Federated learning has gained significant attention for its ability to train models without directly accessing raw data. However, the malicious server may falsify the aggregation results to save computational resources. While existing verifiable federated learning methods can validate the results, they exacerbate communication bottlenecks and fail to achieve collusion-resistant verification in the absence of a trusted authority. In this paper, we propose CVFL-Pro, a collusion-resistant verification federated learning framework with adaptive communication optimization. Specifically, we utilize a mask and Shamir’s secret sharing for privacy protection, and it is robust against client dropout. We combine a lightweight MAC scheme and auxiliary nodes to achieve efficient verifiability. Furthermore, we design an adaptive communication optimization algorithm (AOTop-k), which dynamically adjusts the compression rate p based on the gradient magnitude and the gradient variation between rounds, ensuring optimal performance with minimal cost. Finally, we instantiate CVFL-Pro and prove its correctness and security against collusion by up to |N|−2 clients (where |N| is the total number of clients) and the server. Extensive evaluations on MNIST, CIFAR-10, and CIFAR-100 datasets demonstrate that CVFL-Pro reduces communication overhead by 58.07% compared to the optimal Top-k and 95.81% compared to SecAgg. Experiments show that CVFL-Pro reduces communication overhead by up to 95.81% while maintaining accuracy. It dynamically adjusts compression and achieves efficient storage, requiring only 830.16KB compared to 1952.62KB in SecAgg.

Puncturable attribute-based encryption ( ) not only supports fine-grained access control over encrypted data, but also enables users to revoke the decryption capability for specific messages by puncturing tags, thereby achieving fine-grained forward security. It finds wide applications in scenarios such as sharing government classified documents and personal health records. However, existing schemes only support tag-by-tag puncturing, where each puncturing operation is done through key delegation, which causes the key size to grow with the number of punctured tags. This inefficiency makes impractical in scenarios that require frequent puncturing or mass revocations. To address this limitation, it is crucial to support batch puncturing of tags, i.e., the decryption capability for messages associated with multiple tags can be revoked simultaneously via a single puncture. In this work, we construct a ciphertext-policy attribute-based encryption ( - ) scheme for circuits with batch-puncturing. Notably, the size of the punctured key in our scheme is independent of the number of punctured tags, as well as the size and depth of the circuits. This is achieved by leveraging the evasive learning with errors ( ) and tensor assumptions. In addition, we observe that puncturable - can be re-stated by dual-policy ( - ) with key delegation, and generalize batch-puncturing - to provide the first lattice-based construction of - for circuits. Moreover, inspired by the observation of Agrawal and Yamada (Eurocrypt ’20), we introduce the puncturing property into optimal broadcast encryption ( ), capturing a new primitive called puncturable , which allows the receiver to securely erase sensitive messages without communicating with the authority.

Circuit-based private set intersection (circuit-PSI) enables two parties with respective private sets X and Y to compute general functions over the intersection X ∩︀ Y without revealing anything else. Despite the more powerful functionality than plain PSI, existing circuit-PSI protocols have much less satisfactory performance for practical scenarios, and the under lying hash-to-bin techniques require an extra shuffle step for a wide range of functions, even for intersection and union. Le et al. (CCS'19) proposed an efficient circuit-PSI by enlisting an untrusted helper, however, their protocol leaks intersection cardinality to the helper that could be exploited to launch attacks. In this work, we follow the helper-aided model and present an efficient circuit-PSI protocol, without the information leakage in CCS'19 and the requirement of shuffle in the hashing based works. Our protocol relies on a new primitive, Distributed Key-Value Store (DKVS), which facilitates efficient distributed membership tests without hashing techniques and may be of independent interest. Furthermore, we show how to efficiently extend our circuit-PSI to popular operations, union and intersection-sum, with stronger security via a new variant of oblivious transfer (OT) called replicated secret-shared OT. For fair comparisons, we propose adapted variants of the state-of the-art circuit-PSI (EUROCRYPT'21) and enhanced private set union (ePSU) extension (USENIX Security'25) by also enlisting the helper as baselines. The results show that our circuit-PSI has up to 8.1× lower communication costs and 5.3× faster running time, and our ePSU extension without shuffle also reduces communication costs and running time by a factor of 2.4 ∼ 7.3× and 3.5 ∼ 20.2×, respectively. Since the state-of-the-art PSI Sum-CA protocol (PKC'24) cannot be adapted to the helper aided setting, we directly compare our PSI-Sum with it. The results show that our PSI-Sum achieves no cardinality leakage while running up to 11.3× faster and maintaining comparable communication costs.

