these methods have several limitations, including the need for extensive training data, predefined rules, and limited explainability. Addressing these challenges, we propose a novel anomaly detection framework that leverages the capabilities of Large Language Models (LLMs) in zero-shot mode with unordered data and short natural language attack descriptions within the Open Radio Access Network (O-RAN) architecture. We analyse robustness to prompt variation, demonstrate the practicality of automating the attack descriptions and show that detection quality relies on the semantic completeness of the description rather than its phrasing or length. We utilise an RRC/NAS dataset to evaluate the solution and provide an extensive comparison of open-source and proprietary LLM implementations to demonstrate superior performance in attack detection. We further validate the practicality of our framework within O-RAN's real-time constraints, illustrating its potential for detecting other Layer-3 attacks.

Content providers increasingly utilise Content Delivery Networks (CDNs) to enhance users' content download experience. However, this deployment scenario raises significant security concerns regarding content confidentiality and user privacy due to the involvement of third-party providers. Prior proposals using private information retrieval (PIR) and oblivious RAM (ORAM) have proven impractical due to high computation and communication costs, as well as integration challenges within distributed CDN architectures. In response, we present OblivCDN, a practical privacy-preserving system meticulously designed for seamless integration with the existing real-world Internet-CDN infrastructure. Our design strategically adapts Range ORAM primitives to optimise memory and disk seeks when accessing contiguous blocks of CDN content, both at the origin and edge servers, while preserving both content confidentiality and user access pattern hiding features. Also, we carefully customise several oblivious building blocks that integrate the distributed trust model into the ORAM client, thereby eliminating the computational bottleneck in the origin server and reducing communication costs between the origin server and edge servers. Moreover, the newly-designed ORAM client also eliminates the need for trusted hardware on edge servers, and thus significantly ameliorates the compatibility towards networks with massive legacy devices. In real-world streaming evaluations, OblivCDN demonstrates remarkable performance, downloading a 256 MB video in just 5.6 seconds. This achievement represents a speedup of 90x compared to a strawman approach (direct ORAM adoption) and a 366x improvement over the prior art, OblivP2P.

This paper applies Explainable Artificial Intelligence (XAI) to improve the interpretability of neural differential cryptanalysis on the SPECK cipher. We use Local Interpretable Model-agnostic Explanations (LIME) to analyse and visualise feature importance in neural distinguishers, giving signed contributions and absolute rankings. Signed contributions show whether, and how strongly, specific bit positions influence the model's decision, while absolute rankings reflect their importance regardless of sign. To study interactions beyond single bits, we introduce a Systematic Masking Approach to reveal relations among bits by testing if chosen combinations of masked bits alter classification accuracy. On Gohr's 8-round SPECK32/64 distinguisher, masking up to four-bit combinations shows that decisions involve multi-bit interactions rather than isolated single-bit effects. Although LIME highlights strong single-bit signals, masking reveals interaction patterns consistent with differential cryptanalysis. These findings clarify model behaviour in neural cryptanalysis and show XAI's value for exposing and visualising interaction structure in ciphertext features and decisions.

Recent developments in the field of Dynamic Searchable Symmetric Encryption (DSSE) with forward and backward privacy have attracted much attention from both research and industrial communities. However, most DSSE schemes with forward and backward privacy schemes only support single keyword queries, which impedes its prevalence in practice. Although some forward and backward private DSSE schemes with expressive queries (e.g., conjunctive queries) have been introduced, their backward privacy either essentially corresponds to single keyword queries or forward privacy is not comprehensive. In addition, the deletion of many DSSE schemes is achieved by addition paired with a deletion mark (i.e., lazy deletion). To address these problems, we present two novel DSSE schemes with conjunctive queries (termed SDSSE-CQ and SDSSE-CQ-S), which achieve both forward and backward privacy. To analyze their security, we present two new levels of backward privacy (named Type-O and Type-O-, more and more secure), which give a more comprehensive understanding of the leakages of conjunctive queries in the OXT framework. Eventually, the security analysis and experimental evaluations show that the proposed schemes achieve better security with reasonable computation and communication increase.

Searchable symmetric encryption allows clients to outsource their databases to a semi-trusted cloud server while enabling private searches. The Oblivious Cross-Tag (OXT) protocol is a fundamental approach to conjunctive keyword search, ensuring that search performance scales with the least frequent keyword while introducing keyword pair result pattern (KPRP) and intersection result pattern (IP) leakages. However, recent studies show that the KPRP leakage in OXT can be exploited, allowing the cloud server to infer information about the client database. Several works have aimed to mitigate this issue, with Doris being the first non-interactive OXT-based scheme to hide KPRP and IP leakages. However, this comes at the cost of increased storage overhead. In this work, we propose a Doris-based conjunctive SSE scheme with improved storage efficiency. We replace the XOR filter in Doris with our XEBFF filter, which formalizes XOR filters and Binary Fuse Filters. Additionally, we introduce a frequency estimation approach using Count-Min Sketch to efficiently determine the least frequent keyword, which all previous OXT-based schemes overlook. Our scheme reduces storage overhead by 8

