Li Huang, Zhongxin Liu, Yifan Wu, Tao Yin, Dong li, Jichao Bi, Nankun Mu, Hongyu Zhang, Meng Yan. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

The vector database stores data as high-dimensional feature vectors. Some recently proposed attack techniques enable an adversary to launch feature vector inversion (FVI) attacks against vector databases. In FVI attacks, an adversary trains an FVI attack network to reconstruct the original private data from their feature vectors based on the assumption that an auxiliary dataset is available to the adversary. However, such a data-available assumption is too strong, making such FVI attacks unrealistic in many real-world scenarios. In this paper, we make the first systematic study on FVI attacks against vector databases in the data-free setting. To tackle the issue of no training data, we develop an output-to-input data generation technique that helps to generate synthetic fake samples for the FVI attack network training. In addition, to ensure the high quality of generated fake samples, we develop the accelerable complete bipartite graph (CBG) search strategy and the downstream-classifier-aided generator training strategy. Furthermore, as the key insight of this work, we find that the proposed output-to-input data generation technique can be employed to launch the other three ML attacks. Intriguingly, we find that the proposed FVI attack technique in the data-free setting can be directly employed to boost the attack performance of FVI attacks in the auxiliary-dataset-available setting. Finally, we propose and study defenses against the proposed attacks.

Transfer learning (TL) by fine-tuning (FT) has become a popular paradigm to address the challenges of limited training data and computing resources encountered in model training. This study reveals that this paradigm is susceptible to a new threat called model parasitic (MP) attack. By poisoning the dataset used for fine-tuning, MP attacks enable the finetuned model to execute an additional task (e.g., a specific classification task) designated by the attacker while still being able to execute the original task that the victim's fine-tuned model aims to offer. In addition, through MP attacks, the attacker can free-ride the victim's machine learning (ML) services at the cost of the victim. To design MP attacks, we innovatively propose multiple strategies including the dual-cluster strategy, the benign-to-poisoned example generation strategy, and the feature assignment loss (FAL)-guided controllable perturbation search strategy. Through intensive experiments, we precisely identify the factors that influence the MP attack performance. Finally, we investigate three possible defenses, shedding light on more effective defense design. Our code is available at GitHub

Open-Vocabulary Multi-Label Image Classification (OV-MLIC) is an emerging task in computer vision aimed at recognizing unseen categories in real-world scenarios, leveraging Vision and Language Pre-training (VLP) models like CLIP. However, existing methods overlook the impact of category coupling and scale variation on cross-category knowledge transfer, thereby restricting performance on unseen categories. To address this issue, we propose a novel OV-MLIC method called Hierarchical Dual-Granularity Alignment-CLIP (HDG-CLIP), which emphasizes the complementary characteristics of different modalities and introduces a sample-category matching mechanism. Specifically, to address the category coupling issue, we construct semantic category prototypes to enhance cross-category knowledge transfer. Through the interaction between visual embeddings and category prototypes, we decouple category-specific information from mixed visual features and leverage the visual context of samples to learn category-level visual features. For mitigating the scale variation issue, we build a sample-category dual-granularity matching mechanism based on the difference in capture capability of different modalities across scales, thereby improving the object localization accuracy from a multi-dimensional perspective. Extensive experimental results show that HDG-CLIP exhibits state-of-art performance over existing methods on both the NUS-WIDE and the Open-Images datasets. Our code is available at https://github.com/wakihy/HDG-CLIP.

Real-time performance is of utmost significance for communication in certain specific scenarios of vehicle-to-infrastructure (V2I) like collision warning systems. Vehicle-to-Everything (V2X) Broadcast signcryption is very suitable for these scenarios. However, current solutions prioritize generality, but may not be suitable for specialized communication situations, and many broadcast signcryption schemes suffer from low communication verification efficiency due to the sequence of decryption before verification. Moreover, most of existing broadcast signcryption schemes with single cryptosystem are not applicable for the heterogeneous networks of different Internet of Vehicles. To address these challenges, an efficient conditional privacy-preserving heterogeneous broadcast signcryption scheme(ECPHBS) is proposed, improving roadside unit verification to support batch verification of ciphertexts through a pre-authentication mechanism, and allowing vehicles to conduct secure communication with roadside units under the certificateless cryptosystem and the identity-based cryptosystem. Meanwhile, a tracking and revocation mechanism was introduced to achieve conditional privacy protection. Our formal security analysis demonstrates that the ECPHBS scheme formally achieves IND-CCA2 security under the CDH assumption and EUF-CMA security under the ECDL problem. Experimental results confirm its superior verification efficiency, especially with an increasing number of receiving RSUs, and a constant communication overhead. Furthermore, the RSU service capability analysis shows that our scheme enables RSUs to fully handle communication requests from approximately 500 vehicles within a 150-meter range, outperforming comparative schemes.

