With the rapid growth of mobile applications, large volumes of private data are continuously generated on mobile devices and increasingly outsourced to cloud storage services. Due to the limited computational and energy resources of mobile devices, enabling efficient and secure periodic auditing of cloud stored data remains a challenging task. Existing cloud data auditing schemes, such as Provable Data Possession and Proof of Retrievability, require computation-intensive operations that are impractical for resource-constrained mobile environments. To address this challenge, we propose MIDAS, a mobile-friendly data auditing scheme that supports secure outsourcing of auditing metadata with balanced resource utilization. MIDAS adopts a two-phase auditing metadata structure, in which computation intensive operations are offloaded to edge nodes, while mobile devices only perform lightweight processing. In addition, identity information of edge nodes is embedded into the auditing metadata to support traceability and accountability. To further improve scalability, we design a resource scheduling model for Multi MU and Multi-EN scenarios and propose the proportional load balanced scheduling algorithm to achieve efficient and load balanced metadata generation. The security of MIDAS is rigorously proven by reducing it to the discrete logarithm problem in the RSA quadratic residue subgroup within the random oracle model. Experimental results in a real-world environment demonstrate that MIDAS significantly reduces computational overhead on mobile devices, maintains acceptable communication cost, and achieves superior scalability compared with existing schemes.

Deep learning (DL) models are increasingly deployed in safety-critical applications such as face recognition, autonomous driving, and medical diagnosis. Despite their impressive accuracy, they remain vulnerable to adversarial examples - subtle perturbations that can cause incorrect predictions, i.e., the robustness issues. While adversarial training improves robustness against known attacks, it often fails to generalize to unseen or stronger threats, revealing a critical gap in robustness generalization. In this work, we propose a dual-model fuzzing framework to enhance generalized robustness in DL models. Central to our method is a lightweight metric, the Lagrangian Information Bottleneck (LIB), which guides entropy-based mutation toward semantically meaningful and high-risk regions of the input space. The executor uses a resistant model and a more error-prone vulnerable model; their prediction consistency forms the basis of agreement mining, a label-free oracle for isolating decision-boundary samples. To ensure fuzzing effectiveness, we further introduce a task-driven seed selection strategy (e.g., SSIM for vision) that filters out low-quality inputs. We implement a prototype, TWINFUZZ, and evaluate it on six benchmark datasets and nine DL models. Compared with state-of-the-art testing approaches, TWINFUZZ achieves superior improvements in both training-specific and generalized robustness.

Federated learning (FL) increasingly needs machine unlearning to comply with privacy regulations. However, existing federated unlearning approaches may overlook the overlapping information between the unlearning and remaining data, leading to ineffective unlearning and unfairness between clients. In this work, we revisit federated unlearning through the lens of memorization. We argue that unlearning should mainly remove the unique memorized information attributable to the data to be forgotten, while preserving overlapping patterns that are also supported by the remaining data. Specifically, we propose Grouped Memorization Evaluation, an example-level metric that separates memorized knowledge from overlapping knowledge. Building on this metric, we introduce Federated Memorization Pruning (FedMemPrune), a pruning-based unlearning approach that resets redundant parameters responsible for memorization. Extensive experiments show that FedMemPrune closely matches retraining-based unlearning baselines while more effectively eliminating memorization than existing federated unlearning algorithms, yielding strong unlearning performance without sacrificing the utility of retained knowledge.

