By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a cornerstone of the modern autonomous agent ecosystem. However, it creates novel attack surfaces due to untrusted external tools. While prior work has focused on attacks injected through external tool outputs, we investigate a more fundamental vulnerability: Tool Poisoning, where malicious instructions are embedded within a tool's metadata at the registration stage. To date, this threat has been primarily demonstrated through isolated cases, lacking a systematic, large-scale evaluation. We introduce MCPTox, the first benchmark to systematically evaluate agent robustness against Tool Poisoning in realistic MCP settings. MCPTox is constructed upon 45 live, real-world MCP servers and 353 authentic tools. To achieve this, we design three distinct attack templates to generate a comprehensive suite of 1348 malicious test cases by few-shot learning, covering 10 categories of potential risks. Our evaluation on 20 prominent LLM agents setting reveals a widespread vulnerability to Tool Poisoning, with GPT-o1-mini, achieving an attack success rate of 72.8%. We find that more capable models are often more susceptible, as the attack exploits their superior instruction-following abilities. Finally, the failure case analysis reveals that agents rarely refuse these attacks, with the highest refused rate (Claude-3.7-Sonnet) less than 3%, demonstrating that existing safety alignment is ineffective against malicious actions that use legitimate tools for unauthorized operation. Our findings create a crucial empirical baseline for understanding and mitigating this widespread threat, and we release MCPTox for the development of verifiably safer AI agents.

Jiecong Wang, Haoran Li, Hao Peng, Ziqian Zeng, Zihao Wang, Haohua Du, Zhengtao Yu. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

LLM-powered agents are evolving from passive recommenders into autonomous executors, leveraging tools via the Model Context Protocol (MCP) for web automation. However, this paradigm introduces a new vulnerability: tool poisoning attacks that manipulate the MCP context can corrupt an agent's reasoning. Existing methods focus on anomaly detection and lack autonomous correction mechanisms, hindering their real-world deployment.

The rapid development of the automotive industry and the Internet of Vehicles (IoV) has led to an exponential growth of distributed vehicular data, driving the need for secure and efficient collaborative machine learning solutions. However, existing distributed collaborative machine learning (DCML) approaches, such as federated learning and split learning, face significant challenges in IoV scenarios, including limited training efficiency, centralized aggregation vulnerabilities, and constrained privacy and model protection. To address these issues, we propose a blockchain-based split federated learning (BSFL) scheme for IoV applications. BSFL non-trivially combines federated learning and split learning to enable vehicles with low computational power to participate in parallel training, improving both model accuracy and training efficiency. By utilizing blockchain as a decentralized infrastructure, BSFL eliminates the risks of single points of failure and ensures model consistency through Byzantine fault-tolerant consensus. Furthermore, we design a noise addition mechanism based on differential privacy to safeguard client data privacy and model security. Formal security analysis and extensive experiments demonstrate that BSFL achieves enhanced privacy, security, and training performance. Comparing to related DCML schemes, BSFL reduces computational overhead by up to 88.84% and client training time by up to 29.49% while maintaining comparable accuracy. When training on ResNet-50 based on CIFAR10, BSFL achieved an accuracy of 93.15%. And the verification process for each model’s training results on the blockchain requires 1.49 ms.

The integration of blockchain technology with the sixth generation (6G) networks offers a promising approach to enhance the reliability and trustworthiness of industrial Internet of Things (IIoT) systems. Since IIoT devices typically lack the capability to directly participate in blockchain consensus, drone networks offer a viable alternative by providing dynamic coverage and reducing dependence on fixed infrastructure such as centralized servers. Sharding is an effective method to improve the scalability of blockchain systems, yet existing sharding schemes overlook the complexity and dynamic nature of drone network topologies. These networks frequently experience changes due to drone mobility, task variations, and energy constraints, all of which can disrupt consensus communications. To address these challenges, we propose a time-varying graph-based blockchain sharding scheme (BSTVG) tailored for large-scale drone blockchain networks. The time-varying graph-based model captures the temporal dynamics of drone communications. We adopt an improved K-Means++ clustering algorithm that incorporates communication conditions to adapt network sharding. Additionally, we develop mechanisms for intra-shard consensus and cross-shard transaction processing. To accommodate node joins, exits, and significant topological changes, we introduce a slot–epoch coupling mechanism that dynamically adjusts the epoch length. We analyze the security of the proposed scheme and validate its performance through simulations. Experimental results demonstrate that our scheme not only enhances the throughput but also reduces energy consumption of the drone blockchain network.

