Backdoor attacks pose significant security threats to deep neural networks. A backdoored model performs well on benign samples, but if the hidden backdoor is activated by a trigger defined by the attacker, the model's predictions will be maliciously altered. Existing backdoor attacks typically adopt a trigger-agnostic setup, where different poisoned samples in the backdoor attack methods contain the same trigger, which is usually visible or fragile. To address these limitations, we propose a sample-specific, sample-edge-adaptive backdoor attack method. Specifically, we utilize edge detection algorithms to identify edge structures in images as the target poisoning region, embedding the edge information into the least significant bits of the image using a steganographic method. This generates a sample-specific trigger pattern. Since image structure retains its semantic meaning during data transformation, this trigger pattern exhibits inherent robustness to data conversion. Our proposed attack is extensively evaluated across various network models and datasets, demonstrating its generalizability, superior stealthiness, better robustness compared to existing backdoor attack methods, and strong resistance against state-of-the-art defense techniques while maintaining high benign accuracy.

Reversible data hiding in encrypted JPEG images (JPEG-RDH-EI) is one of the key technologies for securely storing and managing confidential images in cloud environments. However, existing methods typically operate only in the coefficient domain or the encoding domain, failing to fully exploit the characteristics of encrypted images, which results in limited embedding capacity and significant file expansion. To address these limitations, this paper proposes a high-capacity JPEG-RDH-EI scheme based on multi-domain embedding. To reduce file expansion, a rotation model is devised that leverages the correlation of DCT coefficients within a range that does not notably alter the run length. This model embeds secret data by strategically rotating and rearranging these DCT coefficients. On this basis, the scheme constructs an optimal VLC mapping relationship and adaptively adjusts embedding parameters according to the characteristics of the encrypted image, based on the RSV histogram shifting technique, achieving data embedding in the encoding domain, thereby further enhancing embedding capacity. The proposed scheme supports fully separable data extraction and image recovery, making it suitable for various application scenarios. Evaluation results demonstrate that the maximum embedding capacity of this scheme is 2 to 3 times greater than that of existing advanced schemes, with some images achieving a maximum embedding capacity of over 100,000 bits. Moreover, the proposed scheme achieves an average unit file expansion of only about 0.03, outperforming current advanced methods.

Reversible Adversarial Examples (RAE) are designed to protect the intellectual property of datasets. Such examples can function as imperceptible adversarial examples to erode the model performance of unauthorized users while allowing authorized users to remove the adversarial perturbations and recover the original samples for normal model training. With the rise of Self-Supervised Learning (SSL), an increasing number of unlabeled datasets and pre-trained encoders are available in the community. However, existing RAE methods not only rely on well-labeled datasets for training Supervised Learning (SL) models but also exhibit poor adversarial transferability when attacking SSL pre-trained encoders. To address these challenges, we propose RAEncoder, the first framework for RAEs without the need for labeled samples. RAEncoder aims to generate universal adversarial perturbations by targeting SSL pretrained encoders. Unlike traditional RAE approaches, the pre-trained encoder outputs the feature distribution of the protected dataset rather than classification labels, enhancing both the attack success rate and transferability of RAEs. Extensive experiments are conducted on six pre-trained encoders and four SL models, covering aspects such as imperceptibility and transferability. Our results demonstrate that RAEncoder effectively protects unlabeled datasets from malicious infringements. Additional robustness experiments further confirm the security of RAEncoder in practical application scenarios.

Reversible adversarial example (RAE) is an effective cutting‐edge technology for protecting the intellectual property (IP) of datasets. However, existing RAE schemes primarily focus on the adversarial and restoration capabilities of adversarial examples (AE), with little attention paid to traceability, which is crucial for IP protection. This oversight leads to the inability to prevent authorized users from redistributing data, thereby posing significant IP security risks. To address this issue, we propose a novel approach named TAE‐RWP, wherein adversarial perturbations in AEs are treated as tools for IP verification. To enable the traceability of AEs, we introduce varying degrees of warping to the adversarial perturbations within the AEs of authorized users, utilizing the warping degree as a traceable feature. To further strengthen traceability, we adopt a technique named “random warping” to maintain the resilience of adversarial perturbations against distortions, and employ a strategy named “noise mode” to improve the verification model’s capacity to recognize distortion features. Experimental results indicate that AEs generated by TAE‐RWP exhibit remarkable adversarial strength and restoration abilities, while the verification model demonstrates excellence in recognizing distortion features.

The popularity of ChatGPT demonstrates the immense commercial value of natural language processing (NLP) technology. However, NLP models are vulnerable to piracy and redistribution, which harms the economic interests of model owners. Existing NLP model watermarking schemes struggle to balance robustness and covertness. Robust watermarking require embedding more information, which compromises their covertness; conversely, covert watermarking are challenging to embed more information, which affects their robustness. This paper proposes an NLP model watermarking framework that uses multi-task learning to address the conflict between robustness and covertness in existing schemes. Specifically, a covert trigger set is established to implement remote verification of the watermark model, and a covert auxiliary network is designed to enhance the watermark model's robustness. The proposed watermarking framework is evaluated on two benchmark datasets and three mainstream NLP models. The experiments validate the frame-work's excellent covertness, robustness, and low false positive rate.