Training and fine-tuning large-scale language models largely benefit from collaborative learning, but the approach has been proven vulnerable to gradient inversion attacks (GIAs), which allow adversaries to reconstruct private training data from shared gradients. Existing defenses mainly employ gradient perturbation techniques, e.g., noise injection or gradient pruning, to disrupt GIAs' direct mapping from gradient space to token space. However, these methods often fall short due to the retention of semantics similarity across gradient, embedding, and token spaces. Attackers can map proximate gradients into similar embeddings, and subsequently correspond them to tokens with similar semantics.

Federated Learning (FL) enables multiple users to collaboratively train a machine learning model without sharing raw data, making it suitable for privacy-sensitive applications. However, local model or weight updates can still leak sensitive information. Secure aggregation protocols mitigate this risk by ensuring that only the aggregated updates are revealed. Among these, single-setup secure aggregation protocols, where key generation and exchange occur only once, are the most efficient due to reduced communication and computation overhead. However, existing single-setup secure aggregation protocols often lack support for dynamic user participation and do not provide strong privacy guarantees such as forward and backward secrecy.

Transformer-based Text Classifiers (TTC), exemplified by models like BERT, Roberta, T5, and GPT, have showcased impressive proficiency in Natural Language Processing (NLP). Nonetheless, their vulnerability to adversarial examples (AEs) presents a substantial security concern. Existing efforts to fortify model robustness either entail high computational costs or lack transparency and interpretability. This paper introduces a holistic framework calledExplainability-drivenDetection,Identification, andTransformation (EDIT) to address the shortcomings of prevailing inference-time defenses. (i) EDIT employs explainability methodologies (e.g., attention maps, integrated gradients) and frequency features for automated detection and identification of perturbed words while providing insights into the model's decision-making process. (ii) Building upon detection, EDIT purifies detected adversarial examples through an optimal transformation mechanism that utilizes pre-trained embeddings and model feedback to find the best replacements for identified perturbed words. (iii) To integrate human intelligence, the framework automates the process and triggers alerts for a security analyst to ensure secure safeguards and enable proactive human feedback. We comprehensively evaluate our framework on BERT and ROBERTA, trained on four SOTA text classification datasets: IMDB, YELP, AGNEWS, and SST2. We also assess our framework against seven SOTA Word Substitution Attacks (WSA) at character, word, and multi-levels of granularity. The results show that EDIT achieves an average F-score and balanced accuracy of 89.69% and 89.70%, respectively, across all datasets and classifiers. Compared to four SOTA inference defenses, our detector is 1.22 times better in balanced accuracy (BAL_ACC) and 1.33 times better in F1-Score. It also excels in operational efficiency, being about 83 times faster in feature extraction. The identification module outperforms techniques like ReplaceScore, FreqScore, and ExplainScore, achieving 1.125 times better BAL_ACC and Recall, 1.142 times higher AUC, 1.120 times greater Precision, and 1.149 times improved F1-Score. It significantly reduces false positives and negatives by approximately 1.537 and 1.172 times, respectively. Our transformation module effectively converts adversarial examples into non-adversarial counterparts with an accuracy of 91%. EDIT identifies the necessity for human intervention with an average median accuracy of 89%. With alerts integrated, EDIT achieves an average median accuracy of 90% across all evaluated datasets, models, and types of attacks, all while maintaining computational efficiency, averaging 6.94 seconds.

