Federated learning (FL) as a distributed machine learning paradigm can be applied to edge intelligence scenarios for collaborative machine learning model building. Unfortunately, existing privacy-preserving FL applied to this scenario still faces three challenges: data heterogeneity, model heterogeneity, and privacy heterogeneity. Despite numerous privacy-preserving FL techniques proposed, they still cannot effectively address these three challenges. To solve this problem, we propose HeteroFed, a heterogeneous privacy-preserving FL framework for edge intelligence. Our HeteroFed contains heterogeneous model construction, dynamic gradient clipping, adaptive noise addition, and deviation-aware model aggregation. Specifically, we first use the heterogeneous model construction mechanism to enable personalized model training for different smart devices. Then, we propose a dynamic gradient clipping mechanism to perform dynamically adjusted gradient clipping on models uploaded by smart devices to limit the magnitude of gradients. Finally, we propose an adaptive noise addition mechanism to customize differential privacy protection for smart device models based on their convergence status. Furthermore, to mitigate the influence of noise perturbations on model performance, we propose a deviation-aware model aggregation mechanism for accurate model aggregation. Theoretical analysis demonstrates that HeteroFed achieves heterogeneous differential privacy. Extensive experiments show that HeteroFed outperforms similar methods, improving global model accuracy by 18%, 15%, 13%, and 18% on the MNIST, Fashion-MNIST, CIFAR-10, and THUCNews datasets, respectively.

Recently, the research on fairness in recommendation systems has garnered widespread attention. Moreover, numerous fair recommendation models have been developed for scenarios with limited sensitive information, thereby alleviating the issue of missing sensitive information. However, the performance of these methods still tends to decline significantly when sensitive attributes are extremely scarce. In this paper, we propose FairCL, a novel fair recommendation framework designed to perform effectively under limited sensitive attribute information. FairCL features a contrastive learning-based sensitive attribute encoder that can be integrated with existing fair recommendation algorithms. By leveraging both collaborative information and item side information, we predict unknown sensitive attributes and apply contrastive learning for sensitive attribute modeling. Furthermore, we theoretically demonstrate how FairCL can be integrated with mutual information-based and adversarial learning-based fairness algorithms. Extensive experiments on three real-world datasets show that FairCL significantly enhances fairness, even when only a small portion of users' sensitive attributes are known. The code and data are at: https://anonymous.4open.science/r/CL-for-FairRec-000A/.

Pseudonym certificates play a crucial role in providing authorized access in vehicular networks with fine-grained privacy demands. However, the revocation of pseudonym certificates in large-scale, resource-constrained context has posed a significant challenge. The global revocation status is susceptible to disruption by localized anomalous events. Moreover, as the scale of revocation grows, the synchronization process becomes increasingly vulnerable to attacks and incurs high overhead. To decouple the global revocation status from local revocation events, we propose a spatial-temporal pseudonym revocation and verification framework that supports batch pseudonym revocation within resilient revocation cycles. Revoked pseudonyms within the event area are locally filtered, while other pseudonyms are characterized by maintaining a proof to attest their consistent and legitimate status. To improve the efficiency of revocation status updates and mitigate centralization risks, a distributed caching and proof update strategy assisted by edge nodes is presented. Extensive simulations based on real-world large-scale datasets demonstrate that PV-STR scheme significantly reduces the vulnerability window, communication overhead, and memory consumption compared to state-of-the-art approaches.

Direct Prompt Injection (DPI) attacks pose a critical security threat to Large Language Models (LLMs) due to their low barrier of execution and high potential damage.To address the impracticality of existing white-box/gray-box methods and the poor transferability of blackbox methods, we propose an activations-guided prompt injection attack framework.We first construct an Energy-based Model (EBM) using activations from a surrogate model to evaluate the quality of adversarial prompts.Guided by the trained EBM, we employ the tokenlevel Markov Chain Monte Carlo (MCMC) sampling to adaptively optimize adversarial prompts, thereby enabling gradient-free blackbox attacks.Experimental results demonstrate our superior cross-model transferability, achieving 49.6% attack success rate (ASR) across five mainstream LLMs and 34.6% improvement over human-crafted prompts, and maintaining 36.6%ASR on unseen task scenarios.Interpretability analysis reveals a correlation between activations and attack effectiveness, highlighting the critical role of semantic patterns in transferable vulnerability exploitation.