Automatic Dependent Surveillance–Broadcast (ADS-B) is widely deployed in both civil and unmanned aviation networks, yet its plaintext broadcast design leaves it vulnerable to eavesdropping, spoofing, and message forgery. Existing cryptographic solutions incur excessive overhead, depend on complex key infrastructures, and fail to accommodate the broadcast nature of ADS-B, making them unsuitable for real-time IoT aviation scenarios. In this paper, we propose ADSB-IBBE, the first lightweight and scalable security scheme tailored for confidential ADS-B broadcast communication in IoT-enabled aerial networks. ADSB-IBBE integrates a novel Identity-based Broadcast Encryption (IBBE) construction to enable efficient key distribution, together with a purpose-built, format-preserving stream cipher that secures critical ADS-B fields without extending the message size. It further incorporates a customized sharding consortium blockchain for decentralized identity management and rapid key revocation, while a header compression mechanism reduces transmission overhead. Security analysis confirms Indistinguishability against Selective-Identity Chosen Ciphertext Attacks (IND-sID-CCA) security under the Random Oracle Model (ROM). Experiments show over 80% lower computational cost and 90% reduced communication overhead compared to the most demanding baseline, with increasing advantages as the number of receivers grows, achieving the lowest overhead of 510bit header and 80bit ciphertext. These results demonstrate the suitability of our scheme for secure and efficient ADS-B communication in next-generation IoT-enabled air traffic management (ATM) systems.

Network attacks on the Internet of Vehicles (IoV) can lead to catastrophic consequences such as traffic congestion, incorrect routing, and even accidents. Existing rule-based countermeasures are effective only in specific scenarios, while machine learning-based methods suffer from suboptimal performance due to data quality issues. Furthermore, the isolation between in-vehicle networks (IVN) and external vehicle networks (EVN) prevents independent intrusion detection systems (IDS) from detecting continuous attack behaviors. To address these issues, we propose a mechanism that characterizes attack behaviors solely based on network connection information. This mechanism downplays the specifics of the traffic itself, allowing for the integration of IVN and EVN through structure, thus breaking the internal-external boundary and providing relatively stable logical structure information. This approach also offers opportunities to address the scarcity of labeled data. Based on this characterization mechanism, we develop an intrusion detection system – One$^{2}$, utilizing a multi-attribute heterogeneous graph transformer to achieve accurate multi-classification of various types of attacks. To assess the compatibility of the proposed IDS for IVN and EVN, extensive experiments were conducted using six real-world datasets that accurately depict IVN and EVN. The results show that One$^{2}$improves average accuracy by 7.14% and F1 score by 6.97% compared to state-of-the-art methods. The source code of this work is available at:https://github.com/LouHerGetUp/One2

Unmanned aerial vehicles (UAVs) have been extensively employed in the low-altitude intelligent network (LAIN) on data collection and transmission, enabling predictive maintenance, enhanced safety, and improved operational efficiency. However, the openness of wireless communication networks makes UAVs vulnerable to numerous security threats. To secure the critical transmitted data, many authenticated key agreement (AKA) schemes have been developed. Nevertheless, most existing AKA schemes fail to efficiently and securely authenticate communications between a single user and multiple UAVs in IIoT environments. To this end, we propose an extensible multi-party AKA scheme for LAINs. Specifically, we employ the physical unclonable functions and the Chinese remainder theorem to facilitate efficient authentication and data aggregation. Furthermore, by leveraging the additive homomorphic cryptography and blockchain, our scheme ensures privacy even in the presence of semi-trusted mobile operators. Formal security analyses and performance evaluations indicate that the proposed scheme meets the security requirements for LAINs while maintaining lightweight and extensible energy consumption.

With the widespread application of machine learning-based graph classification models in fields such as biology and economics, there has been a growing number of attacks aimed at perturbing classification results. Although current defense methods, such as randomized smoothing, have achieved some success, their practical applicability remains limited due to the need to modify classification models to ensure accuracy.In this paper, we propose a novel defense method—GRACED, which provides theoretical guarantees for the accuracy and robustness of graph classification without requiring knowledge of the attacker’s capabilities or the classification model. The key idea behind our method is to leverage the denoising ability of feature diffusion models for adversarial data purification. We then demonstrate that this randomized purification approach can ensure certified robustness under specific attack budgets. Extensive experiments confirm our theoretical findings and show that graph classifiers using GRACED significantly outperform state-of-the-art classifiers. For instance, the accuracy on MUTAG improved by 11%, and the best results on IMDB showed a 14% increase.

Environmental sensing is an important research topic in the integrated sensing and communication (ISAC) system. Current works often focus on static environments, such as buildings and terrains. However, dynamic factors like rainfall can cause serious interference to wireless signals. In this paper, we propose a system called RainfalLTE that utilizes the downlink signal of LTE base stations for device-independent rain sensing. In particular, it is fully compatible with current communication modes and does not require any additional hardware. We evaluate it with LTE data and rainfall information provided by a weather radar in Badaling Town, Beijing The results show that for 10 classes of rainfall, RainfalLTE achieves over 97 % identification accuracy. Our case study shows that the assistance of rainfall information can bring more than 40 % energy saving, which provides new opportunities for the design and optimization of ISAC systems.

