Deep unfolding networks (DUNs), combining conventional iterative optimization algorithms and deep neural networks into a multi-stage framework, have achieved remarkable accomplishments in Image Restoration (IR), such as spectral imaging reconstruction, compressive sensing and super-resolution. It unfolds the iterative optimization steps into a stack of sequentially linked blocks. Each block consists of a Gradient Descent Module (GDM) and a Proximal Mapping Module (PMM) which is equivalent to a denoiser from a Bayesian perspective, operating on Gaussian noise with a known level. However, existing DUNs suffer from two critical limitations: 1) their PMMs share identical architectures and denoising objectives across stages, ignoring the need for stage-specific adaptation to varying noise levels; and 2) their chain of structurally repetitive blocks results in severe parameter redundancy and high memory consumption, hindering deployment in large-scale or resource-constrained scenarios. To address these challenges, we introduce generalized Deep Low-rank Adaptation (LoRA) Unfolding Networks for image restoration, named LoRun, harmonizing denoising objectives and adapting different denoising levels between stages with compressed memory usage for more efficient DUN. LoRun introduces a novel paradigm where a single pretrained base denoiser is shared across all stages, while lightweight, stage-specific LoRA adapters are injected into the PMMs to dynamically modulate denoising behavior according to the noise level at each unfolding step. This design decouples the core restoration capability from task-specific adaptation, enabling precise control over denoising intensity without duplicating full network parameters and achieving up to $N$ times parameter reduction for an $N$ -stage DUN with on-par or better performance. Extensive experiments conducted on three IR tasks validate the efficiency of our method.

In real-world scenarios, complex data such as multispectral images and multi-frame videos inherently exhibit robust low-rank property. This property is vital for multi-dimensional inverse problems, such as tensor completion, spectral imaging reconstruction, and multispectral image denoising. Existing tensor singular value decomposition (t-SVD) definitions rely on hand-designed or pre-given transforms, which lack flexibility for defining tensor nuclear norm (TNN). The TNN-regularized optimization problem is solved by the singular value thresholding (SVT) operator, which leverages the t-SVD framework to obtain the low-rank tensor. However, it's quite complicated to introduce SVT into deep neural network due to the numerical instability problem in solving the derivatives of the eigenvectors. In this paper, we introduce a novel data-driven generative low-rank t-SVD model based on the learnable orthogonal transform, which can be naturally solved under its representation. Prompted by the linear algebra theorem of the Householder transformation, our learnable orthogonal transform is achieved by constructing an endogenously orthogonal matrix adaptable to neural networks, optimizing it as arbitrary orthogonal matrices. Additionally, we propose a low-rank solver as a generalization of SVT, which utilizes an efficient representation of generative networks to obtain low-rank structures. Extensive experiments highlight its significant restoration enhancements.

Dynamic image degradations, including noise, blur and lighting inconsistencies, pose significant challenges in image restoration, often due to sensor limitations or adverse environmental conditions. Existing Deep Unfolding Networks (DUNs) offer stable restoration performance but require manual selection of degradation matrices for each degradation type, limiting their adaptability across diverse scenarios. To address this issue, we propose the Vision-Language-guided Unfolding Network (VLU-Net), a unified DUN framework for handling multiple degradation types simultaneously. VLU-Net leverages a VisionLanguage Model (VLM) refined on degraded image-text pairs to align image features with degradation descriptions, selecting the appropriate transform for target degradation. By integrating an automatic VLM-based gradient estimation strategy into the Proximal Gradient Descent (PGD) algorithm, VLU-Net effectively tackles complex multi-degradation restoration tasks while maintaining interpretability. Furthermore, we design a hierarchical feature unfolding structure to enhance VLU-Net framework, efficiently synthesizing degradation patterns across various levels. VLU-Net is the first all-in-one DUN framework and outperforms current leading one-by-one and all-in-one end- to-end methods by 3.74 dB on the SOTS dehazing dataset and 1.70 dB on the Rain100L deraining dataset.

