Model merging has emerged as an efficient technique for expanding large language models (LLMs) by integrating specialized expert models. However, it also introduces a new threat: model merging stealing, where free-riders exploit models through unauthorized model merging. Unfortunately, existing defense mechanisms fail to provide effective protection. Specifically, we identify three critical protection properties that existing methods fail to simultaneously satisfy: (1) proactively preventing unauthorized merging; (2) ensuring compatibility with general open-source settings; (3) achieving high security with negligible performance loss. To address the above issues, we propose MergeBarrier, a plug-and-play defense that proactively prevents unauthorized merging. The core design of MergeBarrier is to disrupt the Linear Mode Connectivity (LMC) between the protected model and its homologous counterparts, thereby eliminating the low-loss path required for effective model merging. Extensive experiments show that MergeBarrier effectively prevents model merging stealing with negligible accuracy loss.

Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths—progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining contrastive reindexing for inter-class isolation and constrained cascade generation for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering the first comprehensive defense against knowledge base extraction attacks.

The widespread adoption of encryption across web-based services is compelling both malicious attackers and network defenders to tailor their tool repositories to encrypted traffic. For various security applications in encrypted networks, the analysis of encrypted traffic lies as the fundamental basis. Due to the inherent concealment of content-related information in encrypted packets, the dynamics of encrypted traffic emerge as the discernible variable warranting comprehensive analysis. This paper explores inherent temporal correlations within the encrypted traffic and proposes a novel algorithm calledCriss-crossTrafficTransformer (CTT), tailored to address unique challenges in encrypted traffic analysis. CTT distinguishes itself by employing a specialized time series Transformer that innovatively utilizespatchingandcriss-cross attention module(CAM) to dissect and interpret encrypted traffic, with the “criss” part mining the long-/short-term temporal correlations across time, and the “cross” part capturing temporal correlations across multiple feature dimensions of encrypted traffic. CTT provides a unified framework capable of accommodating diverse analytical granularities, including packet-level, flow-level, and packet-to-flow level. Notably, CTT not only encompasses encrypted traffic classification but also extends to encrypted traffic forecasting, an area that remains largely underexplored in existing literature. We evaluate CTT in the context of fingerprinting attacks and malware detection over 5 real-world datasets against 13 benchmarks. The results indicate that CTT achieves up to 15.56% performance improvement over SOTA solutions for encrypted traffic classification. Particularly, CTT demonstrates over 92.5% forecasting accuracy, which is comparable to SOTA performances in the seen-and-classify scenario, suggesting its potential applicability to broader domains like social network behavioral analysis. Our code is available athttps://github.com/Amanda-HuaDing/Criss-cross_Traffic_Transformer.

Low-Light Video Enhancement (LLVE) seeks to restore dynamic or static scenes plagued by severe invisibility and noise. In this paper, we present an innovative video decomposition strategy that incorporates view-independent and view-dependent components to enhance the performance of LLVE. We leverage dynamic cross-frame correspondences for the view-independent term (which primarily captures intrinsic appearance) and impose a scene-level continuity constraint on the view-dependent term (which mainly describes the shading condition) to achieve consistent and satisfactory decomposition results. To further ensure consistent decomposition, we introduce a dual-structure enhancement network featuring a cross-frame interaction mechanism. By supervising different frames simultaneously, this network encourages them to exhibit matching decomposition features. This mechanism can seamlessly integrate with encoder-decoder single-frame networks, incurring minimal additional parameter costs. Extensive experiments are conducted on widely recognized LLVE benchmarks, covering diverse scenarios. Our framework consistently outperforms existing methods, establishing a new SOTA performance.