Traffic data imputation is fundamentally important to support various applications in intelligent transportation systems such as traffic flow prediction. However, existing time-to-space sequential methods often fail to effectively extract features in block-wise missing data scenarios. Meanwhile, the static graph structure for spatial feature propagation significantly constrains the model's flexibility in handling the distribution shift issue for the nonstationary traffic data. To address these issues, this paper proposes a Spatio-Temporal Attention Mixture of experts network named STAMImputer for traffic data imputation. Specifically, we introduce a Mixture of Experts (MoE) framework to capture latent spatio-temporal features and their influence weights, effectively imputing block missing. A novel Low-rank guided Sampling Graph ATtention (LrSGAT) mechanism is designed to dynamically balance the local and global correlations across road networks. The sampled attention vectors are utilized to generate dynamic graphs that capture real-time spatial correlations. Extensive experiments are conducted on four traffic datasets for evaluation. The result shows STAMImputer achieves significantly performance improvement compared with existing SOTA approaches. Our codes are available at https://github.com/RingBDStack/STAMImupter.

Given the increasing number of on-demand delivery, people progressively realize that accurate indoor localization of couriers becomes vital for improving the quality of services. However, existing wireless indoor localization systems suffer from deployment difficulty caused by model migration or extra infrastructure needed, and traditional neural networks fail to get good performance with poor quality data and labels. In this work, we overcome the fundamental challenges in pitiful data to achieve a low-cost indoor localization system using large-scale poor-quality crowdsourcing WiFi data - WiLoc. WiLoc constructs WiFi data into a hypergraph and acquires the topological relationships among APs based on a light-weight graph convolutional network. Then, it utilizes a modified transformer structure to learn the latent global-aware features according to the data quality and task demand. Finally, we implement the prototype of WiLoc in the real on-demand delivery scenario with merchant-level accuracy and evaluate its performance based on real datasets from couriers. Extensive experiments demonstrate that WiLoc achieves an average F1 score of 85.03 % across various shopping malls, outperforming the baseline methods.

In online communities, trolling disrupts constructive discussion, fuels conflicts, and even triggers offline violence. While many defense techniques assume trolling arises from endogenous user behavior, our research unveils a different dimension: attackers control a group of accounts through hacking or payoffs, and intentionally sow discord by posting specifically designed statements. This attack is considered as a hijacking-based troll attack. Based on the Fridkin-Johnson opinion dynamics model, we formalize how such attacks propagate and accordingly propose Sedative, a real-time defense framework grounded in the concept of attraction basins in complex systems. Sedative identifies and protects structurally and dynamically critical nodes that constitute the backbone of the stable attraction basin to constrain perturbation spread under limited defense budgets. By focusing on localized, real-time influence rather than global computation, Sedative achieves high scalability and responsiveness. Experiments on real and synthetic networks show that Sedative suppresses up to 98 % of attack-induced conflict, significantly outperforming the baselines.

Screen-camera communication enables the seamless integration of encoded auxiliary information from the digital world into the physical domain—allowing users to obtain detailed information about an object of interest, such as a poster, simply by capturing a photo with a smartphone. Traditional screencamera communication methods, such as barcodes, occupy visual space and degrade aesthetics. While inter-frame encoding methods address these limitations, they are restricted to video streams or active screen displays. To enable content-preserving intraframe screen-camera communication, we propose InvisiCode, a noise-aware method for imperceptible, robust, and high-capacity encoding. We first quantitatively analyze screen-camera noise and identify predictable patterns in mid-high frequency Discrete Cosine Transform (DCT) coefficients, enabling mathematically bounded, noise-aware encoding. Based on this insight, we design an adaptive encoding algorithm that distributes data across multiple coefficients, balancing imperceptibility and resilience to noise. To ensure accurate decoding, we enhance$\mathrm{U}^{2}$-Net with Edge-Constraint Loss to improve boundary detection and precisely locate the encoded region in captured images. Experimental results demonstrate that InvisiCode is reliable and adaptable across various screen and camera configurations, including smartphones, tablets, laptops, and desktop monitors. It achieves a throughput of 784 bits per frame with a Bit Error Rate (BER) of less than 0.05, significantly outperforming previous methods. User studies confirm that the system introduces imperceptible distortion. Our code and demo are available at https://github.com/haikuoY/InvisiCode.

Machine learning (ML) enhanced unmanned aerial vehicle (UAV) networks are envisioned to facilitate extensive applications in next-generation wireless networks. Due to the privacy concern and communication overhead in cloud-centric ML, federated reinforcement learning (FRL) enables UAVs to collaboratively train a policy model without disclosing raw observation data. However, the model aggregator in centralized FRL architecture poses various potential threats such as a single point of failure and is inappropriate to distributed networks with unreliable links and nodes. In this paper, we propose AirFRL, a topology-aware decentralized federated reinforcement learning framework for UAV-enabled networks. In AirFRL, we consider the topology dynamics influenced by nodes' mobility and communication quality and its impact on AirFRL. To accelerate training process and guarantee the model performance, we also incorporate the model compression to lighten the local model and introduce the consensus distance and data correlation to reflect the discrepancy between local models and local data. Furthermore, we propose an efficient algorithm to decide the optimal neighbour node selection and model compression ratio. A case study and numerical results demonstrate that AirFRL can achieve linear training speedup and guarantee the learning performance for UAV-enabled networks.

