In current multimodal feature fusion algorithms of 3D object detection for autonomous driving, there is a lack of accurate allocation of weights between features from different fields, which leads to mismatch and subsequent data loss. Ultimately, the accuracy of 3D object detection is reduced. Therefore, a Feature Fusion Attention Former of Point-Image (FFAFormer) is proposed for 3D object detection. Specifically, the features are firstly sampled and encoded through a Feature Encoding Mechanism of Dual Domain Space (FEM-DDS). Meanwhile, precise weight allocation is performed between different domain features, which maximizes the utilization of feature information from different modalities by the Transformer attention. Then, the interaction depth of features at different scale points is enhanced by Multi-Scale Depth Prediction (MSDP), which further refines features and reduces the loss of information. Finally, more accurate fusion of features from different domains are achieved by Dynamic Attention Feature Aggregation (DAFA). Cross-modal features are produced by aligning different features across modalities at a fine-grained level, which are achieved by a learnable dynamic offset and cross-attention mechanism. The effectiveness of FFAFormer is demonstrated by extensive experiments on the KITTI, NuScenes, and Waymo datasets. A real autonomous vehicle platform is also used to verify the proposed algorithm, which shows that the proposed method has enough generalization in complex real-world environments.

Vertical split learning (VSL) has recently emerged as a novel privacy-preserving paradigm by partitioning a model between multiple clients and a server. Despite its practical utility, recent research has revealed its vulnerability to backdoor attacks, where malicious attackers inject poisoned samples embedded with crafted triggers into the training data. In this paper, we present a stealthy Targeted Poisoning Attack within the context of VSL, termed TPA-VSL, which directly manipulates the embedding model without introducing any obvious trigger patterns. The crux of TPA-VSL is to map the embedding vector of the targeted sample to the attacker-desired class, adversely affecting the targeted sample's prediction. To achieve this, TPA-VSL features two novel components. The first component leverages the conditional generation capability of the state-of-the-art generative models — diffusion models, and uniquely guides them with an integrated multimodal encoder-decoder for informative training data generation. This approach allows us to mimic the target model and obtain the mappings of the targeted sample in the embedding space. The second component effectively poisons the embedding model by aligning the mappings of the targeted samples with those of the attacker-desired class. Experimental results demonstrate that TPA-VSL can achieve a 30% higher attack success rate on average compared to baseline attacks.

Electronic nose (E-nose) systems face two interconnected problems in open-set gas recognition: feature distribution shift caused by intensity-related response variability and decision boundary failure induced by unknown gas interference. Existing methods predominantly rely on Euclidean distance or conventional classifiers, failing to account for anisotropic feature distributions and dynamic signal intensity variations. To address these issues, this study proposes the Spherical Normalization coupled Mahalanobis (SNM) module, a universal post-processing module for open-set gas recognition. First, it achieves effective geometric decoupling through cascaded batch and L2 normalization, projecting features onto a unit hypersphere to suppress intensity-related feature magnitude variations. Second, it utilizes Mahalanobis distance to construct adaptive ellipsoidal decision boundaries that conform to the anisotropic feature geometry. The architecture-agnostic SNM-Module seamlessly integrates with mainstream backbones including Convolutional Neural Network (CNN), Recurrent Neural Network (RNN), and Transformer. Experiments on the public Vergara dataset demonstrate that the Transformer + SNM configuration achieves high performance on this benchmark in discriminating among multiple target gases, with an AUROC of 0.9977 ± 0.0028 and an unknown gas detection rate of 99.57% at 5% false positive rate, significantly outperforming state-of-the-art methods with a 3.0% AUROC improvement and 91.0% standard deviation reduction compared to Class Anchor Clustering (CAC). The module maintains exceptional robustness across five sensor positions, with standard deviations below 0.0028. This work effectively addresses the critical challenge of simultaneously achieving high accuracy and high stability in open-set gas recognition, providing solid support for industrial E-nose deployment.

