Although existing backdoor defenses have gained success in mitigating backdoor attacks, they still face substantial challenges. In particular, most of them rely on large amounts of clean data to weaken the backdoor mapping but generally struggle with residual trigger effects, resulting in persistently high attack success rates (ASR). Therefore, in this paper, we propose a novel Backdoor defense method based on Directional mapping module and adversarial Knowledge Distillation (BeDKD), which balances the trade-off between defense effectiveness and model performance using a small amount of clean and poisoned data. We first introduce a directional mapping module to identify poisoned data, which destroys clean mapping while keeping backdoor mapping on a small set of flipped clean data. Then, the adversarial knowledge distillation is designed to reinforce clean mapping and suppress backdoor mapping through a cycle iteration mechanism between trust and punish distillations using clean and identified poisoned data. We conduct experiments to mitigate mainstream attacks on three datasets, and experimental results demonstrate that BeDKD surpasses the state-of-the-art defenses and reduces the ASR by 98% without significantly reducing the CACC.

The widespread adoption of large language models (LLMs) in commercial and research settings has intensified the need for robust intellectual property protection.Recently, backdoor-based LLM fingerprint paradigms have emerged as a promising solution for this challenge.In practical application, the low-cost multi-model collaborative technique, i.e., LLM ensemble, combines diverse LLMs to leverage their complementary strengths, garnering significant attention and practical adoption.Unfortunately, the vulnerability of the existing LLM fingerprint methods for the ensemble scenario is unexplored.In order to comprehensively assess the robustness of LLM fingerprints in the ensemble scenario, in this paper, we propose two novel fingerprint inhibitory attack methods: token filter attack (TFA) and sentence verification attack (SVA).The TFA gets the next token from a unified set of tokens created by the token filter mechanism at each decoding step.The SVA filters out fingerprint responses through a sentence verification mechanism based on perplexity and voting.Experimentally, the proposed methods effectively inhibit the fingerprint response while maintaining ensemble performance.Compared with state-of-the-art attack methods, the proposed method can achieve better performance.The findings necessitate enhanced robustness in LLM fingerprinting.

Training and serving large language models (LLMs) is resource-intensive, making reliable intellectual property (IP) protection and blackbox ownership verification increasingly important.Model fingerprinting enables such verification by injecting a small set of secret query-response behaviors, but many existing fingerprints rely on explicit markers or predetermined outputs that are weakly grounded in prompt semantics.This semantic mismatch yields atypical fingerprint responses, reduces stealthiness, and exposes fingerprints to removal by response normalization.We formalize this vulnerability via a new removal attack, Generation Revision Intervention (GRI), which applies system-prompt-level revision and response standardization to steer models toward typical answers, substantially compromising representative injected baselines.To close this semantic gap, we propose the Implicit Fingerprints (ImF): we encode ownership information into a natural-looking target response y via linguistic steganography, then derive a CoTaugmented query x that embeds semantic cues from y to guide the model toward an output sufficiently close to y for decoding-based verification.Experiments on 15 LLMs show that ImF improves stealthiness and remains verifiable under model updates and deploymenttime prompt interventions; additional analyses further show stability under common decoding variation and realistic related-model partial merging.

Linguistic steganalysis aims to detect whether a given text contains hidden information, playing a critical role in ensuring the security and integrity of modern communication systems. While existing deep learning-based steganalysis methods have shown promise in detecting text with hidden information (stego text), they suffer from severe performance degradation when the test domain does not match the target domain. Previous studies enhance detection accuracy under domain mismatch via domain adaptation methods, but they typically require access to source-domain data. To solve the problem with only unlabeled data in target domain, existing studies have used test-time adaptation (TTA) methods. Although they have achieved good results, there is a serious limitation: in this unsupervised scenario with only unlabeled target-domain data, the prediction of the model is unreliable, and parameter optimization based on this unreliable prediction will lead to error accumulation. To address this limitation, we propose Anomaly-Guided Test-Time Adaptation (AGTTA), a novel test-time adaptation framework for linguistic steganalysis. It consists of two stages: anomaly-guided pseudo-label generation and test-time adaptation. Specifically, we design an anomaly-guided pseudo-label generation module according to the distribution difference between cover and stego text. Then, during test-time adaptation, we design a dual-objective optimization including entropy minimization loss and pseudo-label cross-entropy loss, enabling effective unlabeled target domain adaptation without source data access. Existing experiments on three datasets and five steganography methods demonstrate that AGTTA significantly outperforms existing steganalysis methods without source data, achieving state-of-the-art performance.