In the context of rapid advancements in intelligent transportation technology, secure and efficient cross-domain data sharing imposes higher demands on the reliability and real-time responsiveness of transportation systems. However, the current architectures have limitations such as a lack of data traceability, coarse-grained access control, and high computational complexity, making them inadequate to meet the highly dynamic requirements of vehicular networks. In this paper, we propose Decentralized Secure Vehicular Data Collaboration Paradigm (DSVDCP) – a Vehicular Fog-Cloud cross-domain data sharing paradigm to address above challenges. The DSVDCP combines blockchain with Vehicular-Fog-Cloud Cooperative Computing to ensure the confidentiality and non-deniability in cross-domain data sharing. Furthermore, to enhance the granularity of data access control, we designed an attribute-based encryption scheme, VFC-CPABE, specifically for DSVDCP. This scheme supports multiple authorization authorities, access policy hiding, attribute revocation, and outsourced encryption and decryption, achieving fine-grained access control for cross-domain data. Based on the q-parallel BDHE assumption and detailed parameter selection analysis, we rigorously prove the IND-CPA security of the VFC-CPABE scheme in the standard model. We realized the prototype of DSVDCP, the experimental results show that, while maintaining comparable user-side decryption overhead to the current optimal schemes, VFC-CPABE reduces encryption computation overhead by more than 50% for the same number of attributes, significantly reducing the computational burden on the user side.

In latency-sensitive file caching systems such as Content Delivery Networks (CDNs) and Mobile Edge Computing (MEC), the latency of fetching a missing file to the local cache can be significant. Recent studies have revealed that successive requests for the same missing file before the fetching process completes could still suffer latency (so-called delayed hits). Motivated by the practical scenarios, we study the online general file caching problem with delayed hits and bypassing,i.e., a request may be bypassed and processed directly at the remote data center. The objective is to minimize the total request latency. We present a general reduction that turns a traditional file caching algorithm into one that can handle delayed hits. Based on this reduction, we propose an efficient online file caching algorithm, calledCaLa, with an asymptotically tight competitive ratio as$O(Z \log K)$, whereZis the maximum fetching latency of any file andKis the cache size. Extensive simulations on the production data trace from Google and the Yahoo benchmark illustrate thatCaLacan reduce the latency by up to 8.48% compared with the state-of-the-art schemes dealing with delayed hits without bypassing, and this improvement increases to 26.00% if bypassing is allowed. Furthermore, by upgrading the method for estimating files’ weights inCaLa, we proposeCaLa+, which further reduces the total latency by more than 5%.

Intelligent voice systems are widely utilized to control smart home applications, which raises significant privacy and security concerns. Recent studies have revealed their vulnerability to adversarial attacks, replay attacks, and so on. However, these attacks rely on the victim’s voice data. In our work, we investigate a stealthy and command-independent attack that does not necessitate collecting victims’ voices. Our proposed attack, IUAC, misleads the voice system to go against the victim’s will, regardless of the commands delivered. Our core concept is to train highly robust attack commands through the construction of diverse data, rendering the user’s commands negligible. To achieve stealthy attacks, we leverage a high-frequency carrier to construct an inaudible universal adversarial command. Extensive experiments conducted with real-world datasets demonstrate that our attack system attains an average attack success rate of 96% while resisting environmental interference. Moreover, our attack success rate against real-world voice systems is 4.52× higher than the state-of-the-art. Finally, we propose an effective defense mechanism and provide experimental tests to validate its efficacy.

In response to the escalating prevalence of inference attacks on network traffic, traffic shaping emerges as a highly effective strategy to curb the leakage of user privacy information. Although many traffic shaping mechanisms have been proposed, their privacy-preserving performance has mostly been evaluated empirically or by focusing solely on inter-event traffic shaping methods, thereby neglecting intra-event information. In this work, we develop a general framework considering intra-event characteristics for quantifying privacy leakage. The proposed evaluation framework provides quantitative assessments of privacy risks and can guide the design and improvement of traffic-shaping mechanisms. Our theoretical results identify the limitation of existing approaches, namely, the absence of a flexible trade-off between privacy-preserving effectiveness and cost. This trade-off is critical for IoT applications, as devices are highly heterogeneous in terms of resources (i.e., bandwidth) and need to meet service-level objectives (e.g., latency). To achieve this design goal, we model the trade-off problem as multi-armed bandits and propose an online traffic-shaping algorithm named DPShaping. DPShaping has a proven privacy-preserving guarantee and supports flexible trade-offs between effectiveness and communication cost. We compare our approach with three representative algorithms. Experimental results show that compared with state-of-the-art schemes, DPShaping achieves lower attack accuracy (only 16.8%) and reduces bandwidth and delay.

The significance of intelligent sensing systems is growing in the realm of smart services. These systems extract relevant signal features and generate informative representations for particular tasks. However, building the feature extraction component for such systems requires extensive domain-specific expertise or data. The exceptionally rapid development of foundation models is likely to usher in newfound abilities in such intelligent sensing. We propose a new scheme for sensing model, which we refer to as semi-generalist sensing model (SGSM). SGSM is able to semiautomatically solve various tasks using relatively less task-specific labeled data compared to traditional systems. Built through the analysis of the common theoretical model, SGSM can depict different modalities, such as the acoustic and Wi-Fi signal. Experimental results on such two heterogeneous sensors illustrate that SGSM functions across a wide range of scenarios, thereby establishing its broad applicability. In some cases, SGSM even achieves better performance than sensor-specific specialized solutions. Wi-Fi evaluations indicate a 20% accuracy improvement when applying SGSM to an existing sensing model.

