Horizontal multi-party data publishing enables parties with the same attributes but different records to collaboratively share synthetic data. Generative adversarial networks (GAN) excel at capturing complex distributions and generating statistically consistent samples. However, existing studies treat all parties' data equally without considering heterogeneity, approximate data distributions largely from only a single direction, and suffer from training instability under limited privacy budgets. To address these limitations, we propose MASTER, a weight-aware bidirectional GAN approach. In MASTER, each party maintains a sanitized discriminator to protect local data, while a central server coordinates two complementary generators that learn the underlying data distribution from different perspectives. Specifically, we introduce a dual-generator GAN structure, where training is enhanced by simultaneously increasing the distance between the distributions of generated samples to improve diversity and reducing the discriminators' ability to distinguish them to stabilize training and enhance sample quality. Moreover, a weight-aware fusion mechanism is designed to dynamically balance contributions from different parties and generators based on data quality, enhancing inter-party connections, generation diversity, and training stability. To compute the weights, we formulate an unsupervised integer programming problem and design an alternating optimization scheme. Our theoretical analysis demonstrates that MASTER maintains comparable computational complexity to non-private settings while providing strong differential privacy and utility guarantees. Extensive experiments on four real-world datasets and one synthetic dataset show MASTER's effectiveness.

Video recognition systems are increasingly being deployed in daily life, such as content recommendation and security monitoring. To enhance video recognition development, many institutions have released high-quality public datasets with open-source licenses for training advanced models. At the same time, these datasets are also susceptible to misuse and infringement. Dataset copyright auditing is an effective solution to identify such unauthorized use. However, existing dataset copyright solutions primarily focus on the image domain; the complex nature of video data leaves dataset copyright auditing in the video domain unexplored. Specifically, video data introduces an additional temporal dimension, which poses significant challenges to the effectiveness and stealthiness of existing methods. In this paper, we propose VICTOR, the first dataset copyright auditing approach for video recognition systems. We develop a general and stealthy sample modification strategy that enhances the output discrepancy of the target model. By modifying only a small proportion of samples (e.g., 1

Continual learning (CL) is a key paradigm that enables intelligent agents to operate autonomously in edge networks over the long term. However, continuous model updates can lead to catastrophic forgetting and representation instability in edge deployment scenarios, which may further induce Decision Boundary Drift (DBD). We propose a DBD-based adversarial attack framework that exploits class-level drift modeling and leverages the deformation of decision boundaries caused by incremental updates. We introduce multiple statistical metrics to quantify boundary drift, based on which class-level adversarial perturbations are constructed and further optimized in the input space to generate effective adversarial examples. Extensive experiments on multiple datasets and continual learning models demonstrate that the proposed method can significantly degrade model robustness, revealing non-negligible security risks in continuously evolving learning systems. Inspired by the security and trustworthiness requirements of edge intelligent agents, we systematically study and quantify DBD and its associated security risks in continual learning. Our findings reveal a practical yet underestimated attack surface and provide a foundation for future research on secure and robust continual learning systems.

Causal inference plays a crucial role in scientific research across multiple disciplines. Estimating causal effects, particularly the average treatment effect (ATE), from observational data has garnered significant attention. However, computing the ATE from real-world observational data poses substantial privacy risks to users. Differential privacy, which offers strict theoretical guarantees, has emerged as a standard approach for privacy-preserving data analysis. However, existing differentially private ATE estimation works rely on specific assumptions, provide limited privacy protection, or fail to offer comprehensive information protection. To this end, we introduce PrivATE, a practical ATE estimation framework that ensures differential privacy. In fact, various scenarios require varying levels of privacy protection. For example, only test scores are generally sensitive information in education evaluation, while all types of medical record data are usually private. To accommodate different privacy requirements, we design two levels (i.e., label-level and sample-level) of privacy protection in PrivATE. By deriving an adaptive matching limit, PrivATE effectively balances noise-induced error and matching error, leading to a more accurate estimate of ATE. Our evaluation validates the effectiveness of PrivATE. PrivATE outperforms the baselines on all datasets and privacy budgets.

