The proliferation of large language models has intensified demands for reliable content attribution, yet existing watermarking techniques face a fundamental trilemma: they cannot simultaneously optimize for robustness against attacks, minimal text quality degradation, and detection efficiency. To resolve this challenge, we propose ARGH-Mark, a novel watermarking framework that integrates three synergistic innovations: (1) Anchor-synchronized phase recovery for maintaining detection integrity under insertion/deletion attacks, (2) RG-balanced vocabulary modulation that dynamically partitions lexicons via contextual hashing to preserve generation quality, and (3) Hamming-based error correction enabling single-bit error rectification through algebraic coding. Comprehensive evaluations across question answering (ELI5), summarization (CNN/DailyMail), and text generation (C4) demonstrate state-of-the-art performance: the proposed ARGH-Mark framework achieves near-perfect match rate and bit accuracy across diverse configurations, while preserving the quality of the generated text. It significantly reduces detection latency, enabling real-time extraction, and maintains high robustness against token tampering attacks through integrated Hamming error correction, ensuring reliable attribution in adversarial settings. ARGH-Mark achieves a new Pareto frontier in the watermarking design space and advances trustworthy deployment of generative AI in alignment-critical applications.

Graph Federated Learning (FL) has attracted extensive attention in recent years due to its ability to train global graph models in a distributed manner without exposing original local data. However, fine-grained data heterogeneity remains largely overlooked in collaborative graph model training. Existing graph FL methods that address heterogeneity are mostly adapted from traditional FL and fail to account for the unique complexity of graph-specific heterogeneity. Specifically, graph heterogeneity can be further decomposed into feature heterogeneity and structural heterogeneity, which are tightly coupled during local training. To address this issue, we propose a novel local graph module, Feature and Structure Decoupling Convolution (FSD-Conv), designed to disentangle the interplay between feature bias and structural bias. With FSD-Conv, clients can learn feature-related yet structure-unbiased representations, thereby alleviating the adverse impact of graph heterogeneity in federated training. Furthermore, we introduce FedFSD, a personalized graph FL framework that achieves effective personalized model aggregation through an explainable neural network operating in a low-dimensional space. Extensive experiments on six graph datasets under both disjoint and overlapping client partitioning schemes demonstrate the effectiveness of FedFSD in handling complex graph data heterogeneity.

With the rapid proliferation of large language models (LLMs), their misuse has engendered significant societal concern. Accordingly, the development of efficient and robust AI-generated text detection has emerged as a pivotal strategy for mitigating the potential abuse of LLMs. Existing approaches predominantly rely on a compute-intensive fine-tuning paradigm to capture the implicit stylistic cues of AI-generated text. However, fine-tuning such detectors not only incurs substantial overhead but also yields poor robustness, as classification based solely on stylistic cues fails against textual adversarial attack. This paper introduces ColorFP, a robust AI-generated text detection framework based on fixed vocabulary partitioning and half-bit fingerprinting. Specifically, to achieve the optimal trade-off between detection success rates and generated text quality, we introduce a novel probabilistically biased half-bit fingerprint encoding. To enhance detection robustness, we employ a static hash-seeded pseudorandom number generator to ensure consistent vocabulary partitioning across distinct fingerprints, thereby mitigating the challenges posed by textual adversarial attacks. To comprehensively evaluate ColorFP, we assembled a corpus of fingerprinted text outputs from five LLMs; results show that ColorFP outperforms all baselines–achieving a 93.70 × compared to state-of-the-art approaches.

Federated Graph Learning (FGL) enables collaborative training across distributed clients without sharing raw graph data. However, its performance is severely hindered by graph-specific heterogeneity arising from divergent node feature distributions and disparate graph structures. Existing FGL methods primarily focus on aligning or personalizing node features but largely overlook the role of structural knowledge, leading to aggregation-induced representation drift during message passing. We observe that structural heterogeneity often originates from feature-driven connection biases shaped by local data collection practices or user preferences. To address this, we propose \textbf{Fed-Kalter}, a novel FGL framework that integrates Kalman filtering principles into graph neural networks. Fed-Kalter introduces Kalter-Conv, a graph convolution grounded in a Kalman framework with learnable dynamics, which treats structural embeddings as latent states and feature-augmented neighborhoods as noisy observations, thereby filtering feature-induced structural noise in a layer-wise manner. Only structural parameters are aggregated globally, enabling effective cross-client knowledge transfer while preserving local personalization. Extensive experiments on 16 graph classification datasets spanning 4 domains demonstrate that Fed-Kalter consistently outperforms state-of-the-art FGL methods. Further ablation and hyperparameter studies confirm its robustness, efficiency, and effectiveness in mitigating structural heterogeneity.