Pre-trained large language models (LLMs) are commonly fine-tuned to adapt to downstream tasks. Since the majority of knowledge is acquired during pre-training, attributing the predictions of fine-tuned LLMs to their pre-training data may provide valuable insights. Influence functions have been proposed as a means to explain model predictions based on training data. However, existing approaches often fail to compute "multi-stage" influence and lack scalability to billion-scale LLMs. In this paper, we propose multi-stage influence functions to attribute the downstream predictions of fine-tuned LLMs to pre-training data under the full-parameter fine-tuning paradigm. To enhance the efficiency and practicality of our multi-stage influence function, we leverage Eigenvalue-corrected Kronecker-Factored (EK-FAC) parameterization for efficient approximation. Empirical results validate the superior scalability of EK-FAC approximation and the effectiveness of our multi-stage influence function. Additionally, case studies on a real-world LLM, dolly-v2-3b, demonstrate its interpretive power, with exemplars illustrating insights provided by multi-stage influence estimates.

Proprietary large language models (LLMs) exhibit strong generalization capabilities across diverse tasks and are increasingly deployed on edge devices for efficiency and privacy reasons. However, deploying proprietary LLMs at the edge without adequate protection introduces critical security threats. Attackers can extract model weights and architectures, enabling unauthorized copying and misuse. Even when protective measures prevent full extraction of model weights, attackers may still perform advanced attacks, such as fine-tuning, to further exploit the model. Existing defenses against these threats typically incur significant computational and communication overhead, making them impractical for edge deployment. To safeguard the edge-deployed LLMs, we introduce CoreGuard, a computation- and communication-efficient protection method. CoreGuard employs an efficient protection protocol to reduce computational overhead and minimize communication overhead via a propagation protocol. Extensive experiments show that CoreGuard achieves upper-bound security protection with negligible overhead.

Natural language processing (NLP) models are widely used in various scenarios, yet they are vulnerable to adversarial attacks. Existing works aim to mitigate this vulnerability, but each work targets a specific attack category or has computational overhead limitations, making them vulnerable to adaptive attacks. In this paper, we exhaustively investigate the adversarial attack algorithms in NLP and discover that existing attack algorithms mainly disrupt the importance distribution of words in a text. A well-trained model can distinguish subtle importance distribution differences between clean and adversarial texts. Based on this intuition, we propose TextDefense, a new adversarial example detection framework that utilizes the target model’s capability to defend against adversarial attacks, requiring no prior knowledge. Unlike previous approaches, TextDefense is attack-type agnostic and outperforms existing methods in experiments with different architectures, datasets, and attack methods. We also discover that the target model’s generalizability is a leading factor influencing the performance of TextDefense. Finally, we provide insights into the adversarial attacks in NLP and the principles of our defense method by analyzing the properties of the target model and the adversarial example.

As software systems grow in complexity, scale, and update frequency, parallel fuzzing has become essential for mitigating the efficiency limitations of traditional fuzzing. Effective task allocation is vital in maximizing parallel fuzzing efficiency and has garnered significant attention. However, current strategies often neglect critical code areas, treating all regions uniformly and resulting in suboptimal exploration. To address the limitations of current approaches, we present FlexFuzz, a novel parallel fuzzing system. First, we identify the boundary basic blocks that connect covered and uncovered areas, dynamically adapting them as fuzzing progresses. Second, we introduce a boundary-sensitive task allocation scheme that assigns fuzzing tasks based on the identified boundary basic blocks and their potential for exploration. Finally, to ensure focused exploration, we implement a multi-target, distance-guided approach that directs each instance to concentrate on its relevant task area. We have implemented a prototype of FlexFuzz and comprehensively evaluated it against the state-of-the-art parallel fuzzing systems. Across standard benchmarks, FlexFuzz surpasses other parallel tools: it increases coverage by 20.09% over the next best tool (PAFL), and identifies 33.75% more vulnerabilities than the next best tool (AFL++).