Due to multidimensional heterogeneity, Multimodal Federated Learning (MMFL) confronts fundamental challenges including modality incongruence, modality agnosticism, and modality incompleteness. Existing methods face a trilemma: leveraging external data with privacy risks, isolating features to restrict cross-modal interaction, or incurring high overhead from complex graph-based coordination, all culminating in suboptimal performance. In this paper, we propose a Modality-Agnostic Hybrid Federated Learning (MA-HyFL) framework that synergistically integrates unimodal and multimodal federated processes in modality-agnostic scenarios. Specifically, a bidirectional cross-modal knowledge distillation is employed to promote comprehensive collaboration at inter-client and intra-client levels, enabling robust knowledge transfer among heterogeneous modalities. A reinforcement learning-based aggregation mechanism is further introduced to orchestrate federated workflows through reward-driven policy optimization, dynamically integrating contributive client selection and adaptive aggregation weighting for closed-loop decision-making. Extensive experiments show that MA-HyFL significantly outperforms the other baseline methods in four realistic real-world applications, each exhibiting varying degrees of statistical heterogeneity and missing rates.

Vessel trajectory prediction is fundamental to intelligent maritime systems. Within this domain, short-term prediction of rapid behavioral changes in complex maritime environments has established multimodal trajectory prediction (MTP) as a promising research area. However, existing vessel MTP methods suffer from limited scenario applicability and insufficient explainability. To address these challenges, we propose a unified MTP framework incorporating explainable navigation intentions, which we classify into sustained and transient categories. Our method constructs sustained intention trees from historical trajectories and models dynamic transient intentions using a Conditional Variational Autoencoder (CVAE), while using a non-local attention mechanism to maintain global scenario consistency. Experiments on real Automatic Identification System (AIS) datasets demonstrates our method's broad applicability across diverse scenarios, achieving significant improvements in both ADE and FDE. Furthermore, our method improves explainability by explicitly revealing the navigational intentions underlying each predicted trajectory.

Federated unlearning (FU) has recently emerged as a promising paradigm for removing client data from trained models, enabling privacy preservation and regulatory compliance in federated learning (FL) systems. However, existing FU methods primarily focus on the efficiency of data removal, leaving security vulnerabilities largely unexplored. In this paper, we propose FedUBA, a Federated Unlearning activated Backdoor Attack, which exploits the unlearning process itself to stealthily trigger backdoor behaviors. Unlike traditional backdoor attacks that embed backdoors via direct data poisoning during the learning process, FedUBA exploits the post-training unlearning process to covertly embed backdoor behaviors. The core of FedUBA lies in misleading the global model to unlearn more information associated with influential samples for the backdoored samples than intended, thereby adversely affecting the backdoored samples. To achieve this, FedUBA employs a principled three-stage framework, which involves generating stealthy backdoor triggers, selecting influential samples with the greatest impact on backdoored samples' predictions via black box sensitivity-based analysis, and crafting malicious unlearning requests to induce the global model into activating the backdoor behavior. By doing so, we can significantly alter predictions on backdoored samples by initiating malicious unlearning requests. Extensive experiments on five realistic datasets demonstrate that FedUBA effectively achieves an 80% attack success rate on backdoored samples by triggering only 0.5% malicious unlearning requests.

Federated Learning (FL) has emerged as a promising approach for decentralized machine learning in Internet of Things (IoT) applications, where privacy-sensitive data remains distributed across devices. However, FL systems are vulnerable to attacks that are happening in malicious clients via data poisoning and model poisoning. Once such malicious models are fused in the global server, it will deteriorate the global model's performance. Existing defense methods typically mitigate specific types of poisoning but are often ineffective against others. To overcome this issue, we propose a simple yet effective framework called Confidence-Aware Defense (CAD). It aims to achieve accurate, robust, and versatile detection of malicious attacks. CAD evaluates the reliability of client updates by leveraging the confidence scores produced by each FL client model. Our key insight is that poisoning attacks, regardless of attack type, will cause the model to deviate from its previous state, thus leading to increased uncertainty when making predictions. Therefore, CAD is comprehensively effective for various types of poisoning attacks, including model poisoning and data poisoning. The proposed CAD method accurately identifies and mitigates malicious updates, even under varying attack intensities and data heterogeneity. CAD is evaluated on standard FL benchmarks (CIFAR-10, MNIST, Fashion-MNIST) under non-IID settings and both model and data poisoning attacks. It achieves up to 97.8% accuracy on MNIST and sustains over 64% accuracy under 50% poisoning on CIFAR-10. CAD surpasses all prior defense methods in robustness and performance. These results demonstrate the practicality of CAD in securing FL systems against various threat scenarios.