Model watermarking techniques can embed watermark information into the protected model for ownership declaration by constructing specific input-output pairs. However, existing watermarks are easily removed when facing model stealing attacks, and make it difficult for model owners to effectively verify the copyright of stolen models. In this paper, we analyze the root cause of the failure of current watermarking methods under model stealing scenarios and then explore potential solutions. Specifically, we introduce a robust watermarking framework, DeepTracer, which leverages a novel watermark samples construction method and a same-class coupling loss constraint. DeepTracer can incur a high-coupling model between watermark task and primary task that makes adversaries inevitably learn the hidden watermark task when stealing the primary task functionality. Furthermore, we propose an effective watermark samples filtering mechanism that elaborately select watermark key samples used in model ownership verification to enhance the reliability of watermarks. Extensive experiments across multiple datasets and models demonstrate that our method surpasses existing approaches in defending against various model stealing attacks, as well as watermark attacks, and achieves new state-of-the-art effectiveness and robustness.

The rise of deep learning models in the digital era has raised substantial concerns regarding the generation of Not-Safe-for-Work content (NSFW). Existing defense methods primarily involve model fine-tuning and post-hoc content moderation. Nevertheless, these approaches largely lack scalability in eliminating harmful content, degrade the quality of benign image generation, or incur high inference costs. To address these challenges, we propose an innovative framework named Buster, which injects a semantic backdoor into the text encoder to prevent NSFW content generation. Buster leverages deep semantic information rather than explicit prompts as triggers, redirecting NSFW prompts towards targeted benign prompts. Additionally, Buster employs energy-based training data generation through Langevin dynamics for adversarial knowledge augmentation, thereby ensuring robustness in harmful concept definition. This approach demonstrates exceptional resilience and scalability in mitigating NSFW content. Particularly, Buster fine-tunes the text encoder of Text-to-Image models within merely five minutes, showcasing its high efficiency. Our extensive experiments denote that Buster outperforms nine state-of-the-art baselines, achieving a superior NSFW content removal rate of at least 91.2

In many unbalanced private set intersection (uPSI) applications of the client–server setting, the server needs to perform uPSI with multiple clients. Cong et al. (ACM CCS’21) proposed a state-of-the-art (SOTA) uPSI protocol based on fully homomorphic encryption (FHE), achieving malicious security by employing an oblivious pseudorandom function (OPRF) in the pre-processing phase. However, re-executing existing uPSI protocols with each client imposes significant computational overhead for the server. In this paper, we present JAGUAR, a maliciously secure and efficient uPSI protocol designed for this setting. JAGUAR reduces online computation through a Divide-and-Combine optimization, requiring only 𝒪(√(|X|)) homomorphic multiplications. Furthermore, it employs a novel fixed VOLE-based OPRF that enables reusable and lightweight pre-processing across multiple clients. Experimental results demonstrate that JAGUAR achieves up to 2.7× improvement in online runtime compared to the SOTA protocol in LAN. In multi-client scenarios, JAGUAR further outperforms existing protocols by a wide margin in terms of scalability and overall performance.

