End-to-End Encryption (E2EE) effectively prevents messaging platforms from accessing media content but limits the automatic detection of harmful media using popular perceptual hash-matching methods. Recently, Private Hash Matching (PHM) techniques have shown great potential for moderating harmful content in E2EE. However, many state-of-the-art PHM schemes either focus solely on exact hash matching, neglecting the more practical fuzzy hash matching, or fail to balance privacy, efficiency, and robustness. In this paper, we present an efficient and robust Fuzzy Private Hash Matching (FPHM) scheme for harmful media moderation in E2EE. Our scheme comprises two steps: 1) coarse matching on the client side that filters out the legal media using an index structure based on a Dynamic-Encoding-Tree Locality-Sensitive Hash (DET-LSH), 2) fine-grained, distance-aware fuzzy matching through client-server interaction on the filtered data. Security analyses confirm that the scheme robustly protects both user media information and the server's harmful hash set from unauthorized disclosure. The experiment indicates that FPHM enhances inspection efficiency and robustness with negligible false negatives.

In response to the rapid growth of data in cyberspace and the resulting challenge to storage capacity, this paper proposes a new off-chain storage scheme for blockchain based on erasure codes. The scheme allows for the application of different coding methods tailored to various scenarios. To validate its feasibility, an off-chain distributed storage test system built on the proposed framework is implemented. The test results demonstrate that the proposed scheme ensures blockchain data integrity from local and global perspectives reducing the system's repair bandwidth. This novel off-chain storage approach addresses blockchain's storage limitations and has the potential to enhance the overall robustness and reliability of the system.

Privacy attacks on machine learning (ML) models pose significant risks to individuals whose personal data is used for training or querying these models. Although concerns about the potential exposure of sensitive information through ML models continue to grow, existing safeguard mechanisms primarily focus on security threats, often neglecting privacy risks. In this paper, we examine existing tools to assess privacy risks of ML models and provide an overview of various privacy attacks and defense strategies. Given the lack of a comprehensive framework for assessing privacy vulnerabilities, we propose a generic framework for evaluating the privacy of ML systems and establish a set of tailored evaluation metrics for different types of privacy attacks. In addition, we develop a dedicated testbed to implement our framework and present experimental results that demonstrate the impact of various privacy attacks on different ML models.

Smart meter-based individual load forecasts are more and more widely deployed to serve smart grid and home energy management. Customary load forecasting systems collect a massive amount of fine-grained electrical data from people’s smart meters in plaintext, inevitably raising privacy concerns and even anti-smart-meter initiatives. Current privacy solutions either compromise accuracy and efficacy or require the redeployment of trusted infrastructure. In this paper, we present PrivGrid, the first systematic solution for smart grids that collects, clusters, trains, and forecasts customers’ load data in a privacy-preserving way. Moreover, we highlight the technical contribution of our building block: a novel and fast arithmetic multiplication triple via secure inner product protocol outperforms the existing methods and may be included in other privacy computing modules. Then, we develop efficient secure protocols to enable the arithmetic operations of individual load forecasting in a server-aided model and utilize the best alternatives to nonlinear functions. Besides, aggregating all of our individual forecasts can produce a more accurate estimate of the system-level load than the typical aggregate technique. We rigorously prove that the servers cannot obtain the user’s historical load data and short-term load forecast values while providing services. PrivGrid is also tested on real residential smart meter data to show its efficiency, and the relevant code has been made available to the community for further research.

Decentralized Finance (DeFi), a pivotal component of the emerging Web3 landscape, is gaining popularity but remains vulnerable to market manipulations, such as wash trading. Wash trading is an illegal practice, where traders buy and sell assets to themselves within cryptocurrency exchanges to artificially inflate trading volumes and distort market perceptions. However, current research primarily focuses on traditional exchanges based on the Order-book mechanism (similar to stock markets), while ignoring the Automated Market Maker (AMM) exchanges, which dominate over 75% of the market and represent a significant innovation within the DeFi. This study utilizes entity recognition technology to detect wash trading on AMM exchanges within Ethereum-like systems, based on the understanding that colluding addresses (perceived as the same entity) must use ETH for transaction fees and exhibit direct or indirect ETH transfer links. We identify wash trading when addresses with transfer connections almost simultaneously buy and sell assets while their total asset holdings remain nearly constant. This comprehensive blockchain network analysis, compared to focusing solely on transactions within exchanges, unveils covert wash trading activities. Our detection method achieves a 95.9% recall and a 96.7% true negative rate in identifying pools affected by wash trading, demonstrating its superiority over existing methods. Furthermore, we apply our method to 98,945 pools from Uniswap V2 & V3 (the most popular AMM exchanges on Ethereum) and identify 1,070,626 abnormal transactions, totaling $27.51 billion in trading volume. Analysis of these transactions uncovers insights into wash traders’ behaviors, including the utilization of multiple addresses and the dual roles of certain addresses as wash traders and liquidity providers. These insights are crucial for developing more effective strategies to combat fraudulent activities in the DeFi ecosystem and enhance financial scrutiny.

Online syndicated lending offers quick and convenient financing support to individuals, while diversifying risks by pooling funds from multiple lenders into loan projects. It has experienced explosive growth, reaching a multibillion-dollar market. Establishing transparency is essential for constructing a trusted, fair, and regulation-compliant financial collaboration model. Meanwhile, confidentiality must be maintained to protect the sensitive financial information of individual lenders. Multi-party computation (MPC) can protect the input privacy of lenders, but it cannot safeguard the sensitive information revealed by the fund flow itself. To address these challenges, we propose a new collaborative financial ledger for online syndicated lending. It leverages homomorphic encryption/commitment to enable the reuse of intermediary states without compromising privacy throughout the entire lifecycle of a loan. This system also supports efficient regulation-compliant auditing. We streamline the framework design to optimize performance and develop a prototype system. Even with a large syndicate of 100 lenders, the system still achieves low-latency performance.

Flash Loan, a popular lending service in the decentralized finance (DeFi) ecosystem, allows users to borrow a large number of virtual assets without any collateral. It can be leveraged to support many financial activities (such as arbitrage, collateral swap, self-liquidation, etc.), but unfortunately, it is often abused for malicious intent. One example of abusing flash loan servicing is to simultaneously sell and buy the same crypto currency on the same exchange to mislead the market, aka wash trading. It can manipulate the crypto currency market at a very low cost (anecdotally average around 0.033 ETH gas fee for each transaction on Ethereum mainnet), thereby dramatically damaging the stability and fairness of the market. More seriously, attackers can amplify the market impact by borrowing more assets from Flash Loan platforms. Until now, there has been little attention paid to Flash-Loan-based wash trading, but meanwhile, we have started to witness significant wash trading activities using Flash Loan. In this research, we analyze the properties of Flash-Loan-based wash trading in detail and propose a heuristic-based detection method. The real-world Flash Loan transaction data from Ethereum is used to verify our proposed detection method and more than 6,000 wash transactions were found. Moreover, we analyze the relationship between wash transactions and fluctuations in the price and volume of targeted assets. Finally, we evaluate the cost difference between traditional wash trading and Flash-Loan-based wash trading to reveal the attackers' motivation.