Deep learning models represent valuable intellectual property due to their high development costs. To protect model ownership, existing fingerprinting techniques have been proposed to use adversarial examples to fingerprint a model's decision boundaries. However, these fingerprints are inherently fragile, as model decision boundaries are highly sensitive to common model modifications such as fine-tuning, pruning, and adversarial training. In this paper, we propose MFUE (Model Fingerprinting via Unlearnable Examples), a novel fingerprinting methodology that leverages the stable unlearnability of unlearnable examples to fingerprint arbitrary modified models in parameter space, fundamentally circumventing the inherent vulnerability of decision boundaries. To achieve robust model fingerprinting in parameter space, we are the first to identify that unlearnable examples, owing to their persistent training resistance, can serve as stable fingerprints beyond the model's decision boundaries. To endow unlearnable examples with robustness against arbitrary model modifications, we introduce adversarial training that simulates the randomness of model modifications by jointly optimizing the unlearnable examples over models at different training stages. We evaluate the performance of MFUE against six different attack types, including both model and input tampering. Through extensive experiments, we demonstrate that MFUE outperforms four existing methods in terms of robustness and uniqueness. The code of MFUE is publicly available at: https://github.com/SPHelixLab/MFUE/.

Contrastive learning (CL) usually leverages extensive quantities of unlabeled data to pre-train an encoder, but may confront significant data privacy vulnerabilities due to membership inference attacks (MIAs), where the adversary aims to infer whether a given sample was used to pre-train a target encoder. Existing MIAs against CL encoders often depend on prior knowledge of the target encoder's pre-training data or pre-training settings, which are typically kept confidential to protect the owner's interests. In this paper, we propose ADA-MIA, a novel black-box MIA against CL encoders, which requires only an auxiliary dataset comprising a mixture of certain training samples without the necessity of knowing their membership labels. We illustrate the inherent privacy risk of data augmentations in CL, and present evidence for the first time that aggressive data augmentations not utilized in the pre-training process can result in significant membership leakage in CL encoders. We further exploit the deliberately crafted aggressively augmented views of the target sample to construct the membership features, which can facilitate the execution of our inference in an unsupervised manner. Extensive experimental results on four datasets demonstrate that ADA-MIA can achieve inference performance comparable to that of seven existing MIAs, even with merely the black-box embedding access to the CL encoders.

Federated Learning enables decentralized model training without exposing raw data, but remains fundamentally vulnerable to poisoning attacks from malicious clients. Existing defenses rely heavily on passive anomaly detection, honest majority assumptions, or unrealistic statistical priors, making them ineffective against adaptive and stealthy adversaries. In this paper, we propose SpecShield, a proactive defense mechanism that actively probes client models through calibrated adversarial perturbations. By leveraging the Fast Gradient Sign Method on the server side, SpecShield elicits dynamic response patterns from each client. These responses are then analyzed in the frequency domain using the Discrete Wavelet Transform. These frequency-domain features uncover distinctive response patterns between benign and malicious clients, enabling robust detection of model poisoning attacks in both non-IID environments and Byzantine majority scenarios. We further derive theoretical upper bounds on perturbation magnitudes to guarantee detection accuracy while preserving benign client performance. Through extensive experiments conducted on real-world datasets under six state-of-the-art poisoning attacks, SpecShield consistently outperforms existing defenses in both detection accuracy and model robustness. Our results demonstrate that active perturbation-induced profiling provides a new dimension for securing federated learning against sophisticated adversarial threats.

The convergence of Generative Artificial Intelligence and biometric recognition is reshaping modern healthcare. It enables more adaptive and intelligent human–machine interactions. Epilepsy, a common neurological disorder affecting millions worldwide, relies heavily on electroencephalography (EEG) signals for diagnosis and monitoring. Wearable consumer devices with EEG sensors support continuous physiological data collection. However, transmitting sensitive biometric data to centralized servers introduces serious privacy and security risks. Federated learning (FL) provides a distributed training framework that keeps raw data on local devices. Despite this advantage, existing FL methods remain vulnerable to gradient leakage attacks, where adversaries may infer private biometric information from shared model updates. To address this issue, we propose PFED, a privacy-preserving federated learning protocol that combines randomized group interaction with volunteer-assisted secure aggregation. The proposed method effectively obfuscates gradient information while maintaining model utility. Experiments on the public CHB-MIT EEG dataset show that PFED achieves reliable epilepsy detection performance and strong privacy protection. These results demonstrate its potential for secure AI-enabled biometric healthcare applications in consumer device environments.

