The rapid advancement of large language models (LLMs) has blurred the line between AI-generated and human-written text. This progress brings societal risks such as misinformation, authorship ambiguity, and intellectual property concerns, highlighting the urgent need for reliable AI-generated text detection methods. However, recent advances in generative language modeling have resulted in significant overlap between the feature distributions of human-written and AI-generated text, blurring classification boundaries and making accurate detection increasingly challenging. To address the above challenges, we propose a DNA-inspired perspective, leveraging a repair-based process to directly and interpretably capture the intrinsic differences between human-written and AI-generated text. Building on this perspective, we introduce **DNA-DetectLLM**, a zero-shot detection method for distinguishing AI-generated and human-written text. The method constructs an ideal AI-generated sequence for each input, iteratively repairs non-optimal tokens, and quantifies the cumulative repair effort as an interpretable detection signal. Empirical evaluations demonstrate that our method achieves state-of-the-art detection performance and exhibits strong robustness against various adversarial attacks and input lengths. Specifically, DNA-DetectLLM achieves relative improvements of **5.55\%** in AUROC and **2.08\%** in F1 score across multiple public benchmark datasets. Code and data are available at https://github.com/Xiaoweizhu57/DNA-DetectLLM.

Recently, path inference-based knowledge graph reasoning (KGR) methods have attracted great attention due to their good performance and interpretability. However, as the number of hops increases, the search space grows exponentially, making the reward sparse and the process of reasoning difficult. To alleviate this problem, we propose the Multimodality-guided Hierarchical Policy Search (MHPS) for KGR, which introduces multimodal hierarchical guidance to each layer of policies during policy search. On the one hand, multimodal guidance reserves rich information on different dimensions, providing more opportunities to find better paths. On the other hand, this leads to better interaction between the two agents, resulting in more concise guidance for policy stepping. Experimental results on two public datasets demonstrate that the proposed approach outperforms state-of-the-art methods on multi-hop KGR.

Anonymous networks play a crucial role in preserving information privacy, yet simultaneously spark technical conflicts and gamesmanship between their maintainers and regulatory authorities. To solve the above conflicts and economic losses in real networks, it is imminent to realize adversarial exercises in anonymous networks and validate new technologies and scenarios in the cyber range. It is well known that the two dominant types of anonymity networks are Tor and Invisible Internet Project (I2P). This paper establishes a cyber range based on I2P to realize a task-driven automated scenario construction technique. The proposed task-driven automated scenario construction technique can solve the problem of decoupling between business scenarios and I2P cyber range network infrastructure. Specifically, our approach allows users to upload models/executable code to extend flexibly and fine-grained control I2P nodes, protocols, and traffic behavior characteristics. Then it empowers users to define application scenarios as needed, enabling them to handle intricate business scenarios programmatically. Therefore, it further supports diverse adversarial exercises and the validation of new technologies and scenarios within the dark web.

The impressive development of facial manipulation techniques has raised severe public concerns. Identity-aware methods, especially suitable for protecting celebrities, are seen as one of promising face forgery detection approaches with additional reference video. However, without in-depth observation of fake video’s characteristics, most existing identity-aware algorithms are just naive imitation of face verification model and fail to exploit discriminative information. In this article, we argue that it is necessary to take both spatial and temporal perspectives into consideration for adequate inconsistency clues and propose a novel forgery detector named SpatioTemporal IDentity network (STIDNet). To effectively capture heterogeneous spatiotemporal information in a unified formulation, our STIDNet is following a knowledge distillation architecture that the student identity extractor receives supervision from a spatial information encoder (SIE) and a temporal information encoder (TIE) through multiteacher training. Specifically, a regional sensitive identity modelling paradigm is proposed in SIE by introducing facial blending augmentation but with uniform identity label, thus encourage model to focus on spatial discriminative region like outer face. Meanwhile, considering the strong temporal correlation between audio and talking face video, our TIE is devised in a cross-modal pattern that the audio information is introduced to supervise model exploiting temporal personalized movements. Benefit from knowledge transfer from SIE and TIE, STIDNet is able to capture individual’s essential spatiotemporal identity attributes and sensitive to even subtle identity deviation caused by manipulation. Extensive experiments indicate the superiority of our STIDNet compared with previous works. Moreover, we also demonstrate STIDNet is more suitable for real-world implementation in terms of model complexity and reference set size.