Previous schemes for designing secure branch prediction unit (SBPU) based on physical isolation can only offer limited security and significantly affect BPU's prediction capability, leading to prominent performance degradation. Moreover, encryption-based SBPU schemes based on periodic key re-randomization have the risk of being compromised by advanced attack algorithms, and the performance overhead is also considerable. To this end, this paper proposes conflict-invisible SBPU (CIBPU). CIBPU employs redundant storage design, load-aware indexing, and replacement design, as well as an encryption mechanism without requiring periodic key updates, to prevent attackers' perception of branch conflicts. We provide a thorough security analysis, which shows that CIBPU achieves strong security throughout the BPU's lifecycle. We implement CIBPU in a RISC-V core model in gem5. The experimental results show that CIBPU causes an average performance overhead of only 2.9%-4.0% with acceptable hardware storage overhead, which is the lowest among the state-of-the-art SBPU schemes. CIBPU has also been implemented in the open-source RISC-V core, SonicBOOM, which is then burned onto an FPGA board. The evaluation based on the board shows an average performance degradation of 2.01%, which is approximately consistent with the result obtained in gem5.

Truth discovery has emerged as an effective tool to mitigate data inconsistency in crowdsensing by prioritizing data from high-quality responders. While local differential privacy (LDP) has emerged as a crucial privacy-preserving paradigm, existing studies under LDP rarely explore a worker's participation in specific tasks for sparse scenarios, which may also reveal sensitive information such as individual preferences and behaviors. Existing LDP mechanisms, when applied to truth discovery in sparse settings, may create undesirable dense distributions, provide insufficient privacy protection, and introduce excessive noise, compromising the efficacy of subsequent non-private truth discovery. Additionally, the interplay between noise injection and truth discovery remains insufficiently explored in the current literature. To address these issues, we propose a lOcally differentially private truth diSCovery approach for spArse cRowdsensing, namely OSCAR. The main idea is to use advanced optimization techniques to reconstruct the sparse data distribution and re-formalize truth discovery by considering the statistical characteristics of injected Laplacian noise while protecting the privacy of both the tasks being completed and the corresponding sensory data. Specifically, to address the data density concerns while alleviating noise, we design a randomized response based Bernoulli matrix factorization method BerRR. To recover the sparse structures from densified, perturbed data, we formalize a 0-1 integer programming problem and develop a sparse recovery solving method SpaIE based on implicit enumeration. We further devise a Laplacian-sensitive truth discovery method LapCRH that leverages maximum likelihood estimation to re-formalize truth discovery by measuring differences between noisy values and truths based on the statistical characteristic of Laplacian noise. Our comprehensive theoretical analysis establishes OSCAR's privacy guarantees, utility bounds, and computational complexity. Experimental results show that OSCAR surpasses the state-of-the-arts by at least 30% in accuracy improvement.

Distribution estimation under local differential privacy (LDP) is a fundamental and challenging task. Significant progresses have been made on categorical data. However, due to different evaluation metrics, these methods do not work well when transferred to numerical data. In particular, we need to prevent the probability mass from being misplaced far away. In this paper, we propose a new approach that express the sample distribution using wavelet expansions. The coefficients of wavelet series are estimated under LDP. Our method prioritizes the estimation of low-order coefficients, in order to ensure accurate estimation at macroscopic level. Therefore, the probability mass is prevented from being misplaced too far away from its ground truth. We establish theoretical guarantees for our methods. Experiments show that our wavelet expansion method significantly outperforms existing solutions under Wasserstein and KS distances.