Reversible data hiding over encrypted images (RDH-EI) is an important technique for secure cloud image management but existing schemes often exhibit high computational complexity, low embedding rates, and excessive data expansion. This article addresses these issues by analyzing block-based secret sharing, revealing significant intra-block data redundancy. Based on this observation, we propose two space-preserving methods: the direct space-vacating method and the image-shrinking-based space-vacating method. Using these techniques, we design two novel RDH-EI schemes: a high-capacity RDH-EI scheme and a size-reduced RDH-EI scheme. The high-capacity RDH-EI scheme directly creates embedding space in encrypted images, eliminating the need for complex space-vacating operations and achieving higher and more stable embedding rates. In contrast, the size-reduced RDH-EI scheme minimizes data expansion by discarding unnecessary shares, resulting in smaller encrypted images. Experimental results show that the high-capacity RDH-EI scheme outperforms existing methods in terms of embedding capacity, while the size-reduced RDH-EI scheme achieves strong performance in minimizing data expansion. Both schemes offer effective solutions for RDH-EI challenges.

Authenticated key agreement (AKA) between vehicles and road side units (RSUs) is crucial in vehicular ad-hoc networks (VANETs). However, existing solutions still suffer from high overheads of AKA and lack a mechanism to balance privacy strength and system efficiency. In this paper, we present a lightweight anonymous authenticated key agreement (LWAKA) scheme for VANETs, supporting lightweight anonymous authentication and key agreement between vehicles and RSUs simultaneously. In particular, vehicles’ authentication information is synchronized to target RSUs in advance for accelerating authentication, and lightweight cryptographic operations (i.e., hash function, hash-based message authentication, physical unclonable function, fuzzy extractor and symmetric encryption) are employed to ensure the high efficiency of AKA in terms of computation and communication overheads. The system efficiency and privacy are balanced through modeling the relationship between the frequency of pseudonym updates and the unlinkability of the vehicles’ new and old pseudonyms. Security analysis shows that LWAKA not only achieves anonymity, conditional privacy, pseudonym unlinkability, key escrow freeness, and physical security, but also resists against most known attacks. Comparative experimental results demonstrate that LWAKA outperforms existing schemes in terms of lightweight design.

This article investigates the issue of asynchronous event-triggered secure control for Markov jump systems (MJSs) under aperiodic denial-of-service (DoS) attacks. A memory-based mode-dependent resilient event-triggering scheme (MMRETS) based on aperiodically sampled data is designed to avoid Zeno behavior and continuous monitor, which has the advantages in mitigating the transmission times and tolerating the DoS attacks. Meanwhile, the asynchronous circumstance between the system and corresponding event-triggered controller in the absence of DoS attacks is characterized via a hidden Markov model (HMM). Subsequently, by using a novel Lyapunov functional and an iterative approach, sufficient conditions are obtained to guarantee the${\mathcal {H}}_{\infty }$performance of the resultant Markov closed-loop system. Finally, a practical truck-trailer model example is provided to illustrate the efficacy and benefits of the proposed methods.

Real-world data consistently exhibits a long-tailed distribution, often spanning multiple categories. This complexity underscores the challenge of content comprehension, particularly in scenarios requiring Long-Tailed Multi-Label image Classification (LTMLC). In such contexts, imbalanced data distribution and multi-object recognition pose significant hurdles. To address this issue, we propose a novel and effective approach for LTMLC, termed Category-Prompt Refined Feature Learning (CPRFL), utilizing semantic correlations between different categories and decoupling category-specific visual representations for each category. Specifically, CPRFL initializes category-prompts from the pretrained CLIP's embeddings and decouples category-specific visual representations through interaction with visual features, thereby facilitating the establishment of semantic correlations between the head and tail classes. To mitigate the visual-semantic domain bias, we design a progressive Dual-Path Back-Propagation mechanism to refine the prompts by progressively incorporating context-related visual information into prompts. Simultaneously, the refinement process facilitates the progressive purification of the category-specific visual representations under the guidance of the refined prompts. Furthermore, taking into account the negative-positive sample imbalance, we adopt the Asymmetric Loss as our optimization objective to suppress negative samples across all classes and potentially enhance the head-to-tail recognition performance. We validate the effectiveness of our method on two LTMLC benchmarks and extensive experiments demonstrate the superiority of our work over baselines.The code is available at https://github.com/jiexuanyan/CPRFL.