The exploration of backdoor vulnerabilities in object detectors, particularly in real-world scenarios, remains limited. A significant challenge lies in the absence of a natural physical backdoor dataset, and constructing such a dataset is both time- and labor-intensive. In this work, we address this gap by creating a large-scale dataset comprising approximately 11,800 images/frames with annotations featuring natural objects (e.g., T-shirts and hats) as triggers to incur cloaking adversarial effects in diverse real-world scenarios. This dataset is tailored for the study of physical backdoors in object detectors. Leveraging this dataset, we conduct a comprehensive evaluation of an insidious cloaking backdoor effect against object detectors, wherein the bounding box around a person vanishes when the individual is near a natural object (e.g., a commonly available T-shirt) in front of the detector. Our evaluations encompass three prevalent attack surfaces: data outsourcing, model outsourcing, and the use of pretrained models. The cloaking effect is successfully implanted in object detectors across all three attack surfaces. We extensively evaluate four popular object detection algorithms (anchor-based Yolo-V3, Yolo-V4, Faster R-CNN, and anchor-free CenterNet) using 19 videos (totaling approximately 11,800 frames) in real-world scenarios. Our results demonstrate that the backdoor attack exhibits remarkable robustness against various factors, including movement, distance, angle, non-rigid deformation, and lighting. In data and model outsourcing scenarios, the attack success rate (ASR) in most videos reaches 100% or near it, while the clean data accuracy of the backdoored model remains indistinguishable from that of the clean model, making it impossible to detect backdoor behavior through a validation set. Notably, two-stage object detectors (e.g., Faster R-CNN) show greater resistance to backdoor attacks under pure data poisoning conditions (i.e., in data outsourcing) compared to one-stage detectors (e.g., the Yolo series). However, this challenge is surmountable when the attacker controls the training process (particularly in model outsourcing), even with the same small poisoning rate budget as in data outsourcing. In transfer learning attack scenarios assessed on CenterNet, the average ASR remains high at 78%. A detailed 5-minute video illustrating our attack is available at https://youtu.be/Q3HOF4OobbY.

In an era where misinformation spreads freely, factchecking (FC) plays a crucial role in verifying claims and promoting reliable information.While automated fact-checking (AFC) has advanced significantly, existing systems remain vulnerable to adversarial attacks that manipulate or generate claims, evidence, or claim-evidence pairs.These attacks can distort the truth, mislead decision-makers, and ultimately undermine the reliability of FC models.Despite growing research interest in adversarial attacks against AFC systems, a comprehensive, holistic overview of key challenges remains lacking.These challenges include understanding attack strategies, assessing the resilience of current models, and identifying ways to enhance robustness.This survey provides the first in-depth review of adversarial attacks targeting FC 1 , categorizing existing attack methodologies and evaluating their impact on AFC systems.Additionally, we examine recent advancements in adversary-aware defenses and highlight open research questions that require further exploration.Our findings underscore the urgent need for resilient FC frameworks capable of withstanding adversarial manipulations in pursuit of preserving high verification accuracy.Attack Target Edit Granularity Attack Technique Claim attack Evidence attack Claim-evidence pair attack Generate Manipulate Generate Manipulate

Deepfakes have rapidly emerged as a serious threat to society due to their ease of creation and dissemination, triggering the accelerated development of detection technologies. However, many existing detectors rely on lab-generated datasets for validation, which may not prepare them for novel, real-world deepfakes. This paper extensively reviews and analyzes state-of-the-art deepfake detectors, evaluating them against several critical criteria. These criteria categorize detectors into 4 high-level groups and 13 fine-grained sub-groups, aligned with a unified conceptual framework we propose. This classification offers practical insights into the factors affecting detector efficacy. We evaluate the generalizability of 16 leading detectors across comprehensive attack scenarios, including black-box, white-box, and gray-box settings. Our systematized analysis and experiments provide a deeper understanding of deepfake detectors and their generalizability, paving the way for future research and the development of more proactive defenses against deepfakes.