Smart-devices' grip-state has shown great potential to enable various intelligent applications, including virtual keyboard and automatic UI adaption. However, smartphones nowadays often lack the capability to detect the grip-state, resulting in a poor experience of human-computer interaction. To implement an effective and efficient grip-state detection, we need to tackle a number of technical challenges such as effective features extraction and fusion from multimodal data, nonalignment of different modal data, and limited labeled data availability. In this work, to address these challenges, we design a two-stage grip-state detecting system, named WowSense, for high-accuracy, real-time detection of phone's grip-states using IMU (Inertial Measurement Unit) and CS (Capacitivc Screen) data. Our system WowSense consists of the multimodal alignment stage and the grip-state classification stage. In the first stage, we employ a novel augmentation method to capture subtle features from IMU and CS data. Additionally, we utilize contrastive learning to extract consistent information across these two modalities using a large amount of unlabeled data. In the second stage, we design an attention-based classifier to capture complementary information using only a small amount of labeled data. We implement our system in OpenHarmony and our extensive experimental results demonstrate the superiority of our system, which achieves 95 % accuracy with only 40 % of the data labeled on a self-collected dataset and 92.5 % accuracy with a latency of only around 10ms when running in real-time on a phone,

Accurate and quick relative-distance measurement is crucial for supporting various intelligent transparent services, such as multi-device collaboration, screen rotation, and multi-device mirroring. Unfortunately, current methods often rely on single-modality sensing, resulting in various limitations: BLE-based and WiFi-based methods suffer from coarse-grained estimation, and ultrasound-based approaches suffer from limited sensing range. In this work, we aim at designing a distance-measurement system that enjoys long range, high accuracy, and small delay. Our designed system, named BAIR, relies on low-energy Bluetooth (BLE), acoustic sensors, and inertial measurement units (IMU) equipped on commercial smartphones for fine-grained and real-time relative distance estimation. BAIR effectively aligns multiple sensory signals with different sampling rates via the improved Kalman filter technology. To mitigate IMU's integration errors, BAIR calculates the average velocity over a preceding period and uses this, alongside accumulated velocity data from the IMU, significantly improving distance prediction accuracy. We implemented our BAIR system on smartphones and conducted extensive experiments to evaluate its performance. Specifically, in static scenarios, BAIR achieves a mean average error (MAE) of 11 cm. In moving scenarios, the cumulative distribution function (CDF) values for 95%, 80%, and 50% are 31 cm, 13 cm, and 8 cm, respectively. The memory footprint of BAIR is 16.41 MB. We release a video demo on YouTube11https://youtu.be/7Fbmn4ALaI0.

Location awareness in mobile devices, particularly the detection of indoor and outdoor transitions, empowers devices to ascertain their own or user's position and offer pertinent intelligent services accordingly. In this paper, we present InOut, a robust and realistic indoor-outdoor detection system characterized by high precision, low latency, and cross-device transferability. Regarding effectiveness, considering that a singular sensor signal is inadequate in providing comprehensive environmental information for detection, we employ a multimodal fusion approach. Concerning efficiency, we optimize the model by pruning non-essential features through the calculation of Shapley values for importance assessment. Furthermore, given the heterogeneity of data from different devices, we implement an unsupervised domain adaptation method that enables effective model transfer across devices with limited unlabeled target domain data. Experimental results demonstrate that our InOut system achieves over 96% accuracy on the test dataset, with detection latency consistently maintained to be within 3.1 seconds (including 3 seconds of interface latency and less than 0.1 seconds of inference latency). Moreover, utilizing unlabeled data from a disparate mobile phone model, amounting to one-sixth the size of the original dataset, we enhance the model's accuracy from 83% before transfer to over 91%.

Most existing voice-based user authentication systems mainly rely on microphones to capture the unique vocal characteristics of an individual, which are vulnerable to various acoustic attacks and may suffer high-security risks. In this work, we presentAccuth$^+$+, a novel authentication system on the wrist-worn device that takes advantage of a low-cost accelerometer to verify the user's identity and resist spoofing acoustic attacks.Accuth$^+$+captures unique sound vibrations during the human pronunciation process and extracts multi-level features to verify the user's identity. Specifically, we analyze and model the differences between the physical sound field of human beings and loudspeakers, and extract a novel sound-field-level liveness feature to defend against spoofing attacks.Accuth$^+$+is an effective complement to existing wearable authentication approaches as it only leverages a ubiquitous, low-cost, and small-size accelerometer. In real-world experiments.Accuth$^+$+achieves over 92.85% averaged identification accuracy among 15 human participants and an averaged equal error rate (EER) of 1.91% for spoofing attack detection.

