Illicit transaction detection in blockchain networks is of substantial practical value for anti-money-laundering supervision, financial risk control, and on-chain fund tracing. However, suspicious transactions in evolving blockchain graphs are difficult to identify because laundering behaviors are often mixed with normal transfers and evolve through directional propagation, branching, local mixing, and cross-temporal reorganization. Existing graph neural networks and temporal models still struggle to model transaction-flow directionality, local mismatch, and structural disturbance within a unified framework. To address this problem, we propose Hydro-TGT, a flow-aware graph neural network (GNN)-Transformer framework that integrates three flow-aware statistical proxy fields, a dual-stream GNN encoder, and an evolutionary time-gated Transformer guided by Proxy-Guided Flow Sequence (PGFS). The proxy fields are constructed from observable transaction attributes and local graph statistics to summarize transaction-flow position, local-neighborhood mismatch, and structural disturbance, thereby providing compact flow-aware cues beyond the raw features alone. On the public Elliptic benchmark, Hydro-TGT achieves 73.17% full-span F1-score (F1) and 77.48% area under the precision-recall curve (PR-AUC) over the T35–49 test horizon. Further validation on Ethereum Fraud achieves 94.10% F1 and 97.15% PR-AUC, and additional validation on Ethereum Phishing achieves 86.52% F1 and 92.48% PR-AUC under a pooled T33–T40 test protocol. These results indicate that Hydro-TGT can provide effective support for illicit transaction identification and practical blockchain AML analysis under evolving on-chain environments.

In IoT environments, intrusion detection systems are critical for securing networked control systems. Recent approaches leverage self-supervised pretraining to reduce reliance on labeled data, yet most still depend on computationally expensive sequential models and operate under closed-set assumptions, limiting their effectiveness against previously unseen attacks. In this paper, we propose PreDyn-IDS, a lightweight open-set intrusion detection framework for IoT that is both pretrained and confidence-aware. It leverages self-supervised pretraining to enable cross-granularity feature fusion between a WAC module (for packet-level frequency) and Mamba (for flow-level context), achieving efficient feature extraction, and employs a dynamic confidence mechanism to classify known attacks and separate unknown traffic during both fine-tuning and detection. Experimental results on the IoT dataset (Edge-IIoT) and general network traffic datasets (ISCXVPN, ISCXTor) show that PreDyn-IDS outperforms state-of-the-art methods in both detection accuracy and unknown threat identification, demonstrating its effectiveness and practicality in real-world IoT scenarios.

Large Language Models (LLMs) are increasingly deployed in settings where Chain-of-Thought (CoT) is interpreted by users. This creates a new safety risk: attackers may manipulate the model's observable CoT to make malicious behaviors. In open-weight ecosystems, such manipulation can be embedded in lightweight adapters that are easy to distribute and attach to base models. In practice, persistent CoT hijacking faces three main challenges: the difficulty of directly hijacking CoT tokens within one continuous long CoT-output sequence while maintaining stable downstream outputs, the scarcity of malicious CoT data, and the instability of naive backdoor injection methods. To address the data scarcity issue, we propose Multiple Reverse Tree Search (MRTS), a reverse synthesis procedure that constructs output-aligned CoTs from prompt-output pairs without directly eliciting malicious CoTs from aligned models. Building on MRTS, we introduce Two-stage Backdoor Hijacking (TSBH), which first induces a trigger-conditioned mismatch between intermediate CoT and malicious outputs, and then fine-tunes the model on MRTS-generated CoTs that have lower embedding distance to the malicious outputs, thereby ensuring stronger semantic similarity. Experiments across multiple open-weight models demonstrate that our method successfully induces trigger-activated CoT hijacking while maintaining a quantifiable distinction between hijacked and baseline states under our evaluation framework. We further explore a reasoning-based mitigation approach and release a safety-reasoning dataset to support future research on safety-aware and reliable reasoning. Our code is available at https://github.com/ChangWenhan/TSBH_official.