As 5G networks continue to expand into critical infrastructure, ensuring secure and efficient user authentication has become more important than ever. The 5G-AKA protocol, standardized by 3 GPP in TS 33.501, is the cornerstone of authentication in current 5G deployments. It provides mutual authentication, user privacy, and key secrecy. However, despite its widespread adoption, 5G-AKA suffers from known limitations in both security and performance. While it primarily focuses on protecting privacy against passive attackers, recent studies have highlighted its vulnerabilities to active attacks. Furthermore, it relies on a sequence number-based mechanism to prevent replay attacks, requiring the user device and the core network to remain perfectly synchronized. This stateful design introduces operational complexity, frequent desynchronization issues, and additional communication overhead. More critically, 5G-AKA lacks Perfect Forward Secrecy (PFS), leaving past communications vulnerable if long-term keys are ever compromised- a growing concern in the age of sophisticated adversaries. In this paper, we propose an enhanced authentication protocol that builds on the design principles of 5G-AKA while addressing these fundamental shortcomings. First, we present a stateless version of the protocol that eliminates the reliance on sequence numbers, reducing communication complexity while remaining fully compatible with existing SIM cards and network infrastructure. We then extend this design to include PFS with only minimal cryptographic overhead. Both protocols are rigorously analyzed using ProVerif, showing that they meet all major security requirements, including resistance to both passive and active attacks, as well as those outlined by 3GPP and recent academic studies. We also prototype both protocols and evaluate their performance against 5G-AKA and 5G-AKA’ (USENIX’21). Our results show that the proposed protocols offer stronger security guarantees with only minor impact on computational costs, making them practical and forward-compatible solutions for 5G and beyond.

Split learning (SL) aims to protect user data privacy by distributing deep models between the client-server and keeping private data locally. In SL training with multiple clients, the local model weights are shared among the clients for the local model updates. This paper first reveals data privacy leakage exacerbated by local weight sharing among the clients in SL through model inversion attacks. Then, to reduce the data privacy leakage issue, we propose and analyze privacy-enhanced SL (P-SL) (or SL without local weight sharing). We further propose a parallelized P-SL to expedite the training process by duplicating multiple server-side model instances without compromising accuracy. Finally, we explore P-SL with late participating clients and devise a server-side cache-based training method to address the forgetting phenomenon in SL when late clients join. The experiment results demonstrate that P-SL helps reduce up to$50\%$of client-side data leakage, which essentially achieves a better privacy-accuracy trade-off than the current trend by using differential privacy mechanisms. Moreover, P-SL and its cache-based version achieve comparable accuracy to baseline SL under various data distributions, while incurring lower costs for computation and communication. Additionally, caching-based training in P-SL mitigates the negative effect of forgetting, stabilizes learning, and enables practical and low-complexity training in a dynamic environment with late-arriving clients.

While real-time electricity consumption data of users in smart grids can enable value-added services, such as Big Data analytics, each individual user's privacy needs to be protected. How to balance data utility and privacy protection is a significant issue, of which privacy-preserving data aggregation (PPDA) is a viable solution. Prior to this, researchers have proposed a number of PPDA schemes to address the above challenge. Unluckily, most of them suffer from security and privacy drawbacks, while others are inappropriate for resource-limited smart meters due to high cost of cryptographic operations. To tackle this issue, in this article, we propose a pairing-free and exponentiation-free certificateless PPDA scheme named CL-PPDA for smart grids. We prove the security of our design and analyze its performance. Comparative analyses with state-of-the-art work in theory and experiment show that our design not only has better security properties, but also has competitive computation overhead, especially on the resource-constrained smart meter side. Besides, we present an extension of our CL-PPDA scheme to support multidimensional data aggregation, which further enriches the functionality of our design.

The increasing trend of using Large Language Models (LLMs) for code generation raises the question of their capability to generate trustworthy code. While many researchers are exploring the utility of code generation for uncovering software vulnerabilities, one crucial but often overlooked aspect is the security Application Programming Interfaces (APIs). APIs play an integral role in upholding software security, yet effectively integrating security APIs presents substantial challenges. This leads to inadvertent misuse by developers, thereby exposing software to vulnerabilities. To overcome these challenges, developers may seek assistance from LLMs. In this paper, we systematically assess ChatGPT's trustworthiness in code generation for security API use cases in Java. To conduct a thorough evaluation, we compile an extensive collection of 48 programming tasks for 5 widely used security APIs. We employ both automated and manual approaches to effectively detect security API misuse in the code generated by ChatGPT for these tasks. Our findings are concerning: around 70% of the code instances across 30 attempts per task contain security API misuse, with 20 distinct misuse types identified. Moreover, for roughly half of the tasks, this rate reaches 100%, indicating that there is a long way to go before developers can rely on ChatGPT to securely implement security API code.