As earable devices have become indispensable smart devices in people's lives, earable-based user authentication has gradually attracted widespread attention. In our work, we explore novel in-ear breathing biometrics and design an earable-based authentication approach, namedBreathSign, which takes advantage of inward-facing microphones on commercial earphones to capture in-ear breathing sounds for passive authentication. To expand the differences among individuals, we model the process of breathing sound generation, transmission, and reception. Based on that, we derive hard-to-forge physical-level features from in-ear breathing sounds as biometrics. Furthermore, to eliminate the impact of breathing behavioral patterns (e.g., duration and intensity), we design a triple network model to extract breathing behavior-independent features and design an online user template update mechanism for long-term authentication. Extensive experiments with 35 healthy subjects have been conducted to evaluate the performance ofBreathSign. The results show that our system achieves the average authentication accuracy of 93.15%, 98.06%, and 99.74% via one, five, and nine breathing cycles, respectively. Regarding the resistance of spoofing attacks,BreathSigncould achieve an average EER of approximately 3.5%. Compared with other behavior-based authentication schemes,BreathSigndoes not require users to perform complex movements or postures but only effortless breathing for authentication and can be easily implemented on commercial earphones with high usability and enhanced security.

User authentication is essential for threat defense and data protection. Existed authentication systems have some known limitations, such as spoofing attacks, privacy leakage, and user-unfriendliness. In this paper, we propose BackLip, a novel anti-spoofing authentication system based on lip reading. We employ Wi-Fi backscatter-based technology to recognize users lip reading due to its various advantages, e.g. privacy protection, low power consumption, and low cost. Our system is touch-free and passphrase-independent, making it user-friendly, especially for the elderly and disabled. We first filter out irrelevant interference and enhance the signal-to-noise ratio of lip-reading signals by modulating the backscatter tags and constructing a series of suitable filters. Then, we study the energy distribution and steady-state characteristics of the backscattered signal caused by lip-reading movement at different frequencies to extract passphrase-independen lip-reading fingerprints. We build a theoretical model to analyze and prove the feasibility of our method and design an adaptive correction method to resist the interference caused by distance and angle changes. Additionally, we propose an adaptive segmentation algorithm to label lip-reading motions automatically. Extensive experiments demonstrate that BackLip has an average accuracy of 92.1% and is improved to 96.5% when users use the same passphrases.

Existing intelligent piano learning systems mainly assist the player by camera, which generally only consider the fingering that can only reflect the performance problem from a limited perspective. Thus, we propose PianoWatch, a multi-dimensional assistance system based on wrist wearable devices. PianoWatch extracts more accurate patterns by analyzing data from microphone, camera, accelerometers and gyroscopes. Then it gives corresponding playing advices, in addition to pitch, including fingering, depth and even mood, through an evaluation model. We implement the prototype of PianoWatch and evaluate it by 20 volunteers. Extensive experiments show it can achieve 93% F1-Score on the playing pattern extraction, and more than 95% of users would like to try it to assist their piano learning.

Mechanical vibration monitoring plays a critical role in today's industrial Internet of Things (IoT) applications. Existing invasive solutions usually directly attach sensors to the target, which may affect the operations of delicate devices. Non-invasive video-based approaches incur poor performance in low light conditions, and laser-based ones have difficulties to monitor multiple objects simultaneously. In this work, we proposeRF-Ear$^+$+, a contactless vibration sensing system using Commercial off-the-shelf (COTS) RFID.RF-Ear$^+$+could accurately monitor the mechanical vibrations of multiple devices using a single tag: it can clearly tell which object is vibrating at what frequency without attaching tags on any device.RF-Ear$^+$+can measure the vibration with a frequency up to 987 Hz at a mean error rate of$0.4\%$. We further employ each device's unique vibration fingerprint to identify and differentiate devices of exactly the same model. What's more,RF-Ear$^+$+can detect the rotating machinery faults based on the constructed spectrogram, which achieves$98\%$accuracy on 6 types of states. To improve the computation efficiency, we optimize the input of model in both time and frequency domains, and thus enable deployment on low-cost edge devices successfully. Comprehensive experiments conducted in lab and wild demonstrate the effectiveness of our system.

Device-level security has become a major concern in smart home systems. Detecting problems in smart home sytems strives to increase accuracy in near real time without hampering the regular tasks of the smart home. The current state of the art in detecting anomalies in smart home devices is mainly focused on the app level, which provides a basic level of security by assuming that the devices are functioning correctly. However, this approach is insufficient for ensuring the overall security of the system, as it overlooks the possibility of anomalies occurring at the lower layers such as the devices. In this article, we propose a novel notion, correlated graph , and with the aid of that, we develop our system to detect misbehaving devices without modifying the existing system. Our correlated graphs explicitly represent the contextual correlations among smart devices with little knowledge about the system. We further propose a linkage path model and a sensitivity ranking method to assist in detecting the abnormalities. We implement a semi-automatic prototype of our approach, evaluate it in real-world settings, and demonstrate its efficiency, which achieves an accuracy of around 90% in near real time.