Software security has been a long-standing and prominent topic in both industry and academia. However, with the increasing deployment of smart devices across various architectures, there is now a significant demand for cross-architecture software. For instance, the Heartbleed vulnerability (CVE-2014-0160), classified as CWE-125 (Out-of-bounds Read) and disclosed in the OpenSSL library in 2014, serves as a prime example of a widely-deployed software vulnerability capable of affecting systems across diverse computing environments due to OpenSSL’s broad adoption. More broadly, memory-related vulnerabilities remain a persistent and significant threat, accounting for a substantial proportion of reported CVEs in recent years. Moreover, performing static cross-architecture vulnerability analysis on binary code poses particular challenges due to the variations in instruction sets across different architectures. In this paper, we present a novel static approach, called BinCros, to identify known vulnerabilities across different optimization levels and CPU architectures in binary code. It mainly consists of three phases: 1) Generating ground-truth intermediate representation (IR) data from binary code based on domain knowledge. To address the cross-architecture problem, we consider IR, which is a set of smaller, lower-level instructions that break down, describe, and capture all the effects of an instruction from standard architectures like x86, ARM, and MIPS; 2) Learning good embeddings based on the cross-architecture ground-truth datasets. We employ a code-code learning method to capture the semantic differences and maximize the distribution divergences between vulnerable and non-vulnerable samples; 3) Building a prediction model based on high-level feature representations. To demonstrate the effectiveness of BinCros, we conducted experiments with a series of baselines including single architecture-based techniques, cross-architecture-based techniques, and so on. Experimental results show that BinCros outperforms the baselines by at least 15% in terms of F1-measure in almost all cases. We believe this work will inspire other researchers to consider natural language processing-related techniques for cross-architecture software vulnerability detection.

The rapid evolution of large language models (LLMs) towards autonomous Agentic artificial intelligence (AI) necessitates a systemic overhaul across algorithms, infrastructure, and architectures. This paper presents a unified view of the “Agentic AI Infrastructure,” connecting research threads often studied in isolation. First, post-training algorithms are reviewed, contrasting traditional reinforcement learning (RL) with emerging reasoning-centric methods and test-time scaling strategies. Next, the transition of RL training frameworks is analyzed from monolithic, colocated designs to disaggregated, asynchronous architectures tailored for the extreme variance of agentic rollouts. Furthermore, progress in agent construction is synthesized, covering reflection, planning, tool use, and multi-agent collaboration. By integrating these layers, the paper elucidates how agentic AI systems impose unique demands on underlying training systems. Finally, open challenges are outlined by covering capability scaling, efficiency, safety, privacy, and governance for reliable real-world agentic AI deployment.

To ensure data robustness, users typically create replicas of critical data and store them on multiple servers. However, due to server failures or malicious attacks, these replicas may face the risk of loss or tampering. Therefore, periodic auditing of data replicas is necessary to ensure their integrity. Existing solutions perform periodic auditing with generating metadata for each replica individually. However, generating auditing metadata for every replica incurs significant computational overhead, and storing metadata for multiple replicas also imposes a considerable storage burden. To reduce this overhead and optimize the efficiency of auditing towards multiple replicas, we propose collusion-resistant multi-replica data auditing with optimized metadata generation (CRMRDA). First, CRMRDA enhances replica generation efficiency by employing symmetric encryption and random masking. An indistinguishable challenge strategy is introduced, making the number of generated auditing metadata copies independent of the number of replicas. Second, we construct a security model for multi-replica data possession that allows server collusion and provide a formal security proof for CRMRDA. In addition, CRMRDA supports practical features such as dynamic operations and batch auditing. Finally, the efficiency of CRMRDA is evaluated in an experimental environment consisting of four servers, one third-party auditor, and one data owner. Compared to the latest multi-replica data auditing schemes, CRMRDA demonstrates lower computational overhead in replica generation, metadata generation, and periodic auditing.