In smart cities, face recognition (FR) systems are ubiquitous and they have been extensively used for public safety, traffic management, and other smart services. An FR system usually stores a facial template (i.e., facial feature extracted from face images of enrolled users) dataset and uses it for face recognition. Recent work has shown that FR systems are vulnerable to template inversion (TI) attacks, in which the adversary (who accesses the template dataset) can train a machine learning (ML) model to reconstruct face images from their corresponding templates. However, when only a tiny surrogate dataset is available, these prior learning-based TI attacks fail to achieve good attack performance. To address this issue, we design an Image-Template-Guided GAN (ITGGAN) which can be trained with the guide of face images (in the tiny surrogate dataset) and available templates. ITGGAN can be used to generate a massive number of diversified images, which helps to train a high-quality TI network to launch TI attacks. Additionally, we develop an interactive training strategy where the ITGGAN and the TI network are trained alternately. Applying this strategy, higher diversified images can be used to train the TI network, thereby continuously boosting the attack performance. Our experimental results show that, compared with prior TI attacks, the proposed TI attack achieves the highest ASR (over 99 %) with only 1,000 training samples across four different FR systems and two face datasets.

Data trading is an effective way for commercial companies to obtain massive personal data to develop their data-driven businesses. However, when data owners may want to sell their data without revealing privacy, data consumers also face the dilemma of high purchase costs due to purchasing too much invalid data. Therefore, there is an urgent need for a data trading scheme that can protect personal privacy and save expenses simultaneously. In this paper, we design a privACy-preserving and praCtical aggrEgateStatiStic trading scheme (named as ACCESS). Technically, we focus on the group-level pricing strategy to make ACCESS easier to implement. The differential privacy technique is applied to protect the data owners' privacy, and the sampling algorithm is adopted to reduce the data consumers' costs. Specifically, to provide a maximum tolerant privacy loss guarantee for the data owners, we design a decision algorithm to detect whether a conflict occurs between the consumer-specified accuracy level and the maximum tolerable privacy loss budget. Besides, to minimize the purchase cost for the data brokers, we develop a sampling-based aggregation method consisting of two sampling algorithms (called as BUSA and BKSA, respectively). BUSA enables reducing purchase costs with no additional background knowledge. Once the data broker knows the data boundary, BKSA can significantly reduce the amount of data that needs to be purchased, thereby the purchase cost is reduced. Rigorous theoretical analysis and extensive experiments (over four real-world and public datasets) further demonstrate the practicability of ACCESS.

Data deduplication can efficiently eliminate data redundancies in cloud storage and reduce the bandwidth requirement of users. However, most previous schemes depending on the help of a trusted key server (KS) are vulnerable and limited because they suffer from revealing information, poor resistance to attacks, great computational overhead, etc. In particular, if the trusted KS fails, the whole system stops working, i.e., single-point-of-failure. In this article, we propose aSecure andEfficient dataDeduplication scheme (named SED) in a JointCloud storage system which provides the global services via collaboration with various clouds. SED also supports dynamic data update and sharing without the help of the trusted KS. Moreover, SED can overcome the single-point-of-failure that commonly occurs in the classic cloud storage system. According to the theoretical analyses, our SED ensures the semantic security in the random oracle model and has strong anti-attack ability such as the brute-force attack resistance and the collusion attack resistance. Besides, SED can effectively eliminate data redundancies with low computational complexity and communication and storage overhead. The efficiency and functionality of SED improves the usability in client-side. Finally, the comparing results show that the performance of our scheme is superior to that of the existing schemes

Frequent itemsets mining and association rules mining are among the top used algorithms in the area of data mining. Secure outsourcing of data mining tasks to the third-party cloud is an effective option for data owners. However, due to the untrust cloud and the distrust between data owners, the traditional algorithms which only work over plaintext should be re-considered to take security and privacy concerns into account. For example, each data owner may not be willing to disclose their own private data to others during the cooperative data mining process. The previous solutions are either not sufficiently secure or not efficient. Therefore, we propose aSecure andEfficientDataMiningOutsourcing (SecEDMO) scheme for secure outsourcing of frequent itemsets mining and association rules mining over the joint database (i.e., database aggregated from multiple data owners) in the paradigm of cloud computing. Based on our customized lightweight symmetric homomorphic encryption algorithm and a secure comparison algorithm, SecEDMO can ensure strong privacy protection and low data mining latency simultaneously. Moreover, the well-designed virtual transaction insertion algorithm can hide the information of the original database while still preserving the cloud’s ability to perform data mining over the obfuscated data. By evaluation of a numerical experiment and theoretical comparisons, the correctness, security, and efficiency of SecEDMO are confirmed.