The gradient inversion attack has been demonstrated as a significant privacy threat to federated learning (FL), particularly in continuous domains such as vision models. In contrast, it is often considered less effective or highly dependent on impractical training settings when applied to language models, due to the challenges posed by the discrete nature of tokens in text data. As a result, its potential privacy threats remain largely underestimated, despite FL being an emerging training method for language models. In this work, we propose a domain-specific gradient inversion attack named GRAB (gradient inversion with hybrid optimization). GRAB features two alternating optimization processes to address the challenges caused by practical training settings, including a simultaneous optimization on dropout masks between layers for improved token recovery and a discrete optimization for effective token sequencing. GRAB can recover a significant portion (up to 92.9% recovery rate) of the private training data, outperforming the attack strategy of utilizing discrete optimization with an auxiliary model by notable improvements of up to 28.9% recovery rate in benchmark settings and 48.5% recovery rate in practical settings. GRAB provides a valuable step forward in understanding this privacy threat in the emerging FL training mode of language models.

All current backdoor attacks on deep learning (DL) models fall under the category of a vertical class backdoor (VCB).In VCB attacks, any sample from a class activates the implanted backdoor when the secret trigger is present, regardless of whether it is a sub-type source-class-agnostic backdoor or a source-class-specific backdoor. For example, a trigger of sunglasses could mislead a facial recognition model when either an arbitrary (source-class-agnostic) or a specific (source-class-specific) person wears sunglasses. Existing defense strategiesoverwhelmingly focus on countering VCB attacks, especially those that are source-class-agnostic. This narrow focus neglects the potential threat of other simpler yet general backdoor types, leading to false security implications. It is, therefore, crucial to discover and elucidate unknown backdoor types, particularly those that can be easily implemented, as a mandatory step before developing countermeasures.

An adversarial attack to a text classifier consists of an input that induces the classifier into an incorrect class prediction, while retaining all the linguistic properties of correctly-classified examples. A popular class of adversarial attacks exploits the gradients of the victim classifier to train a dedicated generative model to produce effective adversarial examples. However, this training signal alone is not sufficient to ensure other desirable properties of the adversarial attacks, such as similarity to non-adversarial examples, linguistic fluency, grammaticality, and so forth. For this reason, in this paper we propose a novel training objective which leverages a set of pretrained language models to promote such properties in the adversarial generation. A core component of our approach is a set of vocabulary-mapping matrices which allow cascading the generative model to any victim or component model of choice, while retaining differentiability end-to-end. The proposed approach has been tested in an ample set of experiments covering six text classification datasets, two victim models, and four baselines. The results show that it has been able to produce effective adversarial attacks, outperforming the compared generative approaches in a majority of cases and proving highly competitive against established token-replacement approaches.

Deep Neural Network (DNN) models are often deployed in resource-sharing clouds as Machine Learning as a Service (MLaaS) to provide inference services. To steal model architectures that are of valuable intellectual properties, a class of attacks has been proposed via different side-channel leakage, posing a serious security challenge to MLaaS.Also targeting MLaaS, we propose a new end-to-end attack, DeepTheft, to accurately recover complex DNN model architectures on general processors via the RAPL (Running Average Power Limit)-based power side channel. While unprivileged access to the RAPL has been disabled in bare-metal OSes, we observe that the RAPL is still legitimately accessible in a platform as a service, e.g., the latest docker environment of version 20.10.18 used in this work. However, an attacker can acquire only a low sampling rate (1 KHz) of the time-series energy traces from the RAPL interface, rendering existing techniques ineffective in stealing large and deep DNN models. To this end, we design a novel and generic learning-based framework consisting of a set of meta-models, based on which DeepTheft is demonstrated to have high accuracy in recovering a large number (thousands) of models architectures from different model families including the deepest ResNet152. Particularly, DeepTheft has achieved a Levenshtein Distance Accuracy of 99.75% in recovering network structures, and a weighted average F1 score of 99.60% in recovering diverse layer-wise hyperparameters. Besides, our proposed learning framework is general to other time-series side-channel signals. To validate its generalization, another existing side channel is exploited, i.e., CPU frequency. Different from RAPL, CPU frequency is accessible to unprivileged users in bare-metal OSes. By using our generic learning framework trained against CPU frequency traces, DeepTheft has shown similarly high attack performance in stealing model architectures.