Most existing voice-based user authentication systems mainly rely on microphones to capture the unique vocal characteristics of an individual, which makes these systems vulnerable to various acoustic attacks and suffer high-security risks. In this work, we present Accuth, a novel authentication system that takes advantage of a low-cost accelerometer to verify the user's identity and resist spoofing acoustic attacks. Accuth captures unique sound vibrations during the human pronunciation process and extracts multi-level features to verify the user's identity. Specifically, we analyze and model the differences between the physical sound field of human beings and loudspeakers, and extract a novel sound-field-level liveness feature to defend against spoofing attacks. Accuth is an effective complement to existing authentication approaches as it only leverages a ubiquitous, low-cost, and small-size accelerometer. In real-world experiments, Accuth achieves over 90% identification accuracy among 15 human participants and an average equal error rate (EER) of 3.02% for spoofing attack detection.

This article proposes a novel 3-D nonstationary wideband vehicle-to-vehicle (V2V) geometry-based stochastic model (GBSM) with uniform planar antenna arrays (UPAs) for massive multiple-input–multiple-output (MIMO) wireless communication systems. In the proposed GBSM, a novel method, so-called birth–death (BD) process and seed algorithm-based selective cluster evolution, is developed to capture the space nonstationarity of V2V massive MIMO with UPA channels. The time nonstationarity is further mimicked by employing this novel method over the entire timeline. In addition, the proposed GBSM not only models the reflection of the ground, but also divides clusters into static clusters and dynamic clusters to sufficiently investigate the impact of vehicular traffic density (VTD) on channel statics. The channel parameters are properly calculated by 3-D vectors, resulting in the proposed GBSM with high accuracy and low complexity. Important statistical properties, such as the space-time correlation function (S-T CF), spatial cross-correlation function (CCF), temporal auto-correlation function (ACF), and Doppler power spectrum density (PSD) are derived and thoroughly investigated. Simulation results show that the space-time nonstationarity is successfully mimicked and the VTD has a significant impact on channel statistics. Finally, an excellent agreement is achieved between simulation results and measurements, validating the accuracy of the proposed GBSM.

Voice input users’ speech recordings are being collected by service providers and shared with third parties, who may abuse users’ voiceprints, identify them by voice, and learn their sensitive speech content. In this work, we designSpeech Sanitizerto perturb users’ speech recordings so that the sanitized speech can be safely shared with third parties. First, we desensitize speech content by identifying sensitive words, localizing them in the audio using DTW-based keyword spotting, and substituting them with safe words. Both common and personalized sensitive words are identified and replaced. Then, we anonymize users’ voiceprints with a carefully designed voice conversion mechanism that is resistant to de-anonymization attacks. Meanwhile, we try to preserve the utility of the sanitized speech, measured by the accuracy of speech recognition performed on it. We implement Speech Sanitizer and present extensive experimental results that validate the effectiveness and efficiency of our algorithms. It is demonstrated that we are able to reduce the chance of a user's voice being identified from 50 people by 83.7 percent while keeping the drop of speech recognition accuracy within 19.1 percent. We can also easily relax the privacy level to improve speech recognition accuracy.

Driven by a wide range of real-world applications, several ground-breaking RF-based motion-recognition systems were proposed to detect and/or recognize macro/micro human movements. These systems often suffer from various interferences caused by multiple-users moving simultaneously, resulting in extremely low recognition accuracy. Even if the repetitive motions are fairly well detectable through the wireless signals in theory, in reality they get blended into various other system noises during the motion. Moreover, irregular motion patterns among users will lead to expensive computation cost for motion recognition. To tackle these challenges, we propose a novel wireless sensing system, calledMotion-Fi$\ ^+$+, which marries battery-free wireless backscattering and device-free sensing in one clean sheet.Motion-Fi$\ ^+$+is an accurate, interference tolerable motion-recognition system, which counts repetitive motions without using scenario-dependent templates or profiles and enables multi-user performing certain motions simultaneously because of the relatively short transmission range of backscattered signals and dedicated signal separation method. We implement a backscattering wireless platform to validate our design in various scenarios for over 6 months when different persons, distances and orientations are incorporated. In our experiments, the periodicity in motions could be recognized without any learning or training process, and the accuracy of counting such motions can be achieved within 5 percent count error. With little efforts in learning the patterns, our method could achieve 95.2 percent motion-recognition accuracy for a variety of 7 typical motions. Moreover, by leveraging the periodicity of motions, the recognition accuracy could be further improved to nearly 100 percent with only three repetitions. Our experiments also show that the motions of multiple persons separating by around$ 2$meters cause little accuracy reduction in the counting process.

Privacy has become one of the major concerns in cloud video surveillance. Privacy protection of the surveillance videos strive to protect users' privacy information without hampering regular security tasks of the surveillance, meanwhile retains the system's high accuracy and efficiency. The current state of the art in protecting the video privacy is mainly realized through Privacy Region Protection, which only protects the privacy regions while keeps the non-privacy regions visually intact so that processing in the cloud is still feasible. However, the problem of determining the privacy regions has been ignored and not properly addressed. In this paper, we propose a novel notion - concept graph, and with the aid of that, we develop our system - PatronuS to determine the privacy regions subject to satisfying both privacy and security requirements. We further propose an event distilling model and a privacy inference model to assist in determining specific privacy regions. And we evaluate PatronuS in real-world settings and demonstrate its efficiency in privacy protection without degrading system's surveillance functionality.