Among contemporary AI computing paradigms, Federated Learning (FL) stands out as an innovative method and has shown great potential in conjunction with edge computing. The two techniques combined serve as a building block forthe development of the Artificial Intelligence of Things (AIoT). This paper sheds light on the synergistic integration of FL with edge computing to propel AIoT's capabilities in decentralized environments. By executing computing tasks closer to the data, FL at the edge not only alleviates latency and bandwidth limitations inherent in cloud-centric architectures, but also presents a robust solution to privacy concerns-a crucial obstacle in traditional centralized training setups. This paper delves into how FL tackles these privacy issues, providing an intricate explanation of its operational principles, applications, and the resultant benefits for AIoT systems. Through this scrutiny, we highlight FL's potential in bolstering the efficiency and privacy of AIoT deployments while also delineating future research directions and the expected impact across various domains. This study aims to comprehensively comprehend FL for Edge Computing-enabled AIoT and foster developments in intelligent technologies and applications in an interconnected world.

In the pre-training-fine-tuning paradigm, pre-trained encoders have become high-value intellectual property (IP) due to their immense training costs, necessitating robust protection. Existing fingerprinting or watermarking methods typically rely on pre-defined samples and labels, or require intrusive modifications to the training process. However, downstream fine-tuning can significantly alter an encoder's representation and label space, thereby destroying the label consistency of existing methods and rendering them ineffective. Consequently, it is both challenging and urgent to provide a downstream-agnostic, black-box ownership verification mechanism for pre-trained encoders. To address this, we propose a downstream-agnostic, label-only fingerprinting method that leverages Adversarial Shifting to construct stable fingerprint clusters in the encoder’s latent space. By exploiting the inherent output consistency of these clusters, our method remains effective regardless of the specific downstream task or label mapping. Extensive experiments demonstrate that our method maintains superior robustness and stealthiness across various downstream tasks and category scales, providing a practical and reliable IP protection scheme for high-value pre-trained encoders.

Inductive kriging estimates values at unobserved locations from sparse sensor data, enabling continuous field reconstruction when dense deployment is impractical. However, common 2 × 2 and 2 × 3 evaluation protocols can leak spatial information through model selection and obscure true out-of-distribution (OOD) behavior. We propose a leakage-free 3 × 3 partition that separates training, validation, and testing in both space and time, so that model fitting, checkpoint selection, and final reporting are performed on distinct spatio-temporal domains. Under this stricter setting, we introduce DRIK (Distribution-Robust Inductive Kriging), a framework with three task-specific mechanisms: Spatial Continuity Regularization (SCR) perturbs coordinates to reduce dependence on one discretized graph; Masked Flow Disambiguation (MFD) prunes ambiguous propagation from zero-padded masked nodes; and Structural Domain Expansion (SDE) uses validation-node topology without labels to reduce train-inference structural mismatch. Experiments on six spatio-temporal datasets show that DRIK consistently outperforms state-of-the-art baselines, reducing MAE by up to 12.48% and achieving lower test-to-validation MAE ratios under leakage-free evaluation. These results indicate that robust inductive kriging requires both leakage-free evaluation and mechanisms that explicitly address the structural shifts introduced by unseen nodes.

Federated Learning (FL) offers a privacy-preserving approach to distributed machine learning by enabling collaborative training across multiple clients. Existing research mainly focuses on client selection to improve global model convergence, addressing client resource heterogeneity. However, these methods often separate efficiency from security, neglecting the protection of local model parameter interactions and risking client privacy. To solve this, we propose a framework that balances optimal client selection with secure parameter interactions, protecting client models during training and ensuring correct aggregation without privacy leaks. To prevent man-in-the-middle attacks, a BLS signature mechanism ensures data integrity. Additionally, a Deep Reinforcement Learning (DRL)-based self-weighting method mitigates masking effects on server aggregation, enabling accurate weighted aggregation without masks. Experiments show our framework significantly improves model accuracy over traditional FL aggregation methods.