Large Language Models (LLMs) have achieved impressive capabilities in diverse applications but remain vulnerable to jailbreak attacks despite advanced safety alignments. Existing attacks primarily fall into optimization-based methods, which require white-box access, and prompt-based methods, which rely on surface-level deception strategies like persuasion or obfuscation. While these approaches have exposed significant vulnerabilities and achieved notable success in earlier model generations, they are increasingly mitigated by robust alignment techniques. To overcome these challenges, we propose GRA, a graph-based role-playing attack framework for single-turn black-box jailbreaking. GRA introduces a mechanism of cognitive inertia by synergizing three components: (1)Domain-Aligned Character Matching, which dynamically selects adversarial personas;(2)Graph-based Attention Redirection, which anchors the model in a benign social network analysis task; and(3)Structured Malicious Content Encoding, which injects malicious goals as isomorphic structural instructions, effectively bypassing content-based filters. Extensive evaluations on eight state-of-the-art models (including GPT-5 and Claude-4) demonstrate that GRA achieves an average Attack Success Rate (ASR) of 85.38% and a StrongREJECT Score of 0.690, significantly outperforming the most advanced attacks.

As a countermeasure to linguistic steganography, linguistic steganalysis aims to distinguish between texts containing hidden secret messages (stego) and natural texts (cover). Current semi-supervised steganalysis approaches rely on a self-training mechanism. However, in linguistic steganalysis, pseudo-label errors propagate through iterative training, causing the student model to reinforce incorrect stego-distribution associations, thereby impairing its discriminative ability for subtle linguistic perturbations. To address this challenge, we propose SALT-LS, a self-training linguistic steganalysis framework that integrates a closed feedback loop between student and teacher models alongside a dual-constraint mechanism to improve pseudo-labels. Unlike a conventional semi-supervised steganalysis approach, we compute prototype penalties from both same-class (rather than intra-class) and cross-class perspectives, enabling more effective use of labeled data. Furthermore, we introduce an advanced-updating strategy for the student model, which is combined with the dual-constraint mechanism, forming a closed feedback loop that continuously refines the teacher model's pseudo-label generation for robust steganalysis performance. Extensive experiments on six datasets, including widely used steganographic strategies and corpora, demonstrate that SALT-LS outperforms state-of-the-art models. Our code is available.

The proliferation of digital images on the Internet has provided unprecedented convenience, but also poses significant risks of malicious theft and misuse. Digital watermarking has long been researched as an effective tool for copyright protection. However, it often falls short when addressing partial image theft, a common yet little-researched issue in practical applications. Most existing schemes typically require the entire image as input to extract watermarks. However, in practice, malicious users often steal only a portion of the image to create new content. The stolen portion can have arbitrary shape or content, being fused with a new background and may have undergone geometric transformations, making it challenging for current methods to extract correctly. To address the issues above, we propose WOFA (Watermarking One for All), a robust watermarking scheme against partial image theft. First of all, we define the entire process of partial image theft and construct a dataset accordingly. To gain robustness against partial image theft, we then design a comprehensive distortion layer that incorporates the process of partial image theft and several common distortions in channel. For easier network convergence, we employ a multi-level network structure on the basis of the commonly used embedder-distortion layer-extractor architecture and adopt a progressive training strategy. Abundant experiments demonstrate that our superior performance in the scenario of partial image theft, offering a more reliable solution for protecting digital images against unauthorized use in practical use.

Yinghan Zhou, Juan Wen, Wanli Peng, Xue Yiming, ZiWei Zhang, Wu Zhengxian. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2025.

Linguistic steganalysis is a technique to distinguish whether a text carrier contains secret information via statistical features. Current state-of-the-art methods are caught in two constraints. First, they cannot make accurate predictions on unlearned text distributions. In other words, the performance relies on the consistency of the training and testing distributions. Second, sufficient samples are required to fine-tune these models to reach their optimal states. In this article, we break through these obstacles by developing an effective steganalysis framework in a few-shot scenario. We first build the meta-datasets to simulate the real-world steganalysis environment that contains multi-distributional source and target domains with sparse target-domain samples. Then we propose a few-shot linguistic steganalysis framework combined with an adversarial meta-training mechanism to learn task-transferable features from source task sets to target tasks. Extensive experiments conducted on benchmark datasets show our model has a stable capability to learn transferable knowledge in detecting steganalysis tasks with extremely few-shot samples. We also validate the effectiveness of the model through multi-class steganalysis experiments to identify extra steganographic information involving embedding algorithms and capacities. Our proposed framework is effectively demonstrated to compensate for the drawback of state-of-the-art methods and tremendously improve the detection performance.