Deep Learning (DL) powered by Deep Neural Networks (DNNs) has revolutionized various domains, yet understanding the intricacies of DNN decision-making and learning processes remains a significant challenge. Recent investigations have uncovered an interesting memorization phenomenon in which DNNs tend to memorize specific details from examples rather than learning general patterns, affecting model generalization, security, and privacy. This raises critical questions about the nature of generalization in DNNs and their susceptibility to security breaches. In this survey, we present a systematic framework to organize memorization definitions based on the generalization and security/privacy domains and summarize memorization evaluation methods at both the example and model levels. Through a comprehensive literature review, we explore DNN memorization behaviors and their impacts on security and privacy. We also introduce privacy vulnerabilities caused by memorization and the phenomenon of forgetting and explore its connection with memorization. Furthermore, we spotlight various applications leveraging memorization and forgetting mechanisms, including noisy label learning, privacy preservation, and model enhancement. This survey offers the first-in-kind understanding of memorization in DNNs, providing insights into its challenges and opportunities for enhancing AI development while addressing critical ethical concerns.

Membership inference (MI) attacks reveal that machine learning (ML) models can leak private information about their training samples. Cutout augmentation has been considered a defense mechanism against MI attacks. By randomly masking out square regions of input images during ML model training, cutout can weaken the model's memorization of original training images. However, existing research overlooks the impact of intensity (i.e., the side length of masked squares in the cutout) on privacy leakage. In this paper, we first reveal that ML models trained with cutout at certain intensities can actually increase privacy leakage. This finding is obtained by applying existing MI attacks to evaluate the privacy leakage of ML models trained at different intensities. These MI attacks query the ML model using the same single attack intensity as in training to generate augmented versions of query images, which fails to fully exploit this vulnerability. By empirically analyzing the optimal attack intensity that maximizes the attack success rate, we then find that this optimal attack intensity may differ from the training intensity and vary within a range. Therefore, we propose a novel MI attack that aggregates predictions over a sequence of intensities to cover this range. Experimental results demonstrate that our proposed attack consistently outperforms existing methods across various datasets and model architectures.

Autonomous self-hosted AI agent platforms are rapidly evolving from prompt-response assistants into persistent systems that can maintain long-lived state, invoke tools, ingest external content, and execute environment-changing actions. While this transition enables practical automation, it also introduces lifecycle security risks that cannot be fully explained by prompt-level analysis alone. In this paper, a security analysis of OpenClaw is presented, with OpenClaw serving as a representative autonomous agent operating environment and a concrete case study for broader security challenges in emerging agent ecosys-tems. A trust-boundary-first perspective is adopted to examine how attacks propagate across five boundary classes: Channel-Access, Session-and-State, Tool-Execution, External-Content, and Extension Supply-Chain. The results presented in this paper show that threats such as indirect prompt injection, memory poisoning, unsafe tool invocation, data exfiltration, and malicious skill abuse are not isolated anomalies; rather, they are stage-specific mani-festations of a common systems problem in which untrusted influence progressively crosses into higher-privilege contexts. Based on this analysis, the defense-in-depth implications for OpenClaw deployments are discussed, including boundary-aware isolation, capability-scoped tool mediation, memory integrity controls, extension governance, and evidence-oriented operational oversight. This study provides a practical framework for evaluating and hardening long-running, tool-capable, autonomous AI agents in realistic deployment settings.

Machine Learning (ML) demonstrates dermatologist-level accuracy in skin cancer diagnosis, yet its practical adoption is constrained by data silos and privacy issues. While Federated Learning (FL) addresses these limitations, it remains susceptible to data heterogeneity and gradient leakage attacks. To overcome these challenges, we introduce a privacy-preserving FL framework tailored for encrypted dermoscopic image analysis. Our proposed framework integrates a Fully Homomorphic Encryption (FHE)-enabled variant of Stochastic Controlled Averaging (SCA), enhancing model convergence with Non-IID data. To further minimize computational and communication overhead, we develop a layer-wise Packed FHE (PFHE) approach that improves the efficiency of encrypted model aggregation. Moreover, we design a lightweight, FHE-Friendly Deep Neural Network (DNN) optimized for encrypted inference. This architecture incorporates a DO-EncConv module specifically engineered to balance inference efficiency and precision within FHE computational constraints. Experimental results on the HAM10000 and ISIC2019 datasets confirm the effectiveness of our proposed framework, demonstrating F1-Score improvements of 2.2% and 4.0%, respectively, over baseline FL approaches. Additionally, our method achieves communication overhead reductions of 94.85% and 93.48%, while encrypted inference is performed in approximately 17.8 seconds per sample, with less than 2% accuracy degradation compared to centralized plaintext models. These outcomes underscore the framework's practicality and effectiveness for secure, scalable clinical deployment.