Secure Aggregation (SA) is a fundamental privacy-preserving technique in Federated Learning (FL) that ensures the confidentiality of local model updates while enabling global model aggregation. Previous studies have implemented SA within the FL architecture that includes a central server. However, in a Device-to-Device (D2D) based FL, decentralized SA becomes challenging due to the lack of a central server, particularly in a zero-trust network vulnerable to Byzantine attacks. To address this issue, we present a novel Byzantine-robust decentralized SA protocol (DeSA) that guarantees the integrity of model training and aggregation while protecting the privacy of model updates. Specifically, we utilize an enhanced zk-SNARK proof system to verify the local model training process. Additionally, we propose a framework that embeds multiple zero-knowledge proofs to ensure the integrity of model aggregation, while maintaining succinct proofs and fast verification. Moreover, we present a Byzantine-robust D2D aggregation protocol that can withstand malicious nodes trying to disrupt model aggregation. To protect privacy, we develop a one-time masking method that eliminates aggregated masks through a dynamic aggregation strategy. This strategy takes into account the adjacency and trust relationships among nodes in evolving network topologies. Finally, we perform a theoretical analysis and evaluate DeSA on real-world datasets. Experimental results show that the time required to verify an embedded proof is significantly reduced compared to the time of verifying multiple proofs. Additionally, its accuracy remains robust against malicious nodes.

This paper presents a three-tier secure computing framework for cross-domain vehicle-road-cloud collaboration, integrating Trusted Execution Environments (TEEs), Secure Multi-Party Computation (SMPC), and blockchain technologies. The focus is on architectural flexibility and privacy configurability rather than performance metrics. The framework supports adaptive privacy through multiple SMPC modes—ranging from differential privacy only to high-privacy configurations—allowing dynamic trade-offs between efficiency and security. A hybrid approach combining differential privacy and SMPC enables fine-grained control over the privacy-utility balance. Batch processing optimization further aligns with V2X data flow characteristics. A lightweight blockchain prototype validates data integrity under varying consensus node settings, exploring decentralized trust mechanisms. Experiments based on the VeReMi dataset confirm the feasibility of privacy-preserving processing in vehicular networks using configurable cryptographic layers. While currently at the proof-of-concept stage, the proposed architecture demonstrates a practical and extensible foundation for secure V2X communication, combining privacy, scalability, and real-world adaptability.

Gui et al. (S&P 2023) first proposed an attack exploiting vulnerabilities in document retrieval to reconstruct queries. In response, they (PETS 2024) introduced the first searchable encryption (SE) scheme supporting system-wide security using frequency bucketization and obfuscation. However, it only supports single-keyword retrieval and has limitations in applicability and efficiency. Multi-keyword retrieval, widely used in practice, is also susceptible to system-wide leakage-abuse attacks, with no effective defense mechanisms available. We propose a secure system-wide SE scheme that enhances system security and scalability without compromising practicality. For security, we introduce a volume bucketization technique to protect the volume of retrieved documents. For efficiency, it significantly reduces computational and communication complexity and minimizes the update rounds. Building on this foundation, we introduce the first multi-keyword retrieval scheme supporting system-wide security, using dynamic bitmap and adaptive volume hiding techniques. It demonstrates low overhead and effectiveness in multi-keyword search scenarios. Experiments show that, on large-scale datasets, our method outperforms existing solutions by at least 100× in write-back and update efficiency. Client-side cache overhead is reduced by 78%. In the multi-keyword retrieval, a Boolean query involving 8 keywords takes approximately 454.78ms.

While fault diagnosis methods based on masked modeling significantly reduce reliance on manual data labeling, they shift the burden to a new manual task: tuning the optimal masking ratio. To alleviate the dependency, this study presents a fault diagnosis method based on adaptive masked modeling and retrieval-augmentation techniques, specifically designed for mechanical equipment fault diagnosis under cross-condition and few-shot scenarios. The core of this work is an adaptive masker, informed by feature distributions, that enables end-to-end mask optimization via the joint learning of intrasample and intersample attention. Furthermore, a context retrieval module is employed to construct representative contextual samples through nearest neighbor search. Experiments on two public datasets demonstrate that the proposed method achieves superior performance in the majority of cross-condition and few-shot diagnosis tasks. Additionally, to verify the feasibility and robustness of the model, sensitivity and ablation analyses have been conducted on its key components.