Scene text editing (STE) aims to replace text with the desired one while preserving background and styles of the original text. However, due to the complicated background textures and various text styles, existing methods fall short in generating clear and legible edited text images. In this study, we attribute the poor editing performance to two problems: 1) Implicit decoupling structure. Previous methods of editing the whole image have to learn different translation rules of background and text regions simultaneously. 2) Domain gap. Due to the lack of edited real scene text images, the network can only be well trained on synthetic pairs and performs poorly on real-world images. To handle the above problems, we propose a novel network by MOdifying Scene Text image at strokE Level (MOSTEL). Firstly, we generate stroke guidance maps to explicitly indicate regions to be edited. Different from the implicit one by directly modifying all the pixels at image level, such explicit instructions filter out the distractions from background and guide the network to focus on editing rules of text regions. Secondly, we propose a Semi-supervised Hybrid Learning to train the network with both labeled synthetic images and unpaired real scene text images. Thus, the STE model is adapted to real-world datasets distributions. Moreover, two new datasets (Tamper-Syn2k and Tamper-Scene) are proposed to fill the blank of public evaluation datasets. Extensive experiments demonstrate that our MOSTEL outperforms previous methods both qualitatively and quantitatively. Datasets and code will be available at https://github.com/qqqyd/MOSTEL.

Benefiting from the popularity of deep learning theory, scene text detection algorithms have developed rapidly in recent years. Methods representing text region by text segmentation map are proved to capture arbitrary-shaped text in a more flexible and accurate way. However, such segmentation-based methods are prone to be disturbed by the text-like background patterns (like the fence, grass, etc.), which generally suffer from imprecise boundary detail problem. In this paper, LEMNet is proposed to handle the imprecise boundary problem by guiding the generation of text boundary based on a priori constraint. In the training stage, Boundary Segmentation Branch is firstly constructed to predict coarse boundary mask for each text instance. Then, through mapping pixels into an embedding space, the proposed Pixel Embedding Branch makes the embedding representation of boundary points learn to be more similar, meanwhile enlarging the characteristic distance between background points and boundary points. During inference, noise in the coarse boundary segmentation map can be effectively suppressed by a Noisy Point Suppression Algorithm among pixel embedding vectors. In this way, LEMNet can generate a more precise boundary description of text regions. To further enhance the distinguishability of boundary features, we propose a Context Enhancement Module to capture feature interactions in different representation subspaces, in which features are parallelly performed attention and concatenated to generate enhanced features. Extensive experiments are conducted over four challenging datasets, which demonstrate the effectiveness of LEMNet. Specifically, LEMNet achieves F-measure of 85.2%, 87.6% and 85.2% on CTW1500, Total-Text and MSRA-TD500 respectively, which is the latest SOTA.

Privacy is currently one of the most concerned issues in Cyberspace. Tor is the most widely used system in the world for anonymously accessing Internet. However, Tor is known to be vulnerable to end-to-end traffic correlation attacks when an adversary is able to monitor traffic at both communication endpoints. In this paper, we present a set of novel Trapper Attacks that can be used to deanonymize user activities by both AS-level adversaries and Node-level adversaries in a Tor network. First, AS-level adversaries can exploit the occasional failures of censored network to selectively control entry guards of the Tor users. Second, the adversaries can exploit poor reliability of the Tor communication (e.g., natural churn) to compromise the exiting nodes and the anonymous path. Once the adversaries gain control of the routes, they can identify and inspect any traffic entering and leaving the Tor network, consequently, deanonymize a Tor user’s activity in the network. To demonstrate the effectiveness and feasibility of this attacks, we implemented a tool that can launch the proposed Trapper Attacks to automatic reveal communication relationships between a Tor user and its destinations running on a live Tor network. We also present a formal analysis framework to evaluate the integrity of the Tor network. With this framework, we successfully obtained quantitative estimates of Tor’s security vulnerability. The proposed Trapper Attacks are also designed to scale up in real-world Tor networks. Namely, it allows an adversary to perform deanonymization in honey relays effectively, and compromise the anonymity of Tor clients in real time. Our experimental results show that the proposed attacks succeed in less than 40 seconds achieving a 100% accuracy rate and a false positive rate close to 0.