With the growing computational cost of large models, leveraging pre-trained models and applying fine-tuning have become standard practices in machine learning. While these approaches improve accessibility and efficiency, they also introduce new security and ethical risks. Models can be misused for prohibited or high-risk applications, even when publishers explicitly forbid such use. This paper proposes Backdoor-assisted Inversion for Abuse Verification (BIAV), a framework that enables model publishers to verify unauthorized or unethical model use. In BIAV, the publisher embeds one backdoor corresponding to predefined high-risk usage patterns and declares that the model must not be employed in these contexts. If a user violates this policy and fine-tunes the model on sensitive images aligned with the sensitive pattern, the publisher can reveal the sensitive images for verification. Unlike traditional backdoor attacks designed for malicious behavior, BIAV leverages the backdoor to trace misuse. In fine-tuning scenarios, such hidden triggers are nearly impossible for users to detect, as models behave normally on clean images. BIAV associates each backdoor with a sensitive concept (e.g., “fighter aircraft” in a model meant for civilian aviation). When fine-tuned on images containing such sensitive concept, these inputs disproportionately affect the parameter updates. By analyzing the weight changes before and after fine-tuning, the publisher can estimate the corresponding gradients and reconstruct the sensitive images via gradient inversion. Notably, BIAV remains effective under multi-epoch training and multiple-image settings where conventional inversion methods fail. Experiments show that BIAV successfully recovers sensitive, backdoor-tagged images from local fine-tuning data. These results demonstrate that BIAV provides a practical mechanism for verifying model misuse after deployment.

With the rapid growth of mobile applications, large volumes of private data are continuously generated on mobile devices and increasingly outsourced to cloud storage services. Due to the limited computational and energy resources of mobile devices, enabling efficient and secure periodic auditing of cloud stored data remains a challenging task. Existing cloud data auditing schemes, such as Provable Data Possession and Proof of Retrievability, require computation-intensive operations that are impractical for resource-constrained mobile environments. To address this challenge, we propose MIDAS, a mobile-friendly data auditing scheme that supports secure outsourcing of auditing metadata with balanced resource utilization. MIDAS adopts a two-phase auditing metadata structure, in which computation intensive operations are offloaded to edge nodes, while mobile devices only perform lightweight processing. In addition, identity information of edge nodes is embedded into the auditing metadata to support traceability and accountability. To further improve scalability, we design a resource scheduling model for Multi MU and Multi-EN scenarios and propose the proportional load balanced scheduling algorithm to achieve efficient and load balanced metadata generation. The security of MIDAS is rigorously proven by reducing it to the discrete logarithm problem in the RSA quadratic residue subgroup within the random oracle model. Experimental results in a real-world environment demonstrate that MIDAS significantly reduces computational overhead on mobile devices, maintains acceptable communication cost, and achieves superior scalability compared with existing schemes.

Generative agents are a novel AI agent architecture developed in 2023 using LLMs that can generate believable human behaviors. They are of significant importance in social simulation and human-computer interaction. However, there is a lack of research on the privacy and security issues that may arise from its subsequent application in society. Based on the Generative Agent framework, this paper reintroduces a personal information system, and a shared database, reconstructing the memory and reflection systems to realize a Lightweight Generative Agent framework (LGA). To fill the research gap in the field of privacy for Generative Agents, this paper simulates three scenarios with five agents to explore potential privacy and security issues. Based on observed privacy leaks, three defensive strategies are proposed: behavior guideline regulation, Multi-Agents cooperation, and step-back prompts. These strategies have reduced privacy leaks by more than 50.00

In service computing, video classification has become fundamental to many intelligent applications. While Deep Neural Networks (DNNs) have demonstrated excellent performance in recognizing video content, recent studies have shown that DNNs are highly vulnerable to adversarial examples. Thus, understanding adversarial attacks can better respond to emergency situations. In order to improve attack performance, many style-transfer-based attacks and patch-based attacks have been proposed. However, the global perturbation of the former will bring unnatural global colors, while the latter is difficult to achieve success in targeted attacks due to the limited perturbation space. Moreover, compared to a plethora of methods targeting image classifiers, video adversarial attacks remain relatively underexplored. Therefore, to generate adversarial examples with a low budget and to provide them with a higher verisimilitude, we propose a novel black-box video attack framework, called Stylized Logo Attack (SLA). SLA is conducted through three stages. The first stage involves building a style reference set for logos, which can not only make the generated examples more natural, but also carry more target class features in targeted attacks. Then, Reinforcement Learning is employed to determine the style reference and position parameters of the logo within the video, which ensures that the stylized logo is placed in the video with optimal attributes. Finally, perturbations are optimized in a step-by-step manner so as to improve the fooling rate. Experimental results indicate that SLA can achieve better performance than state-of-the-art methods and still maintain good deception effects when facing various defense methods. We believe SLA can raise awareness among the security community about the reliability and security of video classification systems and serve as a memorandum of possible attack methods.