The rapid advancement of deep learning has turned models into highly valuable assets due to their reliance on massive data and costly training processes. However, these models are increasingly vulnerable to leakage and theft, highlighting the critical need for robust intellectual property protection. Model watermarking has emerged as an effective solution, with black-box watermarking gaining significant attention for its practicality and flexibility. Nonetheless, existing black-box methods often fail to better balance covertness (hiding the watermark to prevent detection and forgery) and robustness (ensuring the watermark resists removal)-two essential properties for real-world copyright verification. In this paper, we propose ComMark, a novel black-box model watermarking framework that leverages frequency-domain transformations to generate compressed, covert, and attack-resistant watermark samples by filtering out high-frequency information. To further enhance watermark robustness, our method incorporates simulated attack scenarios and a similarity loss during training. Comprehensive evaluations across diverse datasets and architectures demonstrate that ComMark achieves state-of-the-art performance in both covertness and robustness. Furthermore, we extend its applicability beyond image recognition to tasks including speech recognition, sentiment analysis, image generation, image captioning, and video recognition, underscoring its versatility and broad applicability.

Existing ViT backdoor attacks based on backbone-overwriting full-tuning are computationally expensive and inflict performance degradation. This has forced adversaries towards the Visual Parameter-Efficient Fine-Tuning (PEFT) paradigm, dominated by adapter-based (e.g., LoRA) and prompt-based (e.g., VPT) approaches. While adapter security has seen initial study, the risks of the burgeoning prompt-based ecosystem remain critically unexplored. We fill this critical gap, exposing how the evolution of VPT towards dynamic, context-aware architectures innately creates a far more dangerous, emergent threat. This vulnerability arises even though these dynamic modules unlock superior benign performance. We propose VIPER, an attack framework built on a lightweight, dynamic Visual Prompt Generator (VPG) that demonstrates this vulnerability. Critically, this dynamic architecture enables Functional Fusion: an emergent phenomenon where malicious logic and benign task utility are inseparably fused into the same sparse, high-magnitude parameter core. This fusion creates an unsolvable ``hostage" dilemma, as pruning the attack necessarily destroys the benign performance.Comprehensive evaluations show VIPER resolves the attacker's trilemma: VIPER not only achieves state-of-the-art performance on clean data, but also maintains near-100\% ASR even under 90\% VPG-module pruning (where LoRA attacks collapse), while adding only an imperceptible 0.06ms (1.16\%) of inference latency. VIPER's results, driven by Functional Fusion, expose a new, paradigm-level risk in dynamic prompt architectures.

Most existing secure neural network inference protocols based on secure multi-party computation (MPC) typically support at most four participants, demonstrating severely limited scalability. Liu et al. (USENIX Security'24) presented the first relatively practical approach by utilizing Shamir secret sharing with Mersenne prime fields. However, when processing deeper neural networks such as VGG16, their protocols incur substantial communication overhead, resulting in particularly significant latency in wide-area network (WAN) environments. In this paper, we propose a high-throughput and scalable MPC protocol for neural network inference against semi-honest adversaries in the honest-majority setting. The core of our approach lies in leveraging packed Shamir secret sharing (PSS) to enable parallel computation and reduce communication complexity. The main contributions are three-fold: i) We present a communication-efficient protocol for vector-matrix multiplication, based on our newly defined notion of vector-matrix multiplication-friendly random share tuples. ii) We design the filter packing approach that enables parallel convolution. iii) We further extend all non-linear protocols based on Shamir secret sharing to the PSS-based protocols for achieving parallel non-linear operations. Extensive experiments across various datasets and neural networks demonstrate the superiority of our approach in WAN. Compared to Liu et al. (USENIX Security'24), our scheme reduces the communication upto 5.85x, 11.17x, and 6.83x in offline, online and total communication overhead, respectively. In addition, our scheme is upto 1.59x, 2.61x, and 1.75x faster in offline, online and total running time, respectively.

Recent advancements in diffusion-based image editing pose a significant threat to the authenticity of digital visual content. Traditional embedding-based watermarking methods often introduce perceptible perturbations to maintain robustness, inevitably compromising visual fidelity. Meanwhile, existing zero-watermarking approaches, typically relying on global image features, struggle to withstand sophisticated manipulations. In this work, we reveal a critical insight: while individual image patches undergo substantial alterations during AI-based editing, the relational distance between patch pairs remain largely invariant. Leveraging this property, we propose Relational Zero-Watermarking (Rel-Zero), a novel framework that requires no modification to the original image but derives a unique zero-watermark from these editing-invariant patch relations. By grounding the watermark in intrinsic structural consistency rather than absolute appearance, Rel-Zero provides a non-invasive yet resilient mechanism for content authentication. Extensive experiments demonstrate that Rel-Zero achieves substantially improved robustness across diverse editing models and manipulations compared to prior zero-watermarking approaches.