Ethereum, one of the most popular cryptocurrencies, has attracted increasing attention of people in various fields. As the backbone of Ethereum, its peer-to-peer network has an effect on almost every aspect of the ecosystem. Consequently, it's necessary to understand the topological properties of Ethereum P2P network. In this paper, we conducted a measurement of Ethereum P2P network. Our result shows that the graphs of Ethereum network have a small average shortest path length and a large clustering coefficient, and the degree distribution of nodes does not follow a pure power-law distribution. These indicate that Ethereum network is very close to a small world network. Though there are a large number of stale nodes and useless nodes, Ethereum is still resilient to both random failures and targeted attacks. What's more, we find that there are around one hundred abnormal nodes in the network. The IP addresses of nodes included in the neighbors messages they reply are replaced with their own IP addresses. Those nodes might have a bad influence on network routing.

Tor hidden services (HSs) are used to provide anonymity services to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor HSs use decentralized architecture that makes it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor HSs that allow an adversary with an extremely low cost to block arbitrary Tor HSs. We found that the dominant cost of this attack is IP address resources, the experimental results show that we can use only three IP addresses to eclipse an arbitrary HS with 100% success probability. To understand the severity of the Eclipse attack problems on Tor HSs, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of HSs at any time. Finally, we discuss countermeasures and future works.

Tor hidden Services are used to provide anonymity service to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor hidden services use decentralized architecture making it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor hidden services that allow an adversary with an extremely low cost to block arbitrary Tor hidden services. We found that the dominant cost of this attack is IP address resources. The experimental results show that we can eclipse an arbitrary hidden service with 100% success probability with only 6 IP addresses. To understand the severity of the Eclipse attack problems on Tor's hidden services, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of hidden services at any time.

I2P is a widely used low-latency anonymous network that provides privacy to service providers, such as anonymous web services called eepSites. The large-scale discovery of eepSites allows us to grasp their size, content and popularity. In this paper, three approaches were proposed to discover eepSites: (1) running floodfill routers, (2) gathering hosts.txt files actively and (3) crawling popular portal eepSites. In our nineteen-day real-world experiments, the combination of the three methods in total discovered 1861 online eepSites covering over 80% of all eepSites in I2P network. And the coupon collector's problem was used for theoretical analysis, showing that eepSites discovery based on running floodfill routers is straightforward and efficient with low cost. Besides, the popularity and availability of eepSites were estimated and analyzed.

With increasing concern for erosion of privacy, privacy preserving and censorship-resistance techniques are becoming more and more important. Anonymous communication techniques offer an important method defending against Internet surveillance, but these techniques don't conceal themselves when used. In this paper, we propose StegoP2P, an unobservable communication system with Internet users in overlay network that relies on Innocent users' oblivious data downloading, StegoP2P works by deploying a end-to-middle proxies, which inspect special steganography flows from StegoP2P users to innocent-looking destinations and mirror them to the true destination requested by oblivious P2P users. The hidden communication is indistinguishable from normal network communications to any adversaries without a private key, hence, making the StegoP2P clients unobservable. We have developed a proof-of-concept application based on Vuze and conducted evaluations through experiments.

Tor is a worldwide publicly deployed low-latency anonymity system. In order to prevent observers from telling where the data came from and where it's going, data packets on the Tor network take a pathway through several intermediate relays. However, nodes selection to build such a pathway is oblivious to Internet routing, so anonymity guarantees can break down in cases where an attacker can correlate traffic across the entry- and exit-segments of a Tor circuit. Although many works have been done to avoid this kind of collusion attack, recent researches [18] indicated that some Internet exchanges (IXes) locating at the entry- and exit-transmission paths in Tor network (that are the paths from the client to the chosen entry node and from the chosen exit node to the destination) are still possible to perform a correlation attack. However, few works have been done to suggest and verify modifications to Tor's path selection algorithm that would help clients avoid an IX-level observer. In this paper, we first, based on the entry-exit pairs chosen by Tor's path selection algorithm, demonstrated that the probability of a single IX observing both ends of an anonymous Tor connection is greater than previously thought. And then, we proposed and evaluated the effectiveness of a simple IX-awareness path selection algorithm that help to resist IX-level attackers.

With the worldwide increasing of Internet censorship, censorship-resistance technology has attracted more and more attentions, some famous systems, such as Tor and JAP, have been deployed to provide public service for censorship-resistance. However, these systems all rely on dedicated infrastructure and entry points for service accessibility. The network infrastructure and entry points may become the target of censorship attack. In this paper, a UGC-based method is proposed (called user-generated content based covert communication, UGC3) for covert communication in a friends-to-friends (F2F) manner. It uses existing infrastructures (i.e., UGC sites ) to form a fully distributed overlay network. An efficient resource discovery algorithm is proposed to negotiate the rendezvous point. Analysis shows that this method is able to circumvent internet censorship with user repudiation and fault tolerance.