Machine learning is a rapidly evolving field with applications in all aspects of human life. Utilizing the decentralized computing architecture can alleviate the high training and computational burden of central servers and improve service accuracy. However, the inherent properties of decentralized networks pose great challenges to communication security. It is urgent to design novel and appropriate security schemes, as malicious adversaries are curious about user private information, sensing data, and service demands. Furthermore, end devices always cooperate to accomplish the service targets, which means that group security schemes are needed to protect transmissions among them. In this paper, a certificateless-based group authentication and key agreement (CL-GAKA) scheme is proposed, named 2PCLGA, for distributed learning-based mobile edge computing (DL-MEC) networks. The proposed scheme establishes a session key among the end device group with the group leader MEC server based on the elliptic curve cryptography. Besides, the 2PCLGA scheme adopts dynamic pseudonym identity technology to realize the anonymity. The provable security analysis under the random oracle model, the formal analysis tool, and the informal analysis are adopted. The performance of 2PCLGA is also evaluated with the benchmarks, and the results show that the 2PCLGA scheme is greatly applicable to the resource-constrained circumstance.

Mobile cloud computing (MCC) optimizes storage and computation on resource-limited mobile devices by leveraging heterogeneous networks and robust cloud servers. However, outsourcing local data to cloud servers, which may be malicious, also raises concerns about data privacy. As a prominent solution for securing outsourced data, server-aided revocable attribute-based encryption (SR-ABE) enforces fine-grained access control over encrypted data while supporting lightweight user revocation. Yet, available SR-ABE schemes struggle in practice due to the following reasons. First, they rely on a fully trusted key generation center to manage attributes and issue long-term transformation and decryption keys. Second, they require setting up a fixed number of data users, and overlook attribute revocation. Third, they incorporate time-based revocation mechanisms that assume synchrony in the underlying network, which does not always hold in practice. This paper presents a secure and practical SR-ABE scheme for MCC that supports the decentralized generation of long-term user keys while integrating state-triggered user and attribute revocation mechanisms. The proposed SR-ABE scheme accommodates unlimited data users, minimizes the sizes of key and ciphertext updates via lazy revocation, and ensures verifiable outsourced decryption. We formally prove that the proposed SR-ABE scheme is adaptively secure, and conduct extensive experiments demonstrating its practicality.

Effective leakage-abuse attacks on encrypted SQL query schemes primarily focus on column equality leakage or cross-column equality leakage. However, these approaches fail to effectively leverage the joint distribution information among correlated columns that are often revealed in multi-attribute queries. This limitation leads to an underestimation of the actual security risks in real-world deployments. This paper presents Anchor-Joint Attack, an incremental inference framework that more effectively exploits joint distribution leakage to achieve superior plaintext recovery. We design an anchor-based incremental strategy that first extracts a set of high-confidence ciphertext plaintext mappings from column equality leakage and treats them as anchors. Guided by these anchors, the framework then incrementally incorporates joint distribution information to expand the recovered mappings in an iterative manner. Moreover, we formulate the recovery procedure as an optimal transport problem based on the Earth Mover's Distance (EMD), which naturally accommodates partial domain overlap and supports iterative error detection and correction. This design avoids explicitly constructing the full joint distribution in a single step, thereby maintaining high recovery rates, robustness, and efficiency even under incomplete leakage conditions. Extensive experiments on real-world data demonstrate that our attack outperforms existing state-of-the-art methods. In the encrypted boolean query scenario, our method achieves an optimal value recovery rate of 71.68% and an optimal row recovery rate of 95.45%, surpassing the Jigsaw attack (Nie et al., USENIX'24) by approximately $3.5 \times$ and $2.5 \times$, respectively. In the encrypted join query scenario, our method attains an optimal value recovery rate of 97.4%, exceeding the attacks proposed by Hoover et al. (USENIX'24) by about $1.2 \times$, while improving runtime by approximately $20 \times$.

The widespread adoption of cloud storage has made secure and flexible access control for outsourced data a core requirement. Although ciphertext-policy attribute-based encryption (CP-ABE) provides robust technical support for fine-grained access control, its practical deployment requires schemes that can simultaneously balance efficient user revocation and practical key tracing capabilities. However, existing CP-ABE schemes fail to meet these demands. To close this gap, we propose RT-CP-ABE, a revocable and traceable CP-ABE scheme. That is, it allows the authority to revoke users by broadcasting public update keys, while maintaining the ability to trace malicious users. The proposed RT-CP-ABE scheme, for the first time, unifies indirect revocation and fully collusion-resistant black-box tracing in prime-order groups. We rigorously demonstrate through formal proofs that our proposal achieves selective security and black-box traceability in the random oracle model. The theoretical analysis indicates that, compared with previous schemes, our scheme features compact key and ciphertext sizes. Moreover, it maintains millisecond-level encryption and decryption latency, demonstrating strong practicality.