Generative vision-language models like Stable Diffusion demonstrate remarkable capabilities in creative media synthesis, but they also pose substantial risks of producing unsafe, offensive, or culturally inappropriate content when prompted adversarially. Current defenses struggle to align outputs with human values without sacrificing generation quality or incurring high costs. To address these challenges, we introduce VALOR (Value-Aligned LLM-Overseen Rewriter), a modular, zero-shot agentic framework for safer and more helpful text-to-image generation. VALOR integrates layered prompt analysis with human-aligned value reasoning: a multi-level NSFW detector filters lexical and semantic risks; a cultural value alignment module identifies violations of social norms, legality, and representational ethics; and an intention disambiguator detects subtle or indirect unsafe implications. When unsafe content is detected, prompts are selectively rewritten by a large language model under dynamic, role-specific instructions designed to preserve user intent while enforcing alignment. If the generated image still fails a safety check, VALOR optionally performs a stylistic regeneration to steer the output toward a safer visual domain without altering core semantics. Experiments across adversarial, ambiguous, and value-sensitive prompts show that VALOR significantly reduces unsafe outputs by up to 100.00% while preserving prompt usefulness and creativity. These results highlight VALOR as a scalable and effective approach for deploying safe, aligned, and helpful image generation systems in open-world settings.

Private set intersection (PSI) is a hot topic in terms of privacy preservation. While numerous studies have focused on two-party PSI, there remains a notable lack of research on multiple PSI scenarios. In fact, as both parties continue to add new datasets, the need for multiple PSI often arises, accompanied by a significant overhead due to the accumulated datasets. We propose a multiple PSI protocol with semi-honest security. Based on the protocol (Pinkas et al., Crypto 2019, spot-low method), we design a streaming PSI, and every time the newly added dataset accumulates to a certain threshold, the streaming PSI are generated, leading to a notable decrease in overall overhead for the subsequent PSI. To our knowledge, this is the first protocol specifically designed for multiple PSI scenarios. Our experiments demonstrate that our protocol achieves optimal performance in terms of runtime and communication. For instance, when the initial dataset size is 2(24) and the newly added dataset size is 2(16) in both parties. Then for the second PSI, the dataset size is (2(24) + 2(16)) in both parties, our runtime is reduced to 14.6 s, and our communication overhead is reduced to 4.8MB.

Private set intersection (PSI) allows two participants to compute the intersection of their private sets without revealing any additional information beyond the intersection itself. It is known that oblivious linear evaluation (OLE) can be used to construct the online efficient PSI protocol. However, oblivious transfer (OT) and fully homomorphic encryption (FHE)-based offline OLE generation are expensive, and the online computational complexity is super-linear and still a heavy burden for large-scale sets. In this paper, we propose VCR, an efficient PSI protocol from vector OLE (VOLE) with the offline-online paradigm. Concretely, we first propose the batched short VOLE protocol to reduce offline overhead for generating VOLE tuples. Then, we design a batched private membership test protocol from pre-computed VOLE to accelerate the online computation. Experiments demonstrate that VCR outperforms prior art. Compared to state-of-the-art work, we reduce the total communication costs (resp. running time) by 341x and 9.1x (resp. 6.5x and 2.5x) on average for OT and FHE-based protocols.

With the growing use of large language models (LLMs) hosted on cloud platforms to offer inference services, privacy concerns about the potential leakage of sensitive information are escalating. Secure multi-party computation (MPC) is a promising solution to protect the privacy in LLM inference. However, MPC requires frequent inter-server communication, causing high performance overhead. Inspired by the prevalent activation sparsity of LLMs, where most neuron are not activated after non-linear activation functions, we propose an efficient private inference system, Comet. This system employs an accurate and fast predictor to predict the sparsity distribution of activation function output. Additionally, we introduce a new private inference protocol. It efficiently and securely avoids computations involving zero values by exploiting the spatial locality of the predicted sparse distribution. While this computation-avoidance approach impacts the spatiotemporal continuity of KV cache entries, we address this challenge with a low-communication overhead cache refilling strategy that merges miss requests and incorporates a prefetching mechanism. Finally, we evaluate Comet on four common LLMs and compare it with six state-of-the-art private inference systems. Comet achieves a 1.87x-2.63x speedup and a 1.94x-2.64x communication reduction.