Network quantization, one of the most widely studied model compression methods, effectively quantizes a floating-point model to obtain a fixed-point one with negligible accuracy loss. Although great success was achieved in reducing the model size, it may exacerbate the unfairness in model accuracy across different groups of datasets. This paper considers two widely used algorithms: Post-Training Quantization (PTQ) and Quantization-Aware Training (QAT), with an attempt to understand how they cause this critical issue. Theoretical analysis with empirical verifications reveals two responsible factors, as well as how they influence a metric of fairness in depth. A comparison between PTQ and QAT is then made, explaining an observation that QAT behaves even worse than PTQ in fairness, although it often preserves a higher accuracy at lower bit-widths in quantization. Finally, the paper finds out that several simple data augmentation methods can be adopted to alleviate the disparate impacts of quantization, based on a further observation that class imbalance produces distinct values of the aforementioned factors among different attribute classes. We experiment on either imbalanced (UTK-Face and FER2013) or balanced (CIFAR-10 and MNIST) datasets using ResNet and VGG models for empirical evaluation.

We explore the potential of \emph{AI-enhanced combinatorial optimization theory}, taking online bipartite matching (OBM) as a case study. In the theoretical study of OBM, the \emph{hardness} corresponds to a performance \emph{upper bound} of a specific online algorithm or any possible online algorithms. Typically, these upper bounds derive from challenging instances meticulously designed by theoretical computer scientists. Zhang et al. (ICML 2024) recently provide an example demonstrating how reinforcement learning techniques enhance the hardness result of a specific OBM model. Their attempt is inspiring but preliminary. It is unclear whether their methods can be applied to other OBM problems with similar breakthroughs. This paper takes a further step by introducing DiMa, a unified and novel framework that aims at understanding the hardness of OBM problems based on denoising diffusion probabilistic models (DDPMs). DiMa models the process of generating hard instances as denoising steps, and optimizes them by a novel reinforcement learning algorithm, named \emph{shortcut policy gradient} (SPG). We first examine DiMa on the classic OBM problem by reproducing its known hardest input instance in literature. Further, we apply DiMa to two well-known variants of OBM, for which the exact hardness remains an open problem, and we successfully improve their theoretical state-of-the-art upper bounds.

Federated Learning (FL) enables collaborative model training while preserving data privacy, but it is highly vulnerable to backdoor attacks. Most existing defense methods in FL have limited effectiveness due to their neglect of the model's over-reliance on backdoor triggers, particularly as the proportion of malicious clients increases. In this paper, we propose FedBAP, a novel defense framework for mitigating backdoor attacks in FL by reducing the model's reliance on backdoor triggers. Specifically, first, we propose a perturbed trigger generation mechanism that creates perturbation triggers precisely matching backdoor triggers in location and size, ensuring strong influence on model outputs. Second, we utilize these perturbation triggers to generate benign adversarial perturbations that disrupt the model's dependence on backdoor triggers while forcing it to learn more robust decision boundaries. Finally, we design an adaptive scaling mechanism to dynamically adjust perturbation intensity, effectively balancing defense strength and model performance. The experimental results demonstrate that FedBAP reduces the attack success rates by 0.22%-5.34%, 0.48%-6.34%, and 97.22%-97.6% under three types of backdoor attacks, respectively. In particular, FedBAP demonstrates outstanding performance against novel backdoor attacks.