Traditional video steganography methods are based on modifying the covert space for embedding, whereas we propose an innovative approach that embeds secret message within semantic feature for steganography during the video editing process. Although existing traditional video steganography methods excel in balancing security and capacity, they lack adequate robustness against common distortions in online social networks (OSNs). In this paper, we propose an end-to-end robust generative video steganography network (RoGVSN), which achieves visual editing by modifying semantic feature of videos to embed secret message. We exemplify the face-swapping scenario as an illustration to demonstrate the visual editing effects. Specifically, we devise an adaptive scheme to seamlessly embed secret messages into the semantic features of videos through fusion blocks. Extensive experiments demonstrate the superiority of our method in terms of robustness, extraction accuracy, visual quality, and capacity.

Recent advances in large language models (LLMs) have blurred the boundary of high-quality text generation between humans and machines, which is favorable for generative text steganography. Currently, advanced steganographic mapping is not suitable for LLMs since most users are restricted to accessing only the black-box API or user interface of the LLMs, thereby lacking access to the training vocabulary and its sampling probabilities. In this paper, we explore a black-box generative text steganographic method based on the user interfaces of large language models, which is called LLM-Stega. The main goal of LLM-Stega is to ensure secure covert communication between Alice (sender) and Bob (receiver) by using the user interfaces of LLMs. Specifically, We first construct a keyword set and design a new encrypted steganographic mapping to embed secret messages. Furthermore, an optimization mechanism based on reject sampling is proposed to guarantee accurate extraction of secret messages and rich semantics of generated stego texts. Comprehensive experiments demonstrate that the proposed LLM-Stega outperforms current state-of-the-art methods.

Recent advances have emphasized the importance of meme stickers in open-domain dialogue systems.However, previous studies overlook the one-to-many issue that a single sticker could represent various emotions in different dialogue contexts.Additionally, they require retraining the model for new stickers which did not appear in previous training.To address the above issues, we propose in this paper an Emotion-Aware and Efficient Meme Sticker Dialogue generation framework.In the framework, we design an Emotion Adaptive Prompt to capture the emotional cues from the dialogue history, which is sent to an Emotion-Aware Fusion Decoder to guide the generation of text responses and to a meme sticker selector to choose the corresponding sticker.Furthermore, to improve the stickers' selection efficiency, we further incorporate the few-shot learning strategy into the proposed framework to avoid extensive model retraining for unseen meme stickers.Through extensive experiments, we demonstrate the superior performance of the proposed E 2 MSD compared to existing methods regarding the quality of response generation and the efficiency of meme sticker retrieval.

The growth of social networks has fueled advancements in text steganography techniques. As a covert communication form, text steganography discreetly embeds information by adding low-amplitude noise, significantly complicating its detection, and making steganographic texts increasingly difficult to identify. Existing steganalysis models achieve high detection accuracy by assuming that the training and testing sets are independent and identically distributed (i.i.d). However, meeting the i.i.d. requirement between training and testing datasets is impractical in real-world scenarios because it is often impossible to pinpoint which texts contain steganography or to identify the algorithms used in their creation. Therefore, obtaining labeled data for training is often unfeasible, and training models with each pair of source and target domains for each task significantly inconveniences the practical application of steganalysis models. Given these detection challenges, we propose a test-time adaptive steganalysis paradigm to accommodate detection scenarios without training data. Employing a generic pre-trained language model as a foundation and optimizing the model during testing allows it to self-adjust to new and varied data sets. The model relies only on the test data and its parameters in this fully test-time adaptation setting. It's important to note that detecting steganographic texts is an immense challenge; thus, we integrate test-time entropy minimization (TTem) to enhance the detection accuracy of steganographic texts. Extensive experiments show that the proposed method achieves good performance for test-time adaptation cross-domain linguistic steganalysis.

Generative steganography, a novel paradigm in information hiding, has garnered considerable attention for its potential to withstand steganalysis. However, existing generative steganography approaches suffer from the limited visual quality of generated images and are challenging to apply to lossy transmissions in real-world scenarios with unknown channel attacks. To address these issues, this paper proposes a novel robust generative image steganography scheme, facilitating zero-shot text-driven stego image generation without the need for additional training or fine-tuning. Specifically, we employ the popular Stable Diffusion model as the backbone generative network to establish a covert transmission channel. Our proposed framework overcomes the challenges of numerical instability and perturbation sensitivity inherent in diffusion models. Adhering to Kerckhoff’s principle, we propose a novel mapping module based on dual keys to enhance robustness and security under lossy transmission conditions. Experimental results showcase the superior performance of our method in terms of extraction accuracy, robustness, security, and image quality.