Federated Learning (FL) enables decentralized IoT devices to collaboratively train a global model, distributed nature makes it vulnerable to poisoning and inference attacks, threatening security Previous approaches combine Robust Defense Mechanisms with cryptographic techniques for Robust Aggregation (SecAgg) to ensure security and privacy. However, schemes with strong resistance against poisoning attacks often incur high complexity, increasing ciphertext communication and computational overhead, reducing efficiency, and limiting scalability for resource-constrained IoT networks. On hand, low-complexity schemes offer higher efficiency but weaker robustness, failing to counter poisoning attacks like backdoors. To address this, we propose FedShelter, an efficient privacy-preserving framework with poisoning resistance for IoT scenarios. It achieves lightweight Robust SecAgg utilizing Two-party Computation (2PC) and incorporates customized encoding techniques to reduce communication overhead and defend against various poisoning attacks. Compared to state-of-the-art solutions (USENIX Security'22) and RoFL (S&P'23), FedShelter offers effective robustness against poisoning attacks reducing communication by up to 56x and run-time by up to 37x, providing a fast and trustworthy environment for distributed devices under resource-constrained IoT network.

Heterogeneous federated learning has emerged as a prominent research focus in recent years. Various methods have been developed to address data heterogeneity, while personalized federated learning has made strides in tackling model heterogeneity. However, these approaches often incur additional computational and communication costs. Federated distillation, a federated learning paradigm capable of addressing heterogeneity issues while reducing communication overhead, is gaining substantial attention. Nevertheless, current federated distillation methods do not differentiate the quality of logits uploaded by different clients. A large number of incorrect logits can compromise the accuracy of the final teacher logits, inevitably impacting the overall effectiveness of federated distillation. To address this, we propose a contribution-based federated distillation knowledge aggregation scheme-CoFD. This method assigns different aggregation weights to logits from different clients, resulting in more effective teacher logits to guide the distillation process for other clients' models. Specifically, we model each client's performance on each piece of public data in each round as a Multi-Armed Bandit problem and use the results of Thompson sampling as aggregation weights. Experimental results demonstrate that our method is nearly optimal compared to existing federated distillation methods. Our code is available at https://github.com/AlexWaker/CoFD.

With the widespread deployment of Deep-Learning-as-a-Service, secure multi-party computation-based outsourcing neural network (NN) inference has garnered significant attention for its high-security guarantee. Nevertheless, under the dishonest-majority setting with malicious adversaries, prior secure inference works are still costly in terms of communication and run-time. Additionally, existing outsourcing frameworks impose a substantial client-side design, which leads to obstacles in resource-constrained devices. To address the above challenges, we propose MD-SONIC, an online efficient and maliciously-secure framework for outsourcing NN inference with a dishonest majority. We first construct communication-efficient n-party protocols for the basic primitives such as fixed-point multiplication and most significant bit extraction by combining mask-sharing and TinyOT-sharing with SPDZ(2k) seamlessly. Then, we build fast secure blocks for the widely used NN operators, including matrix multiplication, ReLU, and Maxpool, on top of our basic primitives. To enable an arbitrary number of users to outsource the secure inference task to n computing servers, we propose a lightweight-client and fast $\Sigma $ paradigm named SPIN, stemming from zero-knowledge proofs. Our SPIN can be instantiated into a set of efficient outsourcing protocols over multiple algebraic structures (e.g., finite field and ring). We also conduct extensive evaluations of MD-SONIC on various neural networks. Compared to the work by Damgard et al. (IEEE S&P'19) and MD-ML (USENIX Security'24), we achieve up to 594.4 x and 45.1x online communication improvements, and improve the online execution time by at most 14.3x (resp. 20.5x) and 1.8x (resp. 2.3x ) in LAN (resp. WAN).