With the increasing size of Internet of Things (IoT) devices, cyber threats to IoT systems have increased. Federated learning (FL) has been implemented in an anomaly-based intrusion detection system (NIDS) to detect malicious traffic in IoT devices and counter the threat. However, current FL-based NIDS mainly focuses on global model performance and lacks personalized performance improvement for local data. To address this issue, we propose a novel personalized federated meta-learning intrusion detection approach (PerFLID), which allows multiple participants to personalize their local detection models for local adaptation. PerFLID shifts the goal of the personalized detection task to training a local model suitable for the client’s specific data, rather than a global model. To meet the real-time requirements of NIDS, PerFLID further refines the client selection strategy by clustering the local gradient similarities to find the nodes that contribute the most to the global model per global round. PerFLID can select the nodes that accelerate the convergence of the model, and we theoretically analyze the improvement in the convergence speed of this strategy over the personalized federated learning algorithm. We experimentally evaluate six existing FL-NIDS approaches on three real network traffic datasets and show that our PerFLID approach outperforms all baselines in detecting local adaptation accuracy by 10.11% over the state-of-the-art scheme, accelerating the convergence speed under various parameter combinations.

In the real world, the stable operation of a network is usually inseparable from the mutual support of other networks. In such an interdependent network, a node in one layer may depend on multiple nodes in another layer, forming a complex one-to-many dependence relationship. Meanwhile, there may also be higher-order interactions between multiple nodes within a layer, which increase the connectivity within the layer. Interlayer dependencies and intralayer connectivity may become key factors affecting network reliability, because failures within a layer will propagate to another layer through dependencies, and the cascading effects within and between layers may trigger catastrophic network collapse. However, existing research on one-to-many interdependence often neglects intralayer higher-order structures and lacks a unified theoretical framework for interlayer dependencies. Moreover, current research on interdependent higher-order networks typically assumes idealized one-to-one interlayer dependencies, which does not reflect the complexity of real-world systems. These limitations hinder a comprehensive understanding of how such networks withstand failures. Therefore, this article investigates the robustness of one-to-many interdependent higher-order networks under random attacks. Depending on whether node survival requires at least one dependence edge or multiple dependence edges, we propose four interlayer interdependence conditions and analyze the network’s robustness after cascading failures induced by random attacks. Using percolation theory, we establish a unified theoretical framework that reveals how higher-order interaction structures within intralayers and interlayer coupling parameters affect network reliability and system resilience. In addition, we extend our study to partially interdependent hypergraphs. We validate our theoretical analysis on both synthetic and real-data-based interdependent hypergraphs, offering insights into the optimization of network design for enhanced reliability.

Hierarchical Federated Learning (HFL) improves the scalability and communication efficiency of the system and achieves load balancing at each level. Incentive mechanisms enhance participant motivation and optimize resource allocation for HFL. However, existing mechanisms mainly focus on maximizing individual utility from the quantity of client data while neglecting to optimize social utility from the learning quality perspective. Meanwhile, strategic behavior and heterogeneous devices can significantly degrade the performance of incentive mechanisms. To this end, we propose a quality-aware incentive mechanism (QAIM) for HFL to improve training efficiency. Specifically, we first systematically evaluate the learning quality of clients based on their training loss and historical records, which allows us to recruit high-quality clients for model updating selectively. Then, we model the cloud-edge-end interaction and cooperation as a three-layer Stackelberg game to analyze the strategies of participants and utilize carefully designed algorithms to derive the solution of the unique Stackelberg Equilibrium (SE). Through the Pareto improvement of client association modeled as a coalition game, we can maximize social utility. Experimental results on both synthetic and real-world datasets demonstrate that our QAIM outperforms the state-of-the-art baselines, with an average increase in accuracy and social utility of 17% and 45%, respectively.

Designing a query-efficient attack strategy to generate high-quality adversarial examples under the hard-label black-box setting is a fundamental yet challenging problem, especially in natural language processing (NLP). The process of searching for adversarial examples has many uncertainties (e.g., an unknown impact on the target model's prediction of the added perturbation) when confidence scores cannot be accessed, which must be compensated for with a large number of queries. To address this issue, we propose TextCheater, a decision-based metaheuristic search method that performs a query-efficient textual adversarial attack task by prohibiting invalid searches. The strategies of multiple initialization points and Tabu search are also introduced to keep the search process from falling into a local optimum. We apply our approach to three state-of-the-art language models (i.e., BERT, wordLSTM, and wordCNN) across six benchmark datasets and eight real-world commercial sentiment analysis platforms/models. Furthermore, we evaluate the Robustly optimized BERT pretraining Approach (RoBERTa) and models that enhance their robustness by adversarial training on toxicity detection and text classification tasks. The results demonstrate that our method minimizes the number of queries required for crafting plausible adversarial text while outperforming existing attack methods in the attack success rate, fluency of output sentences, and similarity between the original text and its adversary.