Local differential privacy (LDP) protocols are vulnerable to poisoning attacks. Existing research have proposed efficient defense strategies for single-item users. However, in practice, a user may possess multiple items. The defense against poisoning attacks for multi-item users is challenging, because due to larger output spaces, the adversary can conduct more powerful attacks without being detected. In this paper, we address the robust sparse vector mean estimation problem, in which each user has a vector with m nonzero coordinates. We propose Randomized Projection with Clipping (RPC). Firstly, the server sends a random binary vector to each user. The user then projects its local data on the vector, and clip the value to restrict the attacker's capability. To handle clipping bias, we propose a correction method based on a careful analysis that gives an exact expression of the bias. As a result, bias-variance tradeoff is no longer needed, thus the clipping threshold can be further reduced to shrink the output space and enhance robustness. We provide a rigorous theoretical guarantee of the estimation error under all possible attacks. Numerical experiments show that under trusted environments, our new method achieves comparable or better performance than existing methods, indicating that our method is already an efficient estimator in its own right. Under untrusted environments, our method is also significantly more robust to poisoning attacks.

Data inconsistency often arises from multiple observed sensory data due to varying participant reliability for crowdsensing systems. Truth discovery, which includes Weight Estimation and Truth Aggregation, for estimating participant reliability weights and aggregating uploaded values from inconsistent observations respectively, has emerged as an effective solution to address this issue. While local differential privacy (LDP) provides strong privacy guarantees by allowing participants to perturb their data locally before submission, existing LDP-based studies are either designed for static scenarios or compromise on privacy and accuracy trade-off for data streams, satisfying only weaker versions of LDP or mere differential privacy. To effectively and efficiently obtain truths over streams under rigorous LDP, we propose NANO which is locally differeNtially privAte truth discovery via updatiNg time stamp determinatiOn. The main idea lies in its integration of Laplacian noise for privacy protection and inherent Gaussian noise representing natural data variability for effective weight and truth estimations, coupled with the adaptive determination of updating time stamps. In NANO, to obtain the Weight Estimation and Truth Aggregation under LDP, we design a mixed noise-aware truth discovery method MixTD by modeling the mixed noise. To capture the dynamic nature of weight and truth evolutions, we develop a changing-aware updating time stamp determination method CUD to selectively re-conduct truth discovery at specific time stamps. We also introduce a dynamic privacy budget management strategy, which accumulates unused budgets from skipped updates for critical timestamps. In this way, Weight Estimation and Truth Aggregation are limited to critical time stamps, which significantly reduces the privacy budget segmentation and computational costs. We demonstrate that NANO provides rigorous LDP guarantees while achieving bounded utility and computational complexity. Extensive experimental results over four real-world datasets and three synthetic datasets showcase that NANO outperforms the state-of-the-arts by at least 20% improvement with negligible extra efficiency loss.

Recommender systems play a crucial role in predicting and suggesting related options for users in different scenarios, including e-commerce, social media, and streaming services. Currently, deep reinforcement learning (DRL)-based recommendation systems have gained significant popularity in both industry and academia, e.g., Spotify, Netflix, Google, and YouTube, since DRL enables modeling long-term interactions between users and the system to enhance the recommendation experience. This paper illustrates that attackers could manipulate DRL-based recommender systems by inserting maliciously constructed interaction data between users and the system. The poisoning attack on these systems is modeled as a non-convex integer programming problem. To address this challenge, a three-phase framework (named ePARL) is proposed to maximize the hit ratio (e.g., the proportion of target items appearing in the user's recommendations) while ensuring high efficiency and evading detection. The insight of ePARL is to increase the ranking of the target item while maintaining the ranking of other items. ePARL supports generating multiple fake user records in a single round, effectively reducing attack costs. Considering the sequential decision-making characteristics of reinforcement learning, ePARL reorganizes the order of items for fake users to mimic the sequential features of normal users, a factor often overlooked in the prior literature. The experiments on several real-world datasets reveal the robustness and effectiveness of ePARL, as well as its superior stealthiness against related detection approaches.