Existing linguistic steganalysis methods require the training and testing datasets to be independent and identically distributed (i.i.d). However, in real-world scenarios, various types of text and steganographic algorithms are employed to generate steganographic text, making it challenging to fulfill the requirement of independent and identical distribution between training and test datasets. This issue, known as the domain mismatch problem, significantly diminishes the detection performance. Thus, it is reasonable to consider domain adaptation by reducing the distribution discrepancy of different domains. However, how to measure and minimize the discrepancy for linguistic steganalysis remains a big challenge. In this paper, we put forward a cross-domain linguistic steganalysis architecture based on a new domain distance metric and adaptive weight selection network. Concretely, a novel steganographic domain distance metric (SDDM) is first proposed, which can effectively characterize the overall distribution discrepancy and capture the weak noise introduced by the information embedding process. Additionally, an adaptive weight selection network with a switching-path structure is designed to calculate domain-specific attention weights, facilitating the model to adapt to various discrepancies scenarios and enhancing its domain-invariant feature representation capability. Extensive experiments show that the proposed method achieves state-of-the-art performance for cross-domain linguistic steganalysis.

Automatic detection of lettuce growth traits is of great significance in modern greenhouse cultivation. Existing methods mainly focus on capturing coarse representations from RGB or RGB-D images with learnable convolutional neural networks. However, due to the significant appearance-varying discrepancies at different growth stages, coarse representations and inefficient depth fusion strategies limit the performance of automatic detection of lettuce growth traits. To alleviate the above problem, this paper proposes a novel detection method for lettuce growth traits based on transformer and convolutional neural network. In this method, we design a dual-transformer module and a residual module to effectively extract multi-scale representations and depth representations from appearance-varying lettuce images. In addition, a feature coupling bridge is proposed to fuse the multi-scale representations and depth representations. The experimental results show that our method outperforms the state-of-the-art methods.

Recently, print-resist watermarking has attracted much interest. Many watermarking schemes have been proposed to achieve robustness against printing and camera-capturing. Though these studies have shown promising results overall, they overlook the scenario of film-coating photographs, which is a significant and common scenario in real-world. The film-coating process can introduce severe distortions to the original image and easily incapacitate the watermark. To address this issue, we propose WRAP, a novel Watermarking scheme Robust Against film-coating upon Printed photographs. We first construct a large dataset with 120,000 film-coating images to train a style-transfer-based film-coating simulation network. Based on the network, we propose a comprehensive distortion layer which includes film-coating simulation and common disturbances in the printing and camera-capturing process. With the distortion layer, the entire embedding and extraction network can be trained end-to-end to gain robustness against film-coating upon printed photographs. Extensive experiments demonstrate the superior performances of our model in terms of robustness and generalization capability. Our model outperforms state-of-the-art print-resist watermarking schemes when testing in film-coating scenario and achieves outstanding performance across various datasets, types of films, and cameras. To the best of our knowledge, we are the first to conduct research on digital watermarking in film-coating scenario.

Steganography has received massive attention from the information-hiding community due to its excellent security for covert communication systems. Existing work focuses on improving security on single-modal media while cross-modal media is less explored. However, cross-modal interaction has become a prevalent social manner on current social networks, which arises potential behavioral security issues of single-modal steganography. In this letter, we propose a novel text steganography to explore the practicability of cross-modal steganography. The proposed scheme is composed with image encoder, message encoder, language model, and message extractor networks, where the generated stego texts are semantically consistent with the input reference image. In addition, current generative text steganography schemes are vulnerable to text attack based on synonym substitution since these heuristic algorithms embed information by constructing a mapping between secret messages and candidate tokens. Thus, we design a text attack layer based on synonym substitution to further improve the robustness of generated stego text. Experiments illustrate the superior performance of the proposed cross-modal steganography scheme in terms of security and robustness.