Ensuring privacy in e-health recommendation systems is a critical yet challenging task, particularly when high-quality recommendations require access to sensitive patient data. Existing approaches often rely on computationally expensive cryptographic techniques or restrict matching to binary outcomes, limiting both efficiency and recommendation accuracy. In this paper, we propose APER, a novel privacy-preserving recommendation scheme that achieves both accuracy and efficiency through the design of two core cryptographic protocols. Specifically, we construct a secure and efficient similarity computation protocol and a privacy-preserving truth discovery protocol by leveraging distributed multi-point function and replicated secret sharing techniques. These protocols enable fine-grained doctor-patient matching without exposing private health or feedback data. Security analysis proves that APER achieves rigorous privacy guarantees under semi-honest adversaries. Experimental results show that APER reduces computational overhead by up to 10× compared to recent methods, while delivering accurate and scalable recommendations.

Voice assistants, as crucial components of the Internet of Things (IoT), are vulnerable to voice spoofing attacks and pose great threats to the security of IoT. Passive liveness detection distinguishes between genuine and spoofing voices by analyzing the collected voice, eliminating the need for deploying additional sensors. This method plays a crucial role in detecting spoofing speeches and ensuring the security of the IoT. However, current passive liveness detection methods typically require users to adopt specific gestures. Meanwhile, these methods are often designed for specific attacks and cannot accommodate multivariate attacks. To address these challenges, this paper proposes an efficient and robust liveness feature called VoiceID, which utilizes the inherent vocal cord vibrations and voiced language to authenticate the collected voice. The VoiceID is defined as the set of maximum magnitude-peak frequency bins in the magnitude spectrum of each frame for voice. VoiceID can be combined with existing acoustic features to compensate for the granularity gap in extracting fine-grained features and distinguishing between genuine and spoofing voices. Furthermore, to leverage VoiceID, this paper proposes a solid fake voice liveness detection system named SFSys and elaborates on a series of acoustic features that can work with VoiceID. Extensive experiments on authoritative ASVspoof 2019 and ASVspoof 2021 datasets reveal that VoiceID reduces the equal error rate and the minimum tandem decision cost function of the existing acoustic features by at most 6.19% and 0.2479. Moreover, SFSys outperforms existing voice liveness detection schemes and exhibits robustness in various advanced spoofing attack environments.

Large language models (LLMs) have brought significant advancements to artificial intelligence, particularly in understanding and generating human language. However, concerns over management burden and data security have grown alongside their capabilities. To solve the problem, we design a blockchain‐based distributed LLM framework, where LLM works in the distributed mode and its outputs can be stored and verified on a blockchain to ensure integrity, transparency, and traceability. In addition, a multiparty signature‐based authentication mechanism is necessary to ensure stakeholder consensus before publication. To address these requirements, we propose a threshold elliptic curve digital signature algorithm that counters malicious adversaries in environments with three or more participants. Our approach relies on discrete logarithmic zero‐knowledge proofs and Feldman verifiable secret sharing, reducing complexity by forgoing multiplication triple protocols. When compared with some related schemes, this optimization speeds up both the key generation and signing phases with constant rounds while maintaining security against malicious adversaries.

Existing multitask outsourcing computations struggle to guarantee the fairness for participants and the correctness of the computation results. Some solutions use blockchain to address the fairness issue in outsourcing computations. However, blockchain suffers from poor data privacy due to its public and transparent nature, as well as the latency because of limited scalability. To effectively confront these problems, we propose the Libras: a fair, secure, verifiable and scalable outsourcing computation scheme based on blockchain. In Libras, tasks are divided into multiple sub-task blocks, coupled with a deposit mechanism that enforces fairness throughout the process. Libras integrates a commitment mechanism with on-chain and off-chain collaboration for security, where the computation results are securely stored off-chain while proofs of these results are immutably recorded on-chain. Moreover, it employs a Directed Acyclic Graph (DAG)-based ledger architecture to significantly expedite transaction confirmations and facilitate elastic scalability. Furthermore, we devise a batch verification algorithm to simultaneously verify the accuracy of all computation results. Theoretical analysis and experiments demonstrate that Libras is fair, secure, verifiable, and scalable. The comparison results indicate that the verification time is 1.2× that of FVP-EOC.