We introduce Quantum-KIP, a method that compresses a training set into a small set of kernel inducing points with soft labels. It uses a quantum feature map to compute state-fidelity overlaps and relies only on forward evaluations, avoiding backpropagation through quantum circuits. We provide a compression-induced stability analysis showing that replacing one training example changes the learned set and predictions by O(m/n). We further provide a joint analysis of this sensitivity bound with intrinsic quantum noise, showing how finite-shot measurement noise and depolarizing noise give rise to privacy-relevant distinguishability bounds for quantum-kernel observations. A circuit-execution analysis shows substantially fewer quantum runs than gradient-based approaches. On MNIST and CIFAR-10 datasets with six-qubit feature maps, Quantum-KIP achieves accuracy close to full-data training, large speedups, reduced privacy leakage, and robustness under depolarizing and measurement noise.

Machine unlearning enables pre-trained models to eliminate the effects of partial training samples. Previous research has mainly focused on proposing efficient unlearning strategies. However, the verification of machine unlearning, or in other words, how to guarantee that a sample has been successfully unlearned, has been overlooked for a long time. Existing verification schemes typically rely on machine learning attack techniques, such as backdoor attacks or membership inference attacks. As these techniques are not formally designed for verification, they are easily bypassed when an untrustworthy model provider in MLaaS undergoes rapid fine-tuning to meet the verification conditions only, rather than executing real unlearning. In this paper, we propose a formal verification scheme, IndirectVerify, to determine whether unlearning requests have been successfully executed. We design influential sample pairs: one referred to as trigger samples and the other as reaction samples. Users send unlearning requests regarding trigger samples and use reaction samples to verify if the unlearning operation has been successfully carried out. We propose a perturbation-based scheme to generate those influential sample pairs. The objective is to perturb only a small fraction of training samples to trigger samples, leading to the misclassification of reaction samples. This indirect influence will be used for our verification purposes. In contrast to existing schemes that employ the same samples for all processes, our scheme, IndirectVerify, provides enhanced robustness, making it less susceptible to bypassing processes.

Retrieval-Augmented Generation (RAG) improves factuality and domain adaptability by grounding responses in external knowledge, but this same dependence on retrieved evidence also creates substantial privacy risks when the underlying corpus contains sensitive information. Existing privacy-preserving RAG methods mainly treat privacy as a per-query or per-response constraint, and therefore fail to capture a more realistic threat in deployment: sensitive information can be progressively reconstructed across multi-turn interactions. In this paper, we study differential privacy for multi-turn RAG from the perspective of cumulative leakage. We show that privacy leakage in such systems is not governed by isolated generation steps, but by the repeated exposure and reuse of sensitive documents across retrieval and generation over time. Based on this observation, we propose Differentially Private Multi-Turn RAG (DP-MultiRAG), a history-aware approach that adaptively controls how sensitive evidence is retrieved, represented, and decoded according to both its instantaneous risk and its accumulated exposure. Experiments on multi-turn benchmarks and real-world sensitive datasets show that DP-MultiRAG effectively suppresses cumulative leakage while preserving answer quality. These results suggest that privacy in RAG should be modeled as a history-dependent exposure process rather than a static per-query constraint, providing a more principled foundation for secure multi-turn RAG systems.

Machine unlearning, a process enabling pre-trained models to remove the influence of specific training samples, has attracted significant attention in recent years. Although extensive research has focused on developing efficient machine unlearning strategies, we argue that these methods mainly aim at removing samples rather than removing samples' influence on the model, thus overlooking the fundamental definition of machine unlearning. In this paper, we first conduct a comprehensive study to evaluate the effectiveness of existing unlearning schemes when the training dataset includes many samples similar to those targeted for unlearning. Specifically, we evaluate: Do existing unlearning methods truly adhere to the original definition of machine unlearning and effectively eliminate all influence of target samples when similar samples are present in the training dataset? Our extensive experiments, conducted on four carefully constructed datasets with thorough analysis, reveal a notable gap between the expected and actual performance of most existing unlearning methods for image and language models, even for the retraining-from-scratch baseline. Additionally, we also explore potential solutions to enhance current unlearning approaches.

In the past few years, there has been an increased focus on creating robust identity authentication protocols for wireless mobile networks to ensure security. Researchers have put forth various authentication protocols that consider the need to defend against potential leakage attacks, such as side-channel attacks and cold-boot attacks. Most existing identity authentication schemes have been primarily studied in an ideal model, assuming that no leakage of internal secret states is possible for a polynomial-time adversary. However, in real-world scenarios, the ability to withstand continuous leakage attacks is crucial for maintaining the claimed security of these schemes. To further tackle this challenge, a new approach to constructing continuous leakage-resilient identity authentication (CLR-IA) protocols is outlined in this paper. The security of the proposed CLR-IA protocol is established based on the hardness of the classical static complexity assumption. Additionally, an identity authentication scheme that can withstand continuous leakage attacks is developed within a multi-server setting. This proposition ensures security even in the presence of leakage on the secret key and offers superior performance attributes such as a fixed constant round leakage parameter, preventing polynomial-time adversaries from obtaining the secret key's leakage from communication messages. The practical implications of these advancements are significant, particularly in providing continuous leakage-resilient identity authentication for mobile edge computing.