Large language models (LLMs) acquire a large amount of knowledge through pre-training on vast and diverse corpora. While this endows LLMs with strong capabilities in generation and reasoning, it amplifies risks associated with sensitive, copyrighted, or harmful content in training data.LLM unlearning, which aims to remove specific knowledge encoded within models, is a promising technique to reduce these risks. However, existing LLM unlearning methods often force LLMs to generate random or incoherent answers due to their inability to alter the encoded knowledge precisely. To achieve effective unlearning at the knowledge level of LLMs, we propose Knowledge Unlearning by Deviating representAtion (KUDA). We first utilize causal tracing to locate specific layers for target knowledge storage. We then design a new unlearning objective that induces the model's representations to deviate from its original position in the phase of knowledge removal, thus disrupting the ability to associate with the target knowledge. To resolve the optimization conflicts between forgetting and retention, we employ a relaxation null-space projection mechanism to mitigate the disruption to the representation space of retaining knowledge. Extensive experiments on representative benchmarks, WMDP and MUSE, demonstrate that KUDA outperforms most existing baselines by effectively balancing knowledge removal and model utility retention.

Background Embodied artificial intelligence (EAI) couples perception, decision-making, and physical actuation in real environments. Its relevance to the food sector is increasing as global systems face pressures from climate change, labor shortages, and rising demands for food safety, traceability, and sustainability. Scope and approach This review synthesizes recent advances in EAI across the food supply chain, from on-farm operations to primary processing, quality inspection, packaging, and cold-chain logistics. Evidence is organized around the perception, learning, and action stack and interpreted together with food-specific deployment constraints such as hygiene compatibility, reliability, latency, and cost. Key findings and conclusion Current evidence suggests that broader deployment of EAI will require open, domain-specific benchmarks, large-scale pilot validation, interpretable and auditable control architectures, and life-cycle-oriented sustainability assessment. Establishing transparent and secure data-governance frameworks among farmers, processors, and logistics providers is critical to ensuring interoperability, accountability, and public trust. The integration of sustainability metrics, ethical oversight, and human-AI collaboration will guide the development of intelligent, regulation-ready food systems that advance productivity while maintaining environmental and social responsibility.

Background In recent years, despite the explosive growth of data in the field of food and nutrition, core challenges such as multi-source heterogeneity and fragmentation persist. To address these challenges, knowledge graphs (KGs) integrate diverse data on foods, ingredients, processing methods, hazards, and health effects into a unified semantic framework. When integrated with large language models (LLMs), they show potential to enhance natural language retrieval, question-answering, and interpretable content generation. This synergy offers preliminary support for building more intelligent decision-making systems in the food domain, but its maturity and reliability require further validation. Scope and approach This review provides an overview of their major applications in food and nutrition KGs, including personalized nutrition recommendation, mining component-health associations, nutrition question answering, and quality regulation. It further highlights critical challenges such as data heterogeneity in KG-LLM integrated systems, while outlining future research directions and implementation pathways. Key findings and conclusions The integration of KGs with LLMs offers potential support for consolidating heterogeneous food data and improving the accuracy and efficiency of food-related decision-making, although current performance remains benchmark-dependent and many examples are at the prototype or single-domain stage. Its development still faces multiple challenges, including data inconsistency, hallucination generation, and disparities across user groups. Future research should focus on building reliable KG governance frameworks, advancing neuro-symbolic fusion, developing multimodal and causal KGs, and establishing shared benchmarks and ecosystems. Through interdisciplinary collaboration, food KGs could contribute toward the realization of a new generation of trustworthy, interpretable, and sustainable intelligent dietary systems.