Since the hybrid beamforming (HBF) can approach the performance of fully-digital beamforming (FDBF) with much lower hardware complexity, we investigate the HBF design for beam-hopping (BH) low earth orbit (LEO) satellite communications (SatComs). Aiming at maximizing the sum-rate of totally illuminated beam positions during the whole BH period, we consider joint beamforming and illumination pattern (BIP) design subject to the HBF constraints and sum-rate requirements. To address the nonconvexity of the HBF constraints, we temporarily replace the HBF constraints with the FDBF constraints. Then a joint FDBF and illumination pattern design scheme is proposed using random search and fractional programming (FP) methods. Based on the designed illumination patterns, we optimize the digital beamformers with the constrained analog beamformers by utilizing the FP methods, where a sum-rate maximization HBF scheme is proposed. Simulation results show that the proposed schemes can achieve satisfactory sum-rate performance for BH LEO SatComs.

Nowadays, many edge computing service providers expect to leverage the computational power and data of edge nodes to improve their models without transmitting data. Federated learning facilitates collaborative training of global models among distributed edge nodes without sharing their training data. Unfortunately, existing privacy-preserving federated learning applied to this scenario still faces three challenges: 1) It typically employs complex cryptographic algorithms, which results in excessive training overhead; 2) It cannot guarantee Byzantine robustness while preserving data privacy; and 3) Edge nodes have limited computing power and may drop out frequently. As a result, the privacy-preserving federated learning cannot be effectively applied to edge computing scenarios. Therefore, we propose a lightweight and secure federated learning scheme LSFL, which combines the features of privacy-preserving and Byzantine-Robustness. Specifically, we design the Lightweight Two-Server Secure Aggregation protocol, which utilizes two servers to enable secure Byzantine robustness and model aggregation. This scheme protects data privacy and prevents Byzantine nodes from influencing model aggregation. We implement and evaluate LSFL in a LAN environment, and the experiment results show that LSFL meets fidelity, security, and efficiency design goals, and maintains model accuracy compared to the popular FedAvg scheme.

Internet of Vehicles (IoV) being a subdivided application of the Internet of Things, is considered as one of the most prominent and emerging technologies for model transportation systems. However, security and privacy remain two key requirements for IoV networks, as communications between vehicles and other Internet-connected things are generally carried out over public channels. Some of the most typical attack issues for the IoV networks include hardware tampering, unauthorized data access, message modification, tracking vehicle locations, etc. Although there have been a number of solutions (e.g., mutual authentication and key agreement protocols) proposed to ensure the secure communication for IoV, most of them still suffer from some vulnerabilities, such as linkability, server spoofing, and replay attacks, in violation of the security requirements of IoV. Hence, it remains challenging to design secure and efficient solutions. In this article, we first take a recently proposed authentication protocol as an example and analyze the weaknesses of it with simple mathematical analysis. We then propose an improved multiserver-based authentication and key agreement protocol for IoV (called SeMAV), which applies the password and smart card to hide the private keys. We also present both formal and informal security proofs to confirm the robustness against those commonly known attacks. The theoretical comparative summary and simulation results also show that SeMAV can achieve a good performance when compared with some other related protocols in the literature.

As the use of machine learning in the Internet-of-Medical Things (IoMT) settings increases, so do the data privacy concerns. Therefore, in this article, we propose an efficient privacy-preserving outsourced support vector machine scheme (EPoSVM), designed for IoMT deployment. To securely train the support vector machine (SVM), we design eight secure computation protocols to allow the cloud server to efficiently execute basic integer and floating-point computations. The proposed scheme protects training data privacy and guarantees the security of the trained SVM model. The security analysis proves that our proposed protocols and EPoSVM satisfy both security and privacy protection requirements. Findings from the performance evaluation using two real-world disease data sets also demonstrate the efficiency and effectiveness of EPoSVM in achieving the same classification accuracy as a general SVM.