Machine learning (ML) has shown its impressive performance in the modern world, and many corporations leverage the technique of machine learning to improve their service quality, e.g., Facebook's DeepFace. Machine learning models with a collection of private data being processed by a training algorithm are deemed to be increasingly confidential. Confidential models are typically trained in a centralized cloud server but publicly accessible. ML-as-a-service (MLaaS) system is one of running examples, where users are allowed to access trained models and are charged on a pay-per-query basis.

Deep Learning has shown promising performance in a variety of pattern recognition tasks owning to large quantities of training data and complex structures of neural networks. However conventional deep neural network (DNN) training involves centrally collecting and storing the training data, and then centrally training the neural network, which raises much privacy concerns for the data producers. In this paper, we study how to enable deep learning without disclosing individual data to the DNN trainer. We analyze the risks in conventional deep learning training, then propose a novel idea - Crowdlearning, which decentralizes the heavy- load training procedure and deploys the training into a crowd of computation-restricted mobile devices who generate the training data. Finally, we propose SliceNet, which ensures mobile devices can afford the computation cost and simultaneously minimize the total communication cost. The combination of Crowdlearning and SliceNet ensures the sensitive data generated by mobile devices never leave the devices, and the training procedure will hardly disclose any inferable contents. We numerically simulate our prototype of SliceNet which crowdlearns an accurate DNN for image classification, and demonstrate the high performance, acceptable calculation and communication cost, satisfiable privacy protection, and preferable convergence rate, on the benchmark DNN structure and dataset.

We are speeding toward a not-too-distant future when we can perform human-computer interaction using solely our voice. Speech recognition is the key technology that powers voice input, and it is usually outsourced to the cloud for the best performance. However, user privacy is at risk because voiceprints are directly exposed to the cloud, which gives rise to security issues such as spoof attacks on speaker authentication systems. Additionally, it may cause privacy issues as well, for instance, the speech content could be abused for user profiling. To address this unexplored problem, we propose to add an intermediary between users and the cloud, named VoiceMask, to anonymize speech data before sending it to the cloud for speech recognition. It aims to mitigate the security and privacy risks by concealing voiceprints from the cloud. VoiceMask is built upon voice conversion but is much more than that; it is resistant to two de-anonymization attacks and satisfies differential privacy. It performs anonymization in resource-limited mobile devices while still maintaining the usability of the cloud-based voice input service. We implement VoiceMask on Android and present extensive experimental results. The evaluation substantiates the efficacy of VoiceMask, e.g., it is able to reduce the chance of a user's voice being identified from 50 people by a mean of 84%, while reducing voice input accuracy no more than 14.2%.

Visible light communication (VLC) has been shown to have several advantages over traditional wireless communication. In this paper, we envision an LED-light-to-smartphone VLC protocol for delivering messages to a group of randomly arriving smartphone receivers. Our goal is to increase the throughput for large message delivery, as well as to reduce the delay of message broadcast. Key challenges for implementing such a VLC message broadcast protocol are: 1) the imperfect synchronization among receivers and the transmitter; 2) the receivers' arbitrary arrival times; and 3) the diversity of receivers' smartphones (e.g., location, capability, and frame-rates). In this paper, we propose a new modulation scheme and design link-layer protocols for improving the network data rate. We carefully design and implement our protocol, Martian, which allows smooth communication from the LED lights to a group of smartphone embedded cameras. Across several phone models, Martian can achieve data rate of about 1.6 kb/s even with NLOS -light. It also has a stable and small delay for broadcasting messages to the randomly arriving receivers.

Visible light communication (VLC) has been shown to have several advantages over traditional wireless communication. We envision a LED-to-smartphone VLC protocol for delivering messages to a group of unsynchronized mobile device receivers. We carefully design and implement our protocol, Martian, which allows smooth communication from the LED lights to a group of camera-enabled mobile devices. Across several phone models, Martian can achieve data rate of about 1.6kbps even with NLOS-light. Our intensive evaluations indicate that, the data rate reaches 4.2kbps on iPhone 6. This is a significant improvement compared with the 88bps data rate claimed by state-of-art design.

This paper presents a framework for privacy-preserving video delivery system to fulfill users' privacy demands. The proposed framework leverages the inference channels in sensitive behavior prediction and object tracking in a video surveillance system for the sequence privacy protection. For such a goal, we need to capture different pieces of evidence which are used to infer the identity. The temporal, spatial and context features are extracted from the surveillance video as the observations to perceive the privacy demands and their correlations. Taking advantage of quantifying various evidence and utility, we let users subscribe videos with a viewer-dependent pattern. We implement a prototype system for off-line and on-line requirements in two typical monitoring scenarios to construct extensive experiments. The evaluation results show that our system can efficiently satisfy users' privacy demands while saving over 25% more video information compared to traditional video privacy protection schemes.