The surging demand for large-scale datasets in deep learning has heightened the need for effective copyright protection, given the risks of unauthorized use to data owners. Although the dataset watermark technique holds promise for auditing and verifying usage, existing methods are hindered by inconsistent evaluations, which impede fair comparisons and assessments of real-world viability. To address this gap, we propose a two-layer taxonomy that categorizes methods by implementation (model-based vs. model-free injection; model-behavior vs. model-message verification), offering a structured framework for cross-task analysis. Then, we develop DWBench, a unified benchmark and open-source toolkit for systematically evaluating image dataset watermark techniques in classification and generation tasks. Using DWBench, we assess 25 representative methods under standardized conditions, perturbation-based robustness tests, multi-watermark coexistence, and multi-user interference. In addition to reporting the results of four commonly used metrics, we present the results of two new metrics: sample significance for fine-grained watermark distinguishability and verification success rate for dataset-level auditing, which enable accurate and reproducible benchmarking. Key findings reveal inherent trade-offs: no single method dominates all scenarios; classification and generation tasks require specialized approaches; and existing techniques exhibit instability at low watermark rates and in realistic multi-user settings, with elevated false positives or performance declines. We hope that DWBench can facilitate advances in watermark reliability and practicality, thus strengthening copyright safeguards in the face of widespread AI-driven data exploitation.

Deep reinforcement learning (DRL) has been implemented in various critical applications, including smart grids, traffic management systems, and autonomous vehicles. To safeguard intellectual property and mitigate security vulnerabilities, access to DRL models is typically restricted to a closed-box format. This means that specific details, such as the structure of the policy network and optimization processes, are not openly available to users. It is crucial to determine if hyper-parameters can be inferred from observable states and actions within these models, presenting two primary challenges: 1) limited data available from the closed-box model and 2) intertwined effects of hyper-parameters on the model behavior. Since DRL models exhibit varying behaviors in identical tasks depending on their hyper-parameter configurations, we introduce a novel hyper-parameter inference attack against DRL, named $\mathsf {HyperInfer}$HyperInfer, which allows adversaries to deduce the settings of a closed-box DRL model. In order to fully assess the risk of model hyper-parameter leakage, we design two novel state generation methods that provoke divergent responses from DRL models. We also develop an inference framework to elucidate the relationship between model behavior and hyper-parameter settings. Through comprehensive experiments involving multiple DRL models and environments, we demonstrate that model behaviors can indeed reveal hyper-parameter settings, with inference accuracy surpassing 90% in scenarios such as PPO with CartPole. We also discuss key findings relevant to practical applications and explore how knowledge of hyper-parameters can facilitate more sophisticated attacks. Lastly, we propose potential defensive strategies to minimize the risk of hyper-parameter leakage in DRL models.

Machine unlearning is the primary way to fight for the “right to be forgotten” in machine learning field, which is promoted among multiple privacy legislations, such as GDPR and CCPA. However, the latest work has shown that machine unlearning in deep learning cannot be easily verified, making it challenging for the data owners to be convinced that their data has indeed been deleted as claimed. This is especially problematic for federated learning (FL), where a number of participants jointly train a global model while each participant should be free to join and leave the federation as they wish. However, the lack of a reliable approach to verify unlearning in FL will no doubt discourage certain users from joining the federation. In this work, we propose A2E, a black-box watermarking scheme from a leaving participant's perspective to realize verifiable federated unlearning which incurs minimum impact and no security threats to vanilla FL. The key idea is to leverage adversarial training to inject the anti-adversarial example (A2E) characteristic into the uploaded model updates of the last contribution round as the watermark of the leaving participant. Then, we verify whether the server has indeed executed the effective unlearning, with the newly developed probabilistic quantification of unlearning confidence, by checking the unlearned global model's resistance to the specially generated watermark-dependent adversarial examples of the leaver. We conducted large-scale experiments on various popular datasets (including natural images, medical images, and speech) and model structures (including LeNet, ResNet, VGG, and LSTM). The results confirm the effectiveness of A2E in verifying federated unlearning with a high confidence. We also show that A2E is robust against multiple adaptive strategies from the adversarial server and participants.