As an indispensable part of a smart city, the smart grid has gained widespread attention from industrial and academic communities. How to securely collect users’ real-time energy consumption data to provide services such as big data analytics and demand-response services while ensuring the privacy of individual users is a challenging issue in the smart grid. The privacy-preserving data aggregation (P2DA) suggests a feasible solution. For years, researchers have designed numerous P2DA schemes for securing smart grids. Unfortunately, the majority of them have some security and privacy deficiencies. Other schemes are unsuitable for resource-constrained smart meters due to expensive cryptographic operations. In this work, we design a lightweight verifiable certificate-based P2DA scheme LV-P2DA without pairings for smart grids. We formally prove its security under standard cryptographic assumptions. The performance comparison results illustrate that compared with state-of-the-art solutions, our design achieves at least a 99.43% improvement in computational cost and a 32.96% improvement in communication cost on the smart meter side, respectively.

While location trajectories represent a valuable data source for analyses and location-based services, they can reveal sensitive information, such as political and religious preferences. Differentially private publication mechanisms have been proposed to allow for analyses under rigorous privacy guarantees. However, the traditional protection schemes suffer from a limiting privacy-utility trade-off and are vulnerable to correlation and reconstruction attacks. Synthetic trajectory data generation and release represent a promising alternative to protection algorithms. While initial proposals achieve remarkable utility, they fail to provide rigorous privacy guarantees. This paper proposes a framework for designing a privacy-preserving trajectory publication approach by defining five design goals, particularly stressing the importance of choosing an appropriate Unit of Privacy. Based on this framework, we briefly discuss the existing trajectory protection approaches, emphasising their shortcomings. This work focuses on the systematisation of the state-of-the-art generative models for trajectories in the context of the proposed framework. We find that no existing solution satisfies all requirements. Thus, we perform an experimental study evaluating the applicability of six sequential generative models to the trajectory domain. Finally, we conclude that a generative trajectory model providing semantic guarantees remains an open research question and propose concrete next steps for future research.

Due to their low latency and high privacy preservation, there is currently a burgeoning demand for deploying deep learning (DL) models on ubiquitous edge Internet of Things (IoT) devices. However, DL models are often large in size and require large-scale computation, which prevents them from being placed directly onto IoT devices, where resources are constrained, and 32-bit floating-point (float-32) operations are unavailable. Commercial framework (i.e., a set of toolkits) empowered model quantization is a pragmatic solution that enables DL deployment on mobile devices and embedded systems by effortlessly post-quantizing a large high-precision model (e.g., float-32) into a small low-precision model (e.g., int-8) while retaining the model inference accuracy. However, their usability might be threatened by security vulnerabilities. This work reveals that standard quantization toolkits can be abused to activate a backdoor. We demonstrate that a full-precision backdoored model which does not have any backdoor effect in the presence of a trigger—as the backdoor is dormant—can be activated by (i) TensorFlow-Lite (TFLite) quantization, the onlyproduct-readyquantization framework to date, and (ii) thebeta releasedPyTorch Mobile framework. In our experiments, we employ three popular model architectures (VGG16, ResNet18, and ResNet50), and train each across three popular datasets: MNIST, CIFAR10 and GTSRB. We ascertain that all trained float-32 backdoored models exhibit no backdoor effecteven in the presence of trigger inputs. Particularly, four influential backdoor defenses are evaluated, and they fail to identify a backdoor in the float-32 models. When each of the float-32 models is converted into an int-8 format model through the standard TFLite or PyTorch Mobile framework's post-training quantization, the backdoor is activated in the quantized model, which shows a stable attack success rate close to 100% upon inputs with the trigger, while it usually behaves upon non-trigger inputs. This work highlights that a stealthy security threat occurs when an end-user utilizes the on-device post-training model quantization frameworks, informing security researchers of a cross-platform overhaul of DL models post-quantization even if these models pass security-aware front-end backdoor inspections. Significantly, we have identified Gaussian noise injection into the malicious full-precision model as an easy-to-use preventative defense against the PQ backdoor. The attack source code is released athttps://github.com/quantization-backdoor.