Process variables (PVs) provide the process evidence needed for process-aware security monitoring in industrial cyber-physical systems (CPSs). However, existing supervisory infrastructures expose only the subset of PV values recorded by historians, leaving many additional runtime PV values unobserved. To address this incomplete process visibility, we study the problem of recovering PV fields and their semantics directly from raw industrial network traffic through protocol reverse engineering (PRE). In this setting, existing PRE methods face two practical challenges: PV-carrying communication is mixed with heterogeneous runtime traffic, and PV-carrying payloads are often long and deployment-specific. Mixed runtime traffic obscures the PV-carrying communication paths, while long payloads create a vast segmentation space in which early segmentation errors can propagate and corrupt the recovery of later fields under sequential inference. In this paper, we formulate the recovery of PV fields from raw network traffic as a search-based optimization problem. Our key insight is that non-sequentially identifying correct segmentations in such a vast segmentation space can be cast as an optimization problem and addressed by searching for near-optimal solutions. We propose PVParser to approach this goal. PVParser first reduces the search space by identifying the PV-carrying payloads from network traffic via a periodic pattern detection mechanism. It then employs a modified Monte Carlo Tree Search to explore near-optimal segmentations, reducing error propagation from incorrect early boundary decisions. Experiments on three representative industrial CPS datasets demonstrate that PVParser achieves high accuracy and F1-score in PV-carrying payload localization and PV field inference, outperforming six state-of-the-art PRE approaches by a significant margin.

The rapid growth of the low-altitude economy, including unmanned aerial vehicles (UAVs) and urban air mobility (UAM), is reshaping industries from transportation to emergency response. Powered by advances in fifth-generation (5G) and 5G-advanced (5.5G) connectivity, artificial intelligence (AI), and new energy systems, these platforms are becoming increasingly autonomous and capable. However, their growing software complexity introduces critical cybersecurity risks. Vulnerabilities in communication protocols, onboard firmware, and AI systems can be exploited to hijack UAVs, disrupt operations, or leak sensitive data. While research has addressed isolated aspects, a unified security perspective is still lacking. This work presents a systematic review of software-level security challenges and defenses in low-altitude UAV/UAM systems. We first categorize major attack surfaces across communication, firmware, and AI layers. Furthermore, we survey defense mechanisms suited to real-time, resource-constrained aerial platforms. Finally, we propose future directions, including quantum-resistant communication protocols, hardware-software cosecurity, and edge-AI-driven architectures. Our work aims to inform researchers, practitioners, and regulators in developing integrated, resilient security strategies for the evolving low-altitude ecosystem.

Content management systems (CMS) have been the preferred option for rapidly developing web applications due to their convenience. Their extensive plugin ecosystems also allow for quick and easy expansion of web application functionality. With the increasing complexity of plugins, there has been a surge in plugin vulnerabilities, which pose a serious threat to the overall security of web applications. Current methods for analyzing plugins simply apply typical web application analysis techniques, which fail to consider the unique characteristics of plugins and lead to inaccuracy. This paper presents PSSA, a novel method for detecting web vulnerabilities in PHP-based CMS plugins. The proposed approach incorporates an in-depth analysis of the CMS framework's context during plugin analysis and enhances the analysis of PHP object-oriented code to achieve precise vulnerability detection. To evaluate its effectiveness, we compare PSSA with existing tools for vulnerability detection using established vulnerability datasets. Our results demonstrate that PSSA outperforms other tools, detecting the highest number of vulnerabilities while minimizing false positives. Additionally, we apply PSSA in a comprehensive survey of popular WordPress plugins, evaluating 980 extensively used plugins. This thorough investigation brings to light 178 new vulnerabilities, 124 of which are found in plugins boasting over 1 million downloads. Our efforts also contribute to the acknowledgment of 82 CVE identifiers, further underscoring the impact and necessity of our research in enhancing CMS plugin security.