Federated learning (FL) is a machine-learning setting, where multiple clients collaboratively train a model under the coordination of a central server. The clients' raw data are locally stored, and each client only uploads the trained weight to the server, which can mitigate the privacy risks from the centralized machine learning. However, most of the existing FL models focus on one-time learning without consideration for continuous learning. Continuous learning supports learning from streaming data continuously, so it can adapt to environmental changes and provide better real-time performance. In this article, we present a federated continuous learning scheme based on broad learning (FCL-BL) to support efficient and accurate federated continuous learning (FCL). In FCL-BL, we propose a weighted processing strategy to solve the catastrophic forgetting problem, so FCL-BL can handle continuous learning. Then, we develop a local-independent training solution to support fast and accurate training in FCL-BL. The proposed solution enables us to avoid using a time-consuming synchronous approach while addressing the inaccurate-training issue rooted in the previous asynchronous approach. Moreover, we introduce a batch-asynchronous approach and broad learning (BL) technique to guarantee the high efficiency of FCL-BL. Specifically, the batch-asynchronous approach reduces the number of client-server interaction rounds, and the BL technique supports incremental learning without retraining when learning newly produced data. Finally, theoretical analysis and experimental results further illustrate that FCL-BL is superior to the existing FL schemes in terms of efficiency and accuracy in FCL.

The real-time data generated from various smart devices will be released and shared for public to obtain numerous benefits. However, it will lead to individual privacy leakage because of data mining or analysis. Currently, many existing privacy protection models either fail to be directly applied in real-time data release or are unsatisfactory in terms of data utility and privacy protection. Toward this end, based on m-signature and fuzzy processing, an anonymous privacy protection model, named PMF, is proposed in this paper. Specifically, for the proposed model there are five advantages: 1) PMF defines m-signature for making each bucket with at least m different sensitive values instead of generating any counterfeit tuples, which can not only resist h-difference attack but also improve practical value; 2) the buckets satisfying m-signature are variable over time, and this flexibility of m-signature can improve the efficiency of dynamic update; 3) PMF can effectively insert, delete, and modify real-time data for release; 4) PMF applies fuzzy processing to handle the tuples in the candidate list, which strikes a good balance between the utility of released data and privacy protection; and 5) PMF adopts greedy heuristic algorithm to process update operations, which greatly reduces the information loss of released data. Furthermore, PMF is obviously more secure than the existing models in the real-time data release. Finally, the results of the comparison experiments on real-world and synthetic datasets illustrate that PMF is superior to the existing models in terms of data utility and efficiency.

Blockchain, as a secured, trusted, and decentralized architecture, is used to create secure and tamper-proof payment schemes, which can serve economies and societies without trusted parties. However, the transparency and traceability of blockchain severely restrict the anonymity of participants in the real world, which will cause participants' privacy leakage. Toward this end, in this paper, an anonymous off-blockchain micropayments scheme (AOM) is proposed for cryptocurrencies in the real world. In AOM, a payee receives micropayments from an “honest-but-curious” intermediary T by solving puzzles which are generated based on the standard RSA assumption. Meanwhile, T also receives micropayments from the payers by payee's solutions and T will randomly select the inputs of the merging transaction Tmer. In order to improve service efficiency of T and resist denial of service attack, one of the outputs of Tmeris paid for T as a service fee. Besides, AOM simultaneously ensures the correctness and fairness of transactions. Finally, from the analyses of property and security, AOM has strong unlinkability, ability for anti-attacks and unforgeability.

In this paper, the event-triggered consensus problem of multiagent systems with input time delay is investigated. First, the normal event-triggered control scheme containing the input time delay is introduced to reduce the number of communication. Then the following results are achieved: 1) the procedure of setting parameters is carefully formulated for the event-triggered control scheme; 2) the precise input time delay margin is calculated for the event-triggered consensus of the multiagent systems; 3) a more general condition of constructing event-triggered functions is derived to exclude the Zeno behavior; 4) the self-triggered control scheme is further applied to avoid the continuous measurement; and 5) the observer-based control scheme is also utilized to tackle the problem of unmeasurable state. Finally, the correctness and the effectiveness of these results are demonstrated by numerical simulations.

In this paper, the asymptotic stability properties of neutral-type neuron system are studied mainly in the critical case when the exponential stability is not possible. In the case of a critical value of the coefficient in neutral-type neuron system, the difficulty for our investigation is the fact that the spectrum of the linear operator is asymptotically approximated to the imaginary axis. Hence, based on the energy method, the asymptotic stability results for neutral-type neuron system are derived, and a complete analysis of the stability diagram is presented.