Recent methods with deep neural networks for text steganalysis have succeeded in mining various feature representations. However, a limited number of studies have explicitly analyzed potential security issues of generative text steganography. Furthermore, current text steganalysis approaches lack detailed consideration in the intricate design of deep learning architectures tailored to these challenges. In this article, in order to tackle these problems, we first theoretically and empirically analyze the inevitable embedding distortions of generative text steganography at a semantic and statistical levels. In light of this, we then propose an innovative text steganalysis method based on hierarchical supervised learning and a dual attention mechanism. Concretely, to extract highly effective semantic features, the proposed method involves fine-tuning a BERT extractor through the hierarchical supervised learning that combines signals from multiple softmax classifiers, rather than relying solely on the final one. The mean and standard deviation values in the Gaussian distribution of cover and stego texts are then estimated using an encoder of variational autoencoders and used to capture features representing the statistical distortion of generative text steganography. Subsequently, we introduce a dual attention mechanism that dynamically fuses the semantic and statistical features, thereby creating discriminative feature representations essential for text steganalysis. The experimental results demonstrate that our proposed text steganalysis method surpasses the current state-of-the-art techniques across three distinct text steganalysis scenarios: specific text steganalysis, semi-blind text steganalysis, and blind text steganalysis.

Category-level 6D pose estimation can be better generalized to unseen objects in a category compared with instance-level 6D pose estimation. However, existing category-level 6D pose estimation methods usually require supervised training with a sufficient number of 6D pose annotations of objects which makes them difficult to be applied in real scenarios. To address this problem, we propose a self-supervised framework for category-level 6D pose estimation in this paper. We leverage DeepSDF as a 3D object representation and design several novel loss functions based on DeepSDF to help the self-supervised model predict unseen object poses without any 6D object pose labels and explicit 3D models in real scenarios. Experiments demonstrate that our method achieves comparable performance with the state-of-the-art fully supervised methods on the category-level NOCS benchmark.

Traditional text steganalysis methods rely on a large amount of labeled data. At the same time, the test data should be independent and identically distributed with the training data. However, in practice, a large number of text types make it difficult to satisfy the i.i.d condition between the training set and the test set, which leads to the problem of domain mismatch and significantly reduces the detection performance. In this paper, we draw on the ideas of domain adaptation and transductive learning to design a novel text steganalysis method. In this method, we design a distributed adaptation layer and adopt three loss functions to achieve domain adaptation, so that the model can learn the domain-invariant text features. The experimental results show that the method has better steganalysis performance in the case of domain mismatch.

Text has become one of the most extensively used digital media in Internet, which provides steganography an effective carrier to realize confidential message hiding. Nowadays, generation-based linguistic steganography has made a significant breakthrough due to the progress of deep learning. However, previous methods based on recurrent neural network have two deviations including exposure bias and embedding deviation, which seriously destroys the security of steganography. In this article, we propose a novel linguistic steganographic model based on adaptive probability distribution and generative adversarial network, which achieves the goal of hiding secret messages in the generated text while guaranteeing high security performance. First, the steganographic generator is trained by using generative adversarial network to effectively tackle the exposure bias, and then the candidate pool is obtained by a probability similarity function at each time step, which alleviates the embedding deviation through dynamically maintaining the diversity of probability distribution. Third, to further improve the security, a novel strategy that conducts information embedding during model training is put forward. We design various experiments from different aspects to verify the performance of the proposed model, including imperceptibility, statistical distribution, anti-steganalysis ability. demonstrate that our proposed model outperforms the current state-of-the-art steganographic schemes.

3D object detection is an important scene understanding task in autonomous driving and virtual reality. Approaches based on LiDAR technology have high performance, but LiDAR is expensive. Considering more general scenes, where there is no LiDAR data in the 3D datasets, we propose a 3D object detection approach from stereo vision which does not rely on LiDAR data either as input or as supervision in training, but solely takes RGB images with corresponding annotated 3D bounding boxes as training data. As depth estimation of object is the key factor affecting the performance of 3D object detection, we introduce an Instance-DepthAware (IDA) module which accurately predicts the depth of the 3D bounding box’s center by instance-depth awareness, disparity adaptation and matching cost reweighting. Moreover, our model is an end-to-end learning framework which does not require multiple stages or postprocessing algorithm. We provide detailed experiments on KITTI benchmark and achieve impressive improvements compared with the existing image-based methods. Our code is available at https://github.com/swords123/IDA-3D.

In reality, oscillators experience spectral broadening due to internal noise process, which becomes a potentially serious problem in OFDM transmission schemes, especially when high order signal constellations are employed. The paper analyzes the influence of the transmitter phase noise to the OFDM system in the multi-path fading channel, and shows when the transmitter contains large phase noise, the immunity of OFDM system to multipath fading is destroyed and the frequency domain model of the influence of phase noise used by some algorithms is no longer suitable. Then a feedback method to reduce the transmitter phase noise is proposed. Simulation results show that after pre- correction of transmitter phase noise, the existing algorithms that have been proposed in the receiver end can be performed to mitigate the receiver phase noise more effectively in the scenario when PHN generated at the transmitter is large compared to PHN generated at the receiver end.