Practical equi-join queries over encrypted databases aim to provide clients with flexible query capabilities while safeguarding data confidentiality. So far, the most promising and practical solution is CHT, which is based on Trusted Execution Environments (TEEs). However, such schemes can only support two-table equi-join queries, which are rather limited compared to Multi-Table Pairwise Equi-Join (MTPEJ). Furthermore, in terms of efficiency, throughput, and access pattern, the join implemented in TEEs is still problematic compared to a practical and secure scheme. In this work, we focus on this important type of equi-join, which facilitates join across any two tables among multiple tables. Specifically, we propose SP(2)Join in this paper, the first MTPEJ framework that supports secure pairwise equi-join among multi-table by leveraging a novel oblivious pipeline join algorithm in TEEs. To validate our approach, we evaluate SP(2)Join in MySQL using the benchmarks and real datasets, and the results demonstrate that SP(2)Join is superior to the state-of-the-art in terms of secure equi-join. Particularly, our pipeline join query time is only 2.68% of CHT, yet throughput can reach up to 16.56 & times; of CHT. Even for MTPEJ, it is still 14.95% of CHT when implementing pairwise equi-join among 10 tables, with a time cost of approximately 140.30 ms.

With the advancement of Intelligent Transportation Systems, multimodal data from edge devices like vehicles and Roadside Units has grown exponentially. Traditional centralized processing faces real-time bottlenecks, model convergence issues due to data heterogeneity, and privacy risks, failing to meet the need for high-frequency decision-making. This paper presents DFLChain, a dynamic Federated Learning framework based on DAG-based blockchain. The three-layer architecture enables efficient collaboration: the vehicular layer handles local training and transaction packaging, the blockchain layer uses DAG for asynchronous parallel verification to boost throughput, and the application layer automates tasks via smart contracts. Key innovations include: 1) a hybrid tip selection algorithm that dynamically balances energy consumption and model accuracy, prioritizing low-energy nodes for fast consensus in early stages and high-accuracy nodes for model optimization later; 2) a dual-verification mechanism to resist malicious attacks. Experiments on Non-IID data show DFLChain improves convergence speed by 31.9

Vision-language models (VLMs) have shown remarkable ability in aligning visual and textual representations, enabling a wide range of multimodal applications. However, their large-scale training data inevitably raises concerns about privacy, copyright, and undesirable content, creating a strong need for machine unlearning. While existing studies mainly focus on single-shot unlearning, practical VLM deployment often involves sequential removal requests over time, giving rise to continual machine unlearning. In this work, we make the first attempt to study continual unlearning for VLMs and identify three key challenges in this setting: effectiveness in removing target knowledge, fidelity in preserving retained model utility, and persistence in preventing knowledge re-emergence under sequential updates. To address these challenges, we propose CATA, a conflict-averse task arithmetic method that represents each forget request as an unlearning task vector. By maintaining historical task vectors and performing sign-aware conflict-averse aggregation, CATA suppresses conflicting update components that may weaken previous forgetting effects. Extensive experiments under both single-shot and continual settings show that CATA outperforms baselines in terms of forgetting effectiveness, model fidelity, and forgetting persistence.

Data capsule provides a feasible solution for controllable data sharing, where data owners outsource their data capsules containing encrypted data and compliance-checking policies to the cloud server, and only valid users can run a compliant analysis program to process the decrypted data capsules in the Trusted Execution Environment (TEE), without obtaining the raw data. However, existing schemes cannot achieve verifiable accesses and updates, which means that malicious servers may use corrupted/old data capsules to deceive users and TEE. In this paper, we introduce the concept of Verifiable Data Capsule (VDC) for secure and controllable data sharing. Specifically, we first design a lightweight authentication tag, dubbed Locally Verifiable Chameleon Tag (LVCT), which allows the data owner to bind all data capsules to a constant-size tag and enables users to recover the local tags for validating data capsules. On this basis, we present a concrete VDC scheme that utilizes a dual-level authentication structure to realize verifiable data updates, and verifiable state updates triggered by regular access without the aid of the data owner. Furthermore, we propose an efficient trust evaluation protocol to judge the credibility of cloud servers. Finally, both security analysis and performance evaluation demonstrate the practicability of the proposed scheme.