Protection of local differential privacy (LDP) protocols against manipulation attacks is an important and challenging problem. We hope to design an attack-agnostic framework, which does not rely on any knowledge of attackers. An early work [1] restricts the attacker's capability by converting each sample into a binary signal. However, the compression of signal leads to severe loss of information, and thus results in unnecessary sacrifice of utility, especially when epsilon > 1. In this paper, we propose a general estimation framework RobustLDP for robust estimation under LDP. The general idea is to send carefully crafted pre-defined information to all users, and then aggregate the feedback at the server. We strike a better tradeoff between preserving information and restricting the attacker's capability. We instantiate RobustLDP for frequency estimation and mean estimation in l(1) and l(2) support, which serve as building blocks for more advanced tasks. We also establish theoretical guarantees for all possible attacks. The result shows that our method significantly outperforms the existing one for epsilon > 1. Extensive experiments on multiple realworld datasets validate the effectiveness of our method.

In this paper, we introduce GradEscape, the first gradient-based evader designed to attack AI-generated text (AIGT) detectors. GradEscape overcomes the undifferentiable computation problem, caused by the discrete nature of text, by introducing a novel approach to construct weighted embeddings for the detector input. It then updates the evader model parameters using feedback from victim detectors, achieving high attack success with minimal text modification. To address the issue of tokenizer mismatch between the evader and the detector, we introduce a warm-started evader method, enabling GradEscape to adapt to detectors across any language model architecture. Moreover, we employ novel tokenizer inference and model extraction techniques, facilitating effective evasion even in query-only access. We evaluate GradEscape on four datasets and three widely-used language models, benchmarking it against four state-of-the-art AIGT evaders. Experimental results demonstrate that GradEscape outperforms existing evaders in various scenarios, including with an 11B paraphrase model, while utilizing only 139M parameters. We have successfully applied GradEscape to two real-world commercial AIGT detectors. Our analysis reveals that the primary vulnerability stems from disparity in text expression styles within the training data. We also propose a potential defense strategy to mitigate the threat of AIGT evaders. We open-source our GradEscape for developing more robust AIGT detectors.

While Code Language Models (CLMs) have demonstrated superior performance in software engineering tasks such as code generation and summarization, recent empirical studies reveal a critical privacy vulnerability: these models exhibit unintended memorization of sensitive training data, enabling verbatim reproduction of confidential information when specifically prompted. To address this issue, several approaches, including training data de-duplication and differential privacy augmentation, have been proposed. However, these methods require full-model retraining for deployed CLMs, which incurs substantial computational costs. In this paper, we aim to answer the following research question: Can sensitive information memorized by CLMs be erased effectively and efficiently? We conduct a pioneering investigation into erasing sensitive memorization in CLMs through machine unlearning - a post-hoc modification method that removes specific information from trained models without requiring full retraining. Specifically, we first quantify the memorization risks of sensitive data within CLM training datasets and curate a high-risk dataset of 50,000 sensitive memorized samples as unlearning targets. We study two widely used gradient ascent-based unlearning approaches: the vanilla and constraint-based methods, and introduce CodeEraser, an advanced variant that selectively unlearns sensitive memorized segments in code while preserving the structural integrity and functional correctness of the surrounding code. Extensive experiments on three families of CLMs, i.e., CodeParrot, CodeGen-Mono, and Qwen2.5-Coder, validate the effectiveness and efficiency of CodeEraser in erasing targeted sensitive memorization while maintaining model utility.

Ethephon (ETH), is an important phytohormone used as a pesticide in agriculture, the overuse of which has caused numerous health problems due to its toxicity. There is an urgent requirement to establish a testing platform that is convenient, accurate, and sensitive in detecting ETH. Herein, we devised an imine groups-based covalent organic framework (COF) with methoxy group as a fluorescent probe for ETH detection. This COF contained a rich imine structure which facilitated acids-responsive characteristics, leading to increased fluorescence response when protonated. Upon exposure to ETH, there was a notable increase at 510nm, triggering a color transition in fluorescence from yellow to green. This change in fluorescence intensity was directly correlated with ETH concentrations ranging from 0.1mg/L to 400mg/L, with a limitation of detection as low as 0.05mg/L. The practicality was demonstrated through the detection of ETH in strawberries, pepino melon, and persimmons, showing its potential for broad application in ETH analysis.