Fieldbus is widely used for real-time distributed control in Industrial Control Systems (ICSs) due to its simplicity and stability. The real-world fieldbus network contains hundreds of interconnected devices, presenting a widespread network layout. Attackers can attach external intrusion devices to these communication lines to launch various attacks. In this paper, we model the fieldbus network’s channel fingerprint based on the signal’s amplitude and propose a detection method to identify potential attackers (silent intrusion devices that are eavesdropping) via channel fingerprint differences. Leveraging the passive fail-safe biasing voltage in the fieldbus network such as RS485, we can still detect the intrusion device when the fieldbus is idle (i.e., no devices are transmitting commands), which can significantly reduce the detection delay with lower sampling costs. Moreover, our method can adapt to environmental changes with little computational overhead by generating dynamic thresholds. Using a monitoring unit with stored channel fingerprints, our method can be easily deployed in fieldbus networks without occupying communication resources. The effectiveness and robustness of the proposed method have been demonstrated via extensive experiments on two real-world scenarios and one simulation scenario, where we can achieve 100% accuracy and 0% false alarm rates against various intrusion devices. Note to Practitioners—This paper is motivated by a practical need for detecting unauthorized intrusion devices in fieldbus networks. Existing detection methods face several challenges: active detection methods based on traffic analysis may disrupt normal bus communication, and it is hard to identify silent intrusion devices that are eavesdropping. Moreover, adapting these methods to changing environments is still challenging and costly. To address these issues, we leverage the inevitable amplitude differences in fail-safe biasing voltage signals and benign devices’ communication voltage signals to detect intrusion devices passively. Furthermore, to adapt to rapidly changing environments, we generate the detection thresholds dynamically based on the hypothesis testing theory. Extensive physical and simulation experiments demonstrate that the detection method against physical intrusion attacks is accurate and robust.

Thermal energy equipment, a critical component for transferring and utilizing thermal energy derived from primary energy sources, is indispensable in Industrial Control Systems (ICSs). With the deep integration of information technologies, ICSs are threatened by new cyber-physical security risks, where the physical systems could be influenced by attacks from the cyber network. While cyber-physical security risks in ICSs have been well studied in various domains, such as power systems and smart structural systems, little attention has been paid to the cyber-physical security of thermal energy equipment. In this paper, we propose a novel cyber-physical threat against thermal energy equipment, namely the Network-Energy-Stress Threat (NEST), which reveals attacks from the cyber network could induce an inhomogeneous distribution of thermal energy, thus causing remarkable thermal stress that can induce physical damage to the thermal energy equipment. From the attacker’s perspective, we propose an inherent vulnerability-based algorithm to explore the threat space of potential attack strategies and find an approximately optimal attack strategy utilizing the nonlinear NEST model. Then, we propose a cyber-physical defense method to detect anomalous states stemming from the NEST. Experimental results on a simulated Solar Power Tower (SPT) plant have validated the existence of the NEST against thermal energy equipment and demonstrated the effectiveness of the proposed algorithm and the proposed detector. Note to Practitioners— This paper is motivated by the practical threat of physical damage to Industrial Control Systems (ICSs) caused by cyber-physical attacks. While cyber-physical security risks in ICSs have been well studied across plenty of types of ICS and physical infrastructures, there is a lack of a framework to describe cyber-physical threats to thermal energy equipment. To address this issue, we propose the Network-Energy-Stress Threat (NEST) to reveal how cyber attacks can induce abnormal thermal stress, causing physical damage to thermal energy equipment—a critical component widely deployed in ICSs. The existence of the NEST has been demonstrated through experimental results on a simulated Solar Power Tower (SPT) plant.

In industrial control systems, terminal devices in fieldbus networks are vulnerable to physical intrusion attacks, where attackers can directly install external intrusion devices. Currently, the localization capabilities of existing methods for intrusion devices are limited. As the reflection signals in transmitted signals are imperceptible and difficult to extract, many methods focus on actively transmitting pulse signals to locate intrusion devices. In this article, we enhance the reflection signals in transmitted signals by parallel connection of an appropriate resistor with the gateway and propose a localization method based on the collaboration of multiple devices' reflection signals. This method can significantly improve localization precision while reducing the sampling rate and does not occupy communication bandwidth. Experimental results on a real-world controller area network testbed demonstrate that our method can achieve a localization precision of 5 cm when locating intrusion devices under a sampling rate of 50 MS/s.