With the rapid development of artificial intelligence, large language models (LLMs) have made remarkable advancements in natural language processing. These models are trained on vast datasets to exhibit powerful language understanding and generation capabilities across various applications, including chatbots, and agents. However, LLMs have revealed a variety of privacy and security issues throughout their life cycle, drawing significant academic and industrial attention. Moreover, the risks faced by LLMs differ significantly from those encountered by traditional language models. Given that current surveys lack a clear taxonomy of unique threat models across diverse scenarios, we emphasize the unique privacy and security threats associated with four specific scenarios: pre-training, fine-tuning, deployment, and LLM-based agents. Addressing the characteristics of each risk, this survey outlines and analyzes potential countermeasures. Research on attack and defense situations can offer feasible research directions, enabling more areas to benefit from LLMs.

Cloud storage services rely on cryptographic access control to ensure secure data sharing. However, conventional access control schemes usually assume that data publishers are honest, and thus cannot prevent malicious publishers from generating abnormal ciphertexts or embedding hidden information into ciphertext randomness. Sanitizable Access Control Systems (SACS) address this problem by introducing a semi-trusted sanitizer. Nevertheless, existing SACS schemes are mainly built on Attribute-Based Encryption (ABE), whose policies are usually expressed over bounded and unordered attribute sets. This makes them insufficient for access control scenarios involving arbitrary length inputs, ordered workflows, or repeated operations. To overcome this limitation, we propose DFA-SAC, a novel sanitizable access control system based on Deterministic Finite Automata (DFA). Different from existing ABE-based SACS schemes, DFA-SAC extends static boolean access policies to regular language policies within the sanitizable access control framework, thereby supporting arbitrary length input strings and sequential logic. To realize this goal, we construct a new cryptographic primitive called Sanitizable DFA-based Encryption (SDFAE), where the ciphertext is associated with a DFA policy and the private key is associated with an input string. The sanitizer can check ciphertext validity under the claimed DFA policy and transform the original ciphertext into a sanitized ciphertext without requiring any sanitizer keys from the authority. We formally prove that the proposed scheme achieves adaptive IND-CPA security under standard assumptions using the dual system encryption methodology. Experimental results show that DFA-SAC provides expressive access control with acceptable overhead, especially in the encryption and sanitization phases.

Neural networks are rarely utilized for exact arithmetic computations.However, we aim to leverage them as accurate computing units in code obfuscation scenarios. The effectiveness of traditional code obfuscation methods is increasingly compromised by advanced reverse-engineering tools, which exploit the semantic transparency of arithmetic operations. To address this, we propose constrained-training neural networks tailored to 8-bit integer addition and multiplication, the most common operations in security-critical software. For addition, we introduce a constrained training algorithm that integrates weight clipping, linearity-enforcing loss terms, and boundary-case oversampling, enabling convergence to 100% accuracy across the entire domain. For multiplication, we design the adaptive symbol-gated NALU (ASG-NALU), an improved 4-bit multiplier that achieves exact results with reduced complexity. Combined with a cascade decomposition strategy, it extends to 8-bit multiplication with guaranteed correctness. Experiments confirm 100% in-domain accuracy, while out-of-domain inputs trigger catastrophic failures that act as natural traps, providing hidden security checks against dynamic analysis. These results establish exact constrained-training neural networks as confidential arithmetic primitives and firmly position neural arithmetic as a promising approach for advancing code obfuscation techniques.

Due to the growing emphasis on privacy and data governance in machine learning, federated unlearning, an emerging concept in the domain of federated learning, stems from the growing need to address the dynamic nature of data and the evolving requirements related to privacy, compliance, and data management. However, there are some security risks during the unlearning process, including the potential for adversarial manipulation of model integrity, privacy breaches, and performance degradation in a federated learning framework. Although existing research has proposed various defenses to mitigate these risks, significant vulnerabilities remain that can be exploited to undermine the integrity and effectiveness of the unlearning process. Current attack methods are limited by their detectability during training, lack of persistence, and reliance on test-time triggers, which reduces their overall effectiveness. In this paper, we introduce camouflaged poisoning attacks, a novel attack paradigm relevant to federated unlearning. In this approach, some adversary clients initially infuse a small number of meticulously designed points into the dataset, ensuring that the model's predictions are barely influenced. The adversary then makes a request to the exclusion of some of these malicious clients. At this juncture, the attack is activated, leading to a detrimental impact on the model's predictions. The outcomes reveal a substantial potential for these strategies to compromise the effectiveness of models in unlearning scenarios. The essence of this attack involves the creation of deceptive clients that conceal the influence of a contaminated dataset during the federated unlearning process.