Tele-operated robots rely on real-time user behavior mapping for remote tasks, but ensuring secure authentication remains a challenge. Traditional methods, such as passwords and static biometrics, are vulnerable to spoofing and replay attacks, particularly in high-stakes, continuous interactions. This paper presents a novel anti-spoofing and anti-replay authentication approach that leverages distinctive user behavioral features extracted from haptic feedback during human-robot interactions. To evaluate our authentication approach, we collected a time-series force feedback dataset from 15 participants performing seven distinct tasks. We then developed a transformer-based deep learning model to extract temporal features from the haptic signals. By analyzing user-specific force dynamics, our method achieves over 90 percent accuracy in both user identification and task classification, demonstrating its potential for enhancing access control and identity assurance in tele-robotic systems.

Constrained states and transient performance are critical in bipartite formation control of multi-agent systems. In this paper, a predictor-based state-constrained bipartite formation control strategy is proposed for a class of nonlinear multi-agent systems with unknown external disturbances. A dual barrier Lyapunov function is proposed to constrain both prediction errors and predictor-based surface errors. With the help of the dual barrier Lyapunov function, a barrier Lyapunov function-based predictor is then constructed. It alleviates oscillations generated by overlarge adaptive gains in identification of state-constrained followers. With a barrier Lyapunov function-based predictor, barrier Lyapunov function neural networks are developed to approximate unknown dynamics of a multi-agent system with state constraints. A barrier Lyapunov function neural network nonlinear disturbance observer is designed for compensating for generalized disturbances including disturbances as well as barrier Lyapunov function neural networks’ identification errors. From analysis, it is proven that the multi-agent system achieves bipartite formation and states of followers satisfy the constrained condition. The effectiveness of the strategy with state constraints is verified via two simulation examples. Compared with the traditional approaches, the proposed strategy reduces the integrated absolute formation error by 31% and the integrated absolute error of identification by 63% during the simulation process.

The rapid advancements and widespread application of deep neural networks (DNNs), coupled with their reliance on sensitive and private data, have sparked growing concerns regarding data privacy and the "right to be forgotten". To address these concerns, machine unlearning has been proposed to efficiently eliminate the influence of specific training data from trained DNNs. However, existing machine unlearning methods struggle with the large number of parameters in trained DNNs, which lead to slow execution and high memory consumption, making them impractical for large-scale models. In this paper, we shift our focus to the small set of weights in the final classification layer of DNNs, which are defined as as "prototypes" for different classes. Our key observation is that the prototype associated with the unlearned training data undergoes a significant shift, whereas prototypes of unrelated classes exhibit only minor changes when comparing the prototypes of original and retrained models. Based on this observation, we propose a novel machine unlearning approach that efficiently achieves machine unlearning by directly adjusting the prototypes of DNNs. We first introduce Naive Prototype Surgery (Naive PS), a fast and simplified method that uses a closed-form solution to approximate unlearning effect by directly adjusting the prototype associated with the unlearned data. Next, we propose Prototype Surgery (PS), which incorporates soft label information to fine-tune the prototypes of all classes, to achieve a more effective unlearning. Both methods achieve data unlearning by only modifying the prototypes in the DNNs, thus avoiding the challenges posed by the large number of model parameters. Extensive experiments on four datasets demonstrate that our methods significantly accelerate the unlearning process while achieving comparable results to five existing methods in terms of both unlearning performance and privacy guarantee.

The Channel State Information (CSI) of WiFi has been increasingly used for many applications, including device localization, authentication, object recognition and human intrusion detection. However, these applications all assume the authenticity of CSI, which is measured by the preamble signals between the transmitter and the receiver. Few of prior works have evaluated CSI under intentional wireless interference. This research visits the attack side of CSI and investigates the potential of adversarially modifying OFDM spectrum to manipulate a target WiFi device’s CSI, which could put all existing WiFi-based applications in danger. We find that using traditional jamming signals is hard to modify CSI with reasonable degrees of freedom, and they often block the transmission. Thus, we explore the novel subcarrier-level interference signals to achieve the malicious purpose, which modifies each subcarrier of the OFDM signal independently without blocking the transmission. Based on that, we design two types of attacks, the random and the targeted CSI alteration attacks, which aim at achieving denial of service and identity spoofing, respectively. We demonstrate the two attacks to adversely modify the channels of IEEE 802.11n WiFi using off-the-shelf WiFi devices. We further use the two attacks to cheat an existing CSI-based device authentication system, which treats each device’s up-link CSI as unique physical-layer information for identification. Both theoretical simulations and real-world experiments show that our CSI alteration attacks significantly degrade the security of WiFi systems, suggesting the reconsideration of using CSI for sensing and security purposes.