The security of 5G networks relies heavily on cryptography, particularly public-key algorithms that are vulnerable to quantum computer attacks. With NIST now standardizing post-quantum cryptographic (PQC) algorithms, we investigate the practical challenges of PQC migration on a physical 5G testbed. Our testbed, built on OpenAirInterface, integrates essential 5G network components, including User Equipment (UE), Next Generation Node B (gNB) - the base stations for 5G - and core network with multiple functions. Within this environment, we migrated the Subscription Concealed Identifier (SUCI) protocol, enabling secure communication between UE and the core network. We deployed ML-KEM in SUCI, implemented quantum-safe IPSec (via strongSwan) between the gNB and core functions, and integrated quantum-safe TLS (via liboqs) within the core network. We present our PQC migration experiences, along with broader implications for other migration tasks, and evaluate the performance of our quantum-safe 5G testbed. Furthermore, we propose a quantum-safe identity-based Non-Interactive Key Exchange (iNIKE) mechanism to reduce communication latency in the core network by eliminating TLS handshake exchanges involving large PQC ciphertexts and enable new 5G/6G applications.

The rapid progress in the field of IoT and its wide-ranging applications emphasize the criticality of robust security measures for effectively sharing, storing, and managing sensitive data generated by IoT devices. Regulations such as the Consumer Data Rights (CDR) highlight the need for the seamless sharing of sensitive data with authorized third parties while ensuring confidentiality and privacy. To enable such secure sharing, a data storage and sharing scheme should fulfill the following core requirements: (a) support multi-client data sharing settings, allowing IoT data owners to authorize multiple clients; (b) a dynamic storage environment permitting IoT owners to add or remove files with minimal privacy leak; (c) decentralized storage for distributing data across servers or Cloud Service Providers (CSPs) for greater security; and (d) efficient privilege revocation mechanism which incurs less computation and communication overhead. To address these requirements, we have proposed a novel keyword search scheme using computationally lightweight cryptographic primitives. Our scheme empowers IoT data owners to securely share, store and manage encrypted data in the CSPs, providing better security and privacy. We have provided formal security proof for our scheme as well as validated its efficiency via extensive experiments on the Docker platform. On a database of 12 million keyword/document pairs (with 105 documents and 103 keywords), our scheme took about 18 ms to return all matched documents.

Graph Neural Networks (GNNs) have emerged as a powerful tool for analysing graph-structured data across various domains, including social networks, banking, and bioinformatics. In the meantime, graph data contains sensitive information, such as social relations, financial transactions, and chemical structures, and GNN models are IPs of the model owner. Thus, deploying GNNs in cloud-based Machine Learning as a Service (MLaaS) raises significant privacy concerns. In this paper, we present a comprehensive solution to enable secure GNN inference in MLaaS, named OblivGNN. OblivGNN is designed to support both transductive (static graph) and inductive (dynamic graph) inference services without revealing either graph data or GNN models. In particular, we adopt a lightweight cryptographic primitive, i.e., function secret sharing, to achieve low communication and computation overhead during inference. Furthermore, we are the first to propose a secure update protocol for the inductive setting, which can obliviously update the graph without revealing which parts of the graph are updated. Particularly, our results with three widely-used graph datasets (Cora, Citeseer, and Pubmed) show that OblivGNN can achieve comparable accuracy to an Additive Secret Sharing-based baseline. Nonetheless, our design reduces the runtime cost by up to 38% and the communication cost by 10x to 151x, highlighting its practicality when processing large graphs with GNN models.

At CRYPTO'19, Gohr[1] presented ResNet-based neural distinguishers (ND) for the round-reduced SPECK32/64 cipher. However, due to the black-box use of such deep learning models, it is hard for humans to understand why these distinguishers work, impeding advancements in cryptanalytic knowledge. In this work, we aim to effectively adapt eXplainable Artificial Intelligence (XAI) techniques, notably Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP), to gain a detailed understanding of the important features useful in Gohr's neural distinguishers.

Spectrum sharing is increasingly vital in 6G wireless communication, facilitating dynamic access to unused spectrum holes. Recently, there has been a significant shift towards employing machine learning (ML) techniques for sensing spectrum holes. In this context, federated learning (FL)-enabled spectrum sensing technology has garnered wide attention, allowing for the construction of an aggregated ML model without disclosing the private spectrum sensing information of wireless user devices. However, the integrity of collaborative training and the privacy of spectrum information from local users have remained largely unexplored. This article first examines the latest developments in FL-enabled spectrum sharing for prospective 6G scenarios. It then identifies practical attack vectors in 6G to illustrate potential AI-powered security and privacy threats in these contexts. Finally, the study outlines future directions, including practical defense challenges and guidelines.