The diffusion model has gained considerable attention as an advanced deep generation model, showcasing remarkable performance. However, concerns have emerged regarding privacy and equity due to potential model misuse, especially for some sensitive features such as gender. Our focus is on addressing the challenge of machine unlearning within an unconditional diffusion model that selectively omits specific features. Our objective is to modify images generated by a pre-trained model by selectively removing particular image components. To achieve this, we propose a novel learning framework for unconditional image-to-image diffusion models. This framework integrates a scoring model into a pre-trained diffusion model, allowing for refinement without the need for a complete retraining process. Experimental validation using datasets such as MNIST and CelebA demonstrates the effectiveness of our approach. It highlights the model’s capability to generate and remove target features while maintaining the fidelity of the original image.

Large Reasoning Models (LRMs) improve performance on complex tasks, but they also make safety control harder at deployment time. In black-box settings, defenders cannot modify model weights and must instead intervene at inference time. This setting creates three practical challenges: harmful intent may be hidden by educational or role-play framing, deep safety analysis can introduce non-trivial latency, and long adversarial contexts can dilute the local cues that simpler filters rely on. These challenges can expose an apparent thinking–output gap, where the model appears cautious during reasoning but still produces an unsafe final answer. To address this problem, we propose Safety Context Injection (SCI), an inference-time framework that separates safety assessment from task generation and prepends a structured external risk report as injected safety context for the protected model. The framework is instantiated in two complementary variants: Static Model Filtering (SMF), a lightweight one-pass guard for fast deployment, and Dynamic Agents Filtering (DAF), an agentic-loop-based analyzer that iteratively gathers and synthesizes evidence for ambiguous or long-context attacks. Across AdvBench and GPTFuzz, spanning base and reasoning models under five jailbreak families, both variants reduce attack success rate and toxicity in the evaluated settings. SMF offers an efficient low-latency option, while DAF is more effective when harmful intent is semantically disguised or dispersed across long contexts.

Large language models (LLMs) are widely deployed in intelligent systems but remain vulnerable to adversarial attacks, such as Greedy coordinate gradient (GCG) and Projected gradient descent (PGD). Existing approaches suffer from three critical issues: (1) Gradient methods like PGD use static entropy factors, failing to adapt to the dynamic gap between continuous optimization and discrete evaluation, leading to low success rates; (2) Discrete methods like GCG rely on trial-and-error with 512 candidate tokens, incurring high computational costs; (3) Existing RL attacks optimize only the objective function, lacking component collaboration, which hinders breakthroughs against complex defenses. To address these, we propose Adaptive reinforcement learning-based projected gradient descent (ARL-PGD). It features three logically sequential innovations: (1) A reinforcement learning-based system-level framework that provides discrete evaluations as the system foundation; (2) A distributed discrete loss feedback mechanism to align continuous optimization with discrete objectives, mitigating GCG’s costs and PGD’s feedback gaps; (3)A dynamic entropy factor strategy: adapting entropy via relaxation gaps, it deterministically modulates distribution sharpness (distinct from noise uncertainty) to preserve optimization gains. These components form a closed-loop “evaluate-feedback-adjust” system, enabling nonlinear synergistic optimization and significantly improving attack success rates (ASR). Experiments on mainstream LLM models (Vicuna, Llama, and Gemma series) show ARL-PGD achieves higher ASR than baselines, with more natural and stealthy adversarial prompts. Ablation studies confirm each component’s effectiveness.

We present a comprehensive analysis of privacy attacks and countermeasures in data-driven systems. We systematically categorize attacks targeting three domains: anonymous data (linkage and structural attacks), statistical aggregates (reconstruction and differential attacks), and privacy-preserving models (extraction, reconstruction, membership inference, and inversion attacks). For each category, we analyze attack methodologies, adversary capabilities, and vulnerability mechanisms. We further evaluate countermeasures including perturbation techniques, randomization methods, query auditing, and model-level defenses, examining their effectiveness and inherent privacy-utility tradeoffs. Our analysis reveals that while differential privacy offers strong theoretical guarantees, it faces implementation challenges and potential vulnerabilities to emerging attacks. We identify critical research directions and provide researchers and practitioners with a structured framework for understanding privacy resilience in increasingly complex data ecosystems.