The rich semantic information in Control Flow Graphs (CFGs) of executable programs has made Graph Neural Networks (GNNs) a key focus for malware detection. However, existing CFG-based detection techniques face limitations in node feature extraction, such as information loss, neglect of execution sequence information, and redundancy in representation vectors. These limitations compromise the balance between high efficiency and precision when training detectors. Addressing this, we introduce an innovative Malware CFG Node Embedding (MalGNE) method. This approach utilizes a novel instruction encoding rule to address the Out-Of-Vocabulary(OOV) problem, generates high-quality initial vectors. Then, it employs aggregation layer and sequence layer to extract node aggregation feature and execution sequence feature, in conjunction with GNNs to develop a pre-trained node embedding model. The model maps the semantic information of node assembly instruction sequences into a compact, low-dimensional continuous space, ensuring high-quality feature extraction, and enhancing the performance and efficiency of the detector. We trained the MalGNE model using the BIG 2015 dataset and validated MalGNE-enhanced detector on the SOREL-20M and BODMAS datasets. MalGNE-enhanced detector demonstrates outstanding performance and efficiency in low-dimensional spaces, especially when the dimensionality of the node feature vector is reduced to 16. MalGNE-enhanced detector not only maintains a high detection accuracy of 95.49%. sacrificing only about 1.7% of accuracy to save approximately 73% of training time compared to 128 dimensions.

Recommendation systems powered by artificial intelligence (AI) are widely used to improve user experience. However, AI inevitably raises privacy leakage and other security issues due to the utilization of extensive user data. Addressing these challenges can protect users’ personal information, benefit service providers, and foster service ecosystems. Presently, numerous techniques based on differential privacy have been proposed to solve this problem. However, existing solutions encounter issues such as inadequate data utilization and a tenuous trade-off between privacy protection and recommendation effectiveness. To enhance recommendation accuracy and protect users’ private data, we propose ID-SR, a novel privacy-preserving social recommendation scheme for trustworthy AI based on the infinite divisibility of Laplace distribution. We first introduce a novel recommendation method adopted in ID-SR, which is established based on matrix factorization with a newly designed social regularization term for improving recommendation effectiveness. We then propose a differential privacy-preserving scheme tailored to the above method that leverages the Laplace distribution’s characteristics to safeguard user data. Theoretical analysis and experimentation evaluation on two publicly available datasets demonstrate that our scheme achieves a superior balance between privacy protection and recommendation effectiveness, ultimately delivering an enhanced user experience.

Generative adversarial networks (GANs) have been widely used for creating diverse data such as images, audio, and videos. However, as the training data of GANs often contain sensitive information, they are vulnerable to privacy attacks on the training dataset, such as membership inference attacks (MIAs). To improve the resistance of GANs to MIA while ensuring their performance, we design a novel GAN framework PGAN-KD (member Privacy protection of GANs based on Knowledge Distillation). PGAN-KD prevents the discriminator from leaking membership information of the training data by introducing knowledge distillation and gradient clipping. Specifically, it adopts an extra teacher discriminator to distilling knowledge and then transfer it to a student discriminator, and thereby isolating the attacker from indirectly obtaining private information through the generator. In addition, the teacher discriminator prevents itself from MIAs through gradient clipping. To evaluate the performance of PGAN-KD, we conducted experiments on both real and simulated datasets. The results indicate that PGAN-KD achieves a 7.8% improvement in privacy protection levels while maintaining similar generation performance with the baselines.