Unlike standard vulnerability disclosure, fixing vulnerabilities "silently" is another common approach in software development. While silent fixes can prevent potential targeted attacks without disclosing any details, they only offer short-term protection. Users often rely on publicly disclosed vulnerabilities to identify and eliminate vulnerabilities in their own software, particularly for open-source software (OSS). We conduct the first comprehensive empirical study in OSS to investigate potential security threats brought by silent fixes. By examining disclosed vulnerabilities and their corresponding patches in real-world OSSes, we investigated the prevalence of silent vulnerabilities and assessed the potential impacts they might cause. After analyzing 3,515 vulnerabilities, we observed that nearly 50% of the vulnerabilities, with half of them classified as high-severity, were exposed for over 30 days. Over 10% of them published exploits during the "silent" period, enabling adversaries to replicate the exploits and attack other OSS users. Due to delayed vulnerability disclosure, we even found one HIGH-severity vulnerability that was silently fixed still exists in downstream software, indicating that silent fixes may increase the risks for other OSSes, amplifying their impact throughout software supply chains.

Documents are core carriers of information and knowledge, with broad applications in finance, healthcare, and scientific research. Tables, as the main medium for structured data, encapsulate key information and are among the most critical document components. Existing studies largely focus on surface-level tasks such as layout analysis, table detection, and data extraction, lacking deep semantic parsing of tables and their contextual associations. This limits advanced tasks like cross-paragraph data interpretation and context-consistent analysis. To address this, we propose DOTABLER, a table-centric semantic document parsing framework designed to uncover deep semantic links between tables and their context. DOTABLER leverages a custom dataset and domain-specific fine-tuning of pre-trained models, integrating a complete parsing pipeline to identify context segments semantically tied to tables. Built on this semantic understanding, DOTABLER implements two core functionalities: table-centric document structure parsing and domain-specific table retrieval, delivering comprehensive table-anchored semantic analysis and precise extraction of semantically relevant tables. Evaluated on nearly 4,000 pages with over 1,000 tables from real-world PDFs, DOTABLER achieves over 90% Precision and F1 scores, demonstrating superior performance in table-context semantic analysis and deep document parsing compared to advanced models such as GPT-4o.

The past decade has witnessed the wide adoption of AI code generators, such as GitHub Copilot, AskCodi, and OpenAI Codex. They offer intelligent solution code for code completion to achieve faster development, cleaner code, and a significant boost in overall productivity. However, such significant productivity advantages also inadvertently lead to the generation of insecure solution code because most AI code generators derive their knowledge from existing projects, which typically prioritize functionality over security. Although numerous tools have been developed to integrate with the code generators for identifying vulnerabilities, the inconsistency in syntactic features and variability in coding rules make the detection task challenging across different programming languages. To address the challenges, we devise a prompt-enhancing approach, PECKER. It examines textual prompts provided by users to identify risky prompts that could lead to insecure code generation. Given the risky prompts, PECKER conducts security-centric rewriting to strengthen the "potentially insecure" descriptions, thereby guiding AI code generators in mitigating vulnerabilities during code generation. We integrated PECKER with one of the most prevalent AI code generators, GitHub Copilot for evaluation. Among 509 risky prompts, PECKER successfully identified and rectified 471 risky prompts.

Large Language Models (LLMs) have shown incomparable representation and generalization capabilities, which have led to significant advancements in Natural Language Processing (NLP). Before deployment, the pre-trained LLMs often need to be tailored to specific downstream tasks for improved performance, which is commonly referred to as downstream alignment. This is a costly effort considering the needed manpower, training resources, and downstream-specific data. While much attention has been paid to protecting the copyright of the models themselves, the copyright protection of LLM alignment has been largely overlooked. In this paper, we present Watermark Embedding for Downstream Alignment (WEDA) scheme, which can provide effective copyright protection for two popular LLM alignment techniques parameter-efficient fine-tuning (PEFT) and in-context learning (ICL). For alignment through PEFT, we propose a Chain of Thought (CoT) based solution to embed watermarks into the PEFT weights. Furthermore, we extend this solution to safeguard alignment through ICL by utilizing the prefix-integrated CoT to watermark examples embedded within ICL prompts. We conduct an extensive experimental evaluation to demonstrate the effectiveness of our proposed scheme.