The rapid development of distributed control technologies has made Fieldbus networks widely used in industrial control systems (ICSs). Meanwhile, the weak security protection of Fieldbus networks exposes potential attack paths for attackers. Attackers can tap covert and unauthorized external devices (i.e., intrusion devices) into the network to launch attacks. As the intrusion device can remain silent when eavesdropping, there is no detectable abnormal traffic in the network to detect the intrusion device. In this paper, we analytically prove that the observed signals sent from any benign device will inevitably change when the intrusion device is tapped into the Fieldbus network. With this knowledge, we construct the channel-state group fingerprint from the communication signals of each benign device and propose a collaborative intrusion detection mechanism for physical access, PhyCID, to passively detect the covert intrusion device. Detection results on a real power distribution cabinet, an RS485 bus testbed, and a controller area network (CAN) bus testbed indicate that PhyCID is purely passive, environmentally adaptive, and protocol-independent in most Fieldbus networks, including RS485 and CAN. Furthermore, extensive experiments under different scenarios demonstrate the effectiveness and robustness of PhyCID.

Graph neural networks (GNNs) have demonstrated efficient processing of graph-structured data, making them a promising method for electroencephalogram (EEG) emotion recognition. However, due to dynamic functional connectivity and nonlinear relationships between brain regions, representing EEG as graph data remains a great challenge. To solve this problem, we proposed a multi-domain based graph representation learning (MD$^{2}$GRL) framework to model EEG signals as graph data. Specifically, MD$^{2}$GRL leverages gated recurrent units (GRU) and power spectral density (PSD) to construct node features of two subgraphs. Subsequently, the self-attention mechanism is adopted to learn the similarity matrix between nodes and fuse it with the intrinsic spatial matrix of EEG to compute the corresponding adjacency matrix. In addition, we introduced a learnable soft thresholding operator to sparsify the adjacency matrix to reduce noise in the graph structure. In the downstream task, we designed a dual-branch GNN and incorporated spatial asymmetry for graph coarsening. We conducted experiments using the publicly available datasets SEED and DEAP, separately for subject-dependent and subject-independent, to evaluate the performance of our model in emotion classification. Experimental results demonstrated that our method achieved state-of-the-art (SOTA) classification performance in both subject-dependent and subject-independent experiments. Furthermore, the visualization analysis of the learned graph structure reveals EEG channel connections that are significantly related to emotion and suppress irrelevant noise. These findings are consistent with established neuroscience research and demonstrate the potential of our approach in comprehending the neural underpinnings of emotion.

It is hard to conduct cyberattacks in industrial control systems (ICSs) because most underlying networks of ICS like the field bus network are isolated from the internet. However, attackers can physically connect the intrusive device into the target network to launch various attacks, which bypasses the security protection mechanisms between the ICS and the internet. Currently, no effective measures could defend against such unauthorized physical access attacks. In this article, a reflection-based channel fingerprint is proposed to detect and locate these physically intrusive devices in the field bus network. We theoretically analyze the signal reflection characteristics and utilize inevitable changes in the channel fingerprint to detect the intrusive device. Besides, the detected anomaly features could be used to accurately estimate the intrusive device's location. In the end, the proposed method's effectiveness is validated through extensive simulation experiments.

The development of Industrial Internet of Things has made industrial control systems more vulnerable to cyber attacks. Many defense measures have been proposed to prevent attacks in upper IP-based networks. However, the security of underlying field bus networks has not received enough attention. Adversaries could tap intrusive devices into the field bus network via unauthorized physical access. As adversaries’ behaviors could be highly concealed when they are eavesdropping or camouflaging, it is challenging and costly to identify these inactive intrusive devices through the network traffic. However, inevitable changes in channel state caused by intrusive devices could be leveraged to detect unauthorized physical access. This article theoretically proves that the transmitted signal’s voltage amplitude would vary after tapping intrusive devices into the field bus network. Leveraging the signal’s variation, we propose an unauthorized physical access detection method via fingerprinting the channel state. Specifically, we adopt weak signal processing technologies to recover the signal’s weak variation and extract its features for detection. The effectiveness of the proposed detection method is validated based on a real testbed. Moreover, simulation experiments with diverse settings demonstrate that the proposed detection method could successfully detect intrusive devices under different scenarios.