Internet of Things (IoT)-enabled smart grids can achieve more reliable and high-frequency data collection and transmission compared with existing grids. However, this frequent data processing may consume a lot of bandwidth, and even put the user’s privacy at risk. Although many privacy-preserving data aggregation schemes have been proposed to solve the problem, they still suffer from some security weaknesses or performance deficiency, such as lack of satisfactory data confidentiality and resistance to malicious data mining attack. To address these issues, we propose a novel privacy-preserving data aggregation scheme (called PDAM) for IoT-enabled smart grids, which can support efficient data source authentication and integrity checking, secure dynamic user join and exit. Unlike existing schemes, the PDAM is resilient to the malicious data mining attack launched by internal or external attackers and can achieve perfect data confidentiality against not only a malicious aggregator but also a curious control center for an authorized user. The detailed security and performance analysis show that our proposed PDAM can satisfy several well-known security properties and desirable efficiency for a smart grid system. Moreover, the comparative studies and experiments demonstrate that the PDAM is superior to other recently proposed works in terms of both security and performance.

Achieving low latency and providing real-time services are two of several key challenges in conventional cloud-based smart grid systems, and hence, there has been an increasing trend of moving to edge computing. While there have been a number of cryptographic protocols designed to facilitate secure communications in smart grid systems, existing protocols generally do not support conditional anonymity and flexible key management. Thus, in this article, we introduce a blockchain-based mutual authentication and key agreement protocol for edge-computing-based smart grid systems. Specifically, leveraging blockchain, the protocol can support efficient conditional anonymity and key management, without the need for other complex cryptographic primitives. The security analysis shows that the protocol achieves reasonable security assurance, and the comparative summary for security and efficiency also suggests the potential of the proposed protocol in a smart grid deployment.

Smart grid has emerged as the next-generation electricity grid with power flow optimization and high power quality. Smart grid technologies have attracted the attention of industry and academia in the last few years. However, the tradeoff between security and efficiency remains a challenge in the practical deployment of the smart grid. Most recently, Li et al. proposed a lightweight message authentication scheme with user anonymity and claimed that their scheme is provably secure. But we found that their scheme fails to achieve mutual authentication and mitigate some typical attacks (e.g., impersonation attack, denial of service attack) in the smart grid environment. To address these drawbacks, we present a new message authentication scheme with reasonable efficiency. Security and performance analysis results show that the proposed scheme can satisfy the security and lightweight requirements of practical implementations and deployments of the smart grid.

As mobile devices ownership becomes more prevalent (e.g., a user owns multiple mobile devices), the capability to offer secure and user friendly authentication becomes increasingly important. A large number of identity-based user authentication mechanisms for the wireless mobile environment have been proposed. However, they are not generally designed for situations where a user's private key and some other sensitive data can be exposed if his/her mobile device is remotely or physically controlled by an attacker. Threshold secret sharing is one of the solutions to this problem, but it is limited in the requirement that there should exist an honest third-party to hold the complete key after the secret reconstruction process. Therefore, in this paper, we consider the special case that only two devices (i.e., no honest party) at the user's side jointly perform user authentication with a server, and neither device can successfully complete the authentication process alone. Moreover, the key reconstruction is not needed during authentication so that neither device can hold a complete key. We then analyze the security of the proposed protocol and show that it satisfies all known security requirements in practical applications, particularly the key exposure attack resistance. The performance analysis of the proposed protocol is also presented to demonstrate its practicality.

Public verification of data integrity is crucial for promoting the serviceability of cloud storage systems. Recently, Tan and Jia (2014) proposed an identity-based public verification (NaEPASC) protocol for cloud data to simplify key management and alleviate the burden of check tasks. They claimed that NaEPASC enables a third-party auditor (TPA) to verify the integrity of outsourced data with high efficiency and security in a cloud computing environment. However, in this paper, we pinpoint that NaEPASC is vulnerable to the signature forgery attack in the setup phase; i.e., a malicious cloud server can forge a valid signature for an arbitrary data block by using two correct signatures. Moreover, we demonstrate that NaEPASC is subject to data privacy threats in the challenge phase; i.e., an external attacker acting as a TPA can reveal the content of outsourced data. The analysis shows that NaEPASC is not secure in the data verification process. Therefore, our work is helpful for cryptographers and engineers to design and implement more secure and efficient identity-based public auditing schemes for cloud storage.