Cross-chain transactions typically rely on a committee to validate transaction requests, while threshold signatures distribute authorization power among multiple nodes to eliminate single points of failure. However, existing schemes still face several practical challenges in large-scale deployments. Interactive distributed key generation incurs substantial overhead during system initialization and dynamic committee updates, while weighted authorization policies arising in proof-of-stake (PoS) settings remain difficult to support efficiently. In addition, transparent signatures expose signer identities, while full anonymity weakens accountability. To address these challenges, the SAW-TS is proposed, a succinct accountable weighted threshold signature scheme with conditional privacy for decentralized cross-chain transactions. SAW-TS employs a non-interactive hint-based initialization mechanism that eliminates interactive key generation and enables efficient committee updates. Its signature size and verification cost remain constant regardless of the committee size. Signer identities are concealed during normal verification but can be recovered when accountability is required. We formally prove that SAW-TS satisfies unforgeability, anonymity, and accountability. Experimental results show that SAW-TS maintains stable verification latency ($\approx$20 ms) and constant signature size across different committee sizes. The aggregation cost scales linearly with the number of signers, while the per-signer signing cost remains constant. Compared with hinTS (S&P 2024), SAW-TS achieves comparable performance and further supports accountability with signer privacy protection.

Internet of Drones (IoD), an important component of 6G air-based networks, uses drone cluster collaboration to accomplish efficient communication. Group authentication scheme (GAS) is essential for verifying members’ identities and controlling dynamic networking privileges in order to guarantee secure communication of drone clusters in an open IoD environment. However, current GAS schemes still struggle technically to balance security, functionality, and lightweight design, and they are unable to fully support security requirements in complex drone application scenarios with cross-domain interconnections and dynamic topology. In order to tackle the aforementioned issues, we propose a blockchain-assisted BAGAS scheme that supports distributed authentication and dynamic change of IoD members. The eCK model provides a rigorous proof of the scheme’s security, while the Scyther tool is used to further validate security properties. The scheme guarantees low computation, communication, and energy cost by utilizing Shamir’s secret sharing and Chebyshev chaotic map. The total computation cost is reduced by an average of 41.6%, the total communication cost by an average of 39.8%, and the total energy consumption by an average of 54.3% in comparison to mainstream schemes of the same type, as demonstrated by experiments (refer to Table VIII for a more detailed comparison). For drone swarm communications, the BAGAS scheme achieves synergistic optimization of communication security and performance.

Real-time traffic analytics require joint processing of privacy-sensitive vehicular data that are inherently non-IID, yet current secure multi-party computation (SMPC) pipelines either ignore data skew or exceed the sub- 200 ms latency budget of V2X links. We present RT-AW-SMPC, a self-adaptive framework that combines (i) an entropy-volume-based local weighting estimator to debias aggregation under skewed sample distributions, and (ii) an edge-optimized private set intersection protocol that aligns feature keys in only two network rounds. The entire workflow executes within a two-party additive SMPC circuit, protecting inputs from honest-but-curious roadside units and cloud servers. Experiments on the public PEMS-D7 freeway dataset show that RT-AW-SMPC reduces aggregation error by $6.3 \times$ compared with a uniform-weight SMPC baseline, completes each computation round in 25 ms-well below the V2X hard limit-and caps per-vehicle uplink traffic at 2.3 KB. These results indicate that accurate, contribution-aware statistics can be produced within strict real-time and privacy constraints, making RT-AW-SMPC a practical cryptographic substrate for intelligent transportation systems.

Wildcard keyword search enables the client to perform wildcard queries over the encrypted database. Wildcard symmetric searchable encryption (wildcard SSE) appears to be a practical solution. However, it is vulnerable to false positives in query results due to its reliance on keyword feature extraction and approximate membership data structures. In contrast, wild-card asymmetric searchable encryption (wildcard ASE) ensures accuracy, but its practicality is limited by the high search latency incurred by public-key operations. To achieve the best of wildcard SSE and ASE, we propose F-WSSE, a novel false-positive-free wildcard SSE scheme in the symmetric-key setting that offers both high search efficiency and guaranteed accuracy. Specifically, we design a new cryptographic construction, ciphertext-masked symmetric-key hidden vector encryption (CM-SHVE), which ensures ciphertext randomness and features a concise secret key. Based on CM-SHVE, F-WSSE achieves query results without false positives in the symmetric-key setting. Additionally, we leverage a fragmentation technique to support dual-wildcard keyword queries, i.e., queries containing both single-and multi-character wildcards. Our evaluation demonstrates that the search efficiency of F-WSSE outperforms the existing wildcard ASE scheme by several orders of magnitude, while delivering comparable search performance to the state-of-the-art wildcard SSE schemes.