Sign Language Translation (SLT) converts continuous sign videos into spoken language text, yet current models, whether gloss-based or gloss-free, struggle with long or discourse-level inputs. Recent architectures such as TwoStreamNetwork and CV-SLT have nearly saturated short-sentence accuracy, but their performance degrades on long sentences and multi-sentence paragraphs. In real scenarios such as news, interviews or daily conversations, signers naturally produce extended signing sequences with complex contextual dependencies. Moreover, identifying precise gloss boundaries remains a key obstacle, while gloss-based methods, though often superior, incur heavy annotation costs. The community therefore needs a solution that mitigates gloss dependency while preserving translation quality.We present BoostSLT , a context-aware framework enhancing semantic consistency over long sign sequences without gloss supervision. Instead of requiring explicit gloss segmentation, BoostSLT introduces an Energy-Aware Temporal Segmentation (EAT-Seg) module that dynamically partitions videos into semantically coherent fragments, followed by a Diffusion-based Semantic Reconstruction (DSR) module that stitches and refines fragment-level translations into globally fluent paragraphs. The framework is plug-and-play and model-agnostic, seamlessly integrating with existing gloss-based or gloss-free pipelines across languages. Experiments on PHOENIX-2014T, CSL-Daily, and Auslan-Daily show consistent BLEU and Rouge-L gains, confirming that diffusion-driven semantic reconstruction effectively bridges local accuracy and global coherence in long-form SLT.

Untargeted poisoning membership inference (PMI) attacks are a newly emerging privacy threat that evaluates the impact of poisoned samples on the privacy leakage risk in the model's training dataset. Existing approaches typically select target samples randomly from a candidate dataset to generate poisoned samples, which are then injected into the training dataset. While effective in amplifying privacy leakage risks, this random selection strategy overlooks the fact that each poisoned sample contributes unequally to the attack. In this article, we first observe that randomly selected target samples may be distant from and dispersed relative to high-confidence benign samples, which restricts the effectiveness of membership inference attacks. We then show that selecting target samples with high confidence in their ground-truth class to generate poisoned samples contributes more significantly to the attack. Therefore, we propose a novel untargeted PMI attack incorporating the target sample selection and enhancement. Specifically, we train shadow models to select the highest-confidence target samples for poison generation. To further enhance the effectiveness of the attack, we introduce a noise generator that adds adversarial perturbations to the selected target samples. Experimental results demonstrate that our approach significantly improves the attack success rate (e.g., 85.6% compared to the baseline of 71.9%). Notably, the ablation study shows that our noise generator enhances privacy leakage risks even when target samples are selected randomly, highlighting its effectiveness and broad applicability.

Auditing differential privacy (DP) guarantees often relies on querying trained models with specially crafted queries, such as canaries, examples differing between two neighboring datasets. However, in this work, we revisit this common approach and identify a fundamental limitation: canary-based queries may not capture the strongest privacy leakage, as the most informative queries can shift during the training process. This mismatch can result in loose lower bounds on the privacy parameter epsilon, underestimating potential risks from query-based adversaries. To address this issue, we propose two methods. First, we introduce a consistent and optimizable surrogate privacy loss function that better aligns with the true privacy loss, called Privacy-loss Maximization Method (PMM), enabling systematic discovery of stronger queries through optimization. Second, we analyze how the optimal queries evolve with model training and propose a gradient-aligned query generation algorithm, called Gradient-Guided Querying (GGQ), that rapidly identifies high-risk queries by aligning their gradients with the distribution of model parameters. Empirical evaluations across multiple tasks demonstrate that our methods consistently produce stronger privacy audit results, offering a more accurate assessment of the privacy risks associated with training algorithms.

Decentralized finance has experienced phenomenal growth, revolutionizing the landscape of financial transactions and asset management via blockchain. Yet, this swift growth brings with it substantial challenges, notably the surge in scam tokens, imposing significant security threats on cryptocurrency investments and trading. Existing detection methods of scam token, primarily relying on analyzing contract codes or transaction patterns, struggle to catch increasingly sophisticated tactics employed by scammers. For example, contract-based analysis are unable to identify scams lacking overt malicious code, e.g., most rugpulls, while transaction-based methods generally lack the foresight to early-detect potential risks. In this paper, we present TOKENSCOUT, the first temporal GNN-based framework for scam token early detection. TOKEN SCOUT formulates token transfer data as a dynamic temporal attributed multigraph and leverages the temporal graph learning model to learn graph representations. It also builds a graph rep resentation refining model based on contrastive learning to learn a more discriminative representation space for risk identification. We evaluated TOKENSCOUT using a comprehensive dataset of 214,084 standard ERC20 tokens from 2015 to February 2023. TOKENSCOUT achieves a balanced accuracy of 98.41%. Additionally, from March to May 2023, deploying TOKENSCOUT on Ethereum effectively identified 706 rugpulls, 174 honeypots, and 90 Ponzi schemes, thereby alerting to potential risks exceeding $240 million.

Federated learning (FL) is a key paradigm for deploying AI models across large numbers of Internet of Things (IoT) devices in edge computing. While FL avoids uploading raw data to a central server, client privacy remains vulnerable during new client integration, when previously unseen devices first register their identities and cryptographic keys. A malicious or semi-honest central server (CS) can manipulate training to isolate target gradients, reconstruct local data, and tamper with aggregation. We study the Identity Forgery and Gradient Inversion Attack (IFGIA) against federated edge learning. By fabricating virtual clients and exploiting secure aggregation, a malicious CS can recover target gradients with success rates above 99.5% under realistic edge settings, revealing a critical weakness in existing privacy-preserving and verifiable FL schemes. To defend against IFGIA, we propose Robust Federated Learning (RFL), a framework tailored for edge computing that combines model splitting between edge clients and edge servers, lightweight differential privacy on intermediate representations, and split verification using digital signatures and homomorphic hashes. Experiments show that RFL reduces IFGIA's success rate to 73.6%, shrinks per-client communication from 375 MB to 40 KB, accelerates edge-side training by at least 10 & times;, and maintains competitive accuracy.

Reliable protocol knowledge is often difficult to obtain in industrial networks, as industrial communications come with limited documentation, vendor-specific encodings, and opaque payloads. This lack of transparency hinders message interpretation and protocol analysis. To recover this missing protocol knowledge, network-trace-based protocol reverse engineering (PRE) infers message structure, field roles, and interaction logic directly from recorded traces. This enables protocol-aware intrusion detection, process monitoring, and protocol testing and fuzzing without access to device internals. Although PRE has advanced rapidly, existing techniques are developed under diverse objectives and assumptions. As a result, it is often unclear how isolated results relate to an end-to-end reverse-engineering workflow, and how evaluation outcomes should be compared across tasks and protocols. In this article, we cast reverse engineering of industrial protocols from network traces as a task-driven pipeline and articulate a unified task decomposition spanning message type identification, protocol syntax and semantic inference, payload pattern recognition and semantic inference, and protocol state machine reconstruction. For each task, we describe key methodological themes, common evaluation practices, and practical limitations that affect robustness and deployability in industrial settings. We further discuss security, privacy, and ethical risks that accompany increasingly capable PRE, and identify promising research directions toward more systematic, dependable, and deployment-oriented PRE methodologies.