To mitigate recent insidious backdoor attacks on deep learning models, advances have been made by the research community. Nonetheless, state-of-the-art defenses are either limited to specific backdoor attacks (i.e., source-agnostic attacks) or non-user-friendly in that machine learning expertise and/or expensive computing resources are required. This work observes that all existing backdoor attacks have an inadvertent and inevitable intrinsic weakness, termed as non-transferability —that is, a trigger input hijacks a backdoored model but is not effective in another model that has not been implanted with the same backdoor. With this key observation, we propose non-transferability enabled backdoor detection to identify trigger inputs for a model-under-test during run-time. Specifically, our detection allows a potentially backdoored model-under-test to predict a label for an input. Moreover, our detection leverages a feature extractor to extract feature vectors for the input and a group of samples randomly picked from its predicted class label, and then compares the similarity between the input and the samples in the feature extractor’s latent space to determine whether the input is a trigger input or a benign one. The feature extractor can be provided by a reputable party or is a free pre-trained model privately reserved from any open platform (e.g., ModelZoo, GitHub, Kaggle) by a user and thus our detection does not require the user to have any machine learning expertise or perform costly computations. Extensive experimental evaluations on four common tasks affirm that our detection scheme has high effectiveness (low false acceptance rate) and usability (low false rejection rate) with low detection latency against different types of backdoor attacks.

Since Deep Learning (DL) backdoor attacks have been revealed as one of the most insidious adversarial attacks, a number of countermeasures have been developed with certain assumptions defined in their respective threat models. However, their robustness is currently inadvertently ignored, which can introduce severe consequences, e.g., a countermeasure can be misused and result in a false implication of backdoor detection. For the first time, we critically examine the robustness of existing backdoor countermeasures. As an initial study, we first identify five potential non-robust failure factors including binary classification, poison rate, model complexity, single-model justification, and hyperparameter sensitivity. As exhaustively examining defenses is infeasible, we instead focus on influential backdoor detection-based countermeasures consisting of model-inspection ones including Neural Cleanse (S&P’19), ABS (CCS’19), and MNTD (S&P’21), and data-inspection ones including SCAn (USENIX SECURITY’21) to examine their failure cases under one or more of these factors. Although these investigated countermeasures claim that they work well under their respective threat models, they have inherent unexplored non-robust cases, which are not even rooted from delicate adaptive attacks. We demonstrate how to trivially bypass them aligned with their respective threat models by simply varying the aforementioned factors. Particularly, for each defense, formal proofs or empirical studies are used to reveal its non-robust cases where it is not as robust as it claims or expects. This work highlights the necessity of thoroughly evaluating the robustness of backdoor countermeasures to avoid their misleading security implications in unknown non-robust cases.

By 2050, global sales of electric vehicles (EVs) are predicted to account for approximately 70% of all vehicle sales. However, whilst transitioning from combustion engine vehicles to EVs would result in reduced carbon dioxide emissions, it would place significant strain on energy generation, and grid infrastructure. Many EV studies investigated routing or charge station management, while research on predicting energy demand at a specific location was lacking. To address this, our study focused on predicting EV’s next charge location. We developed a localised onboard Convolutional Neural Network (CNN) model that achieved accuracies up to 95%. Our proposal used community area Distributed Energy Resource Management Systems (DERMS) to train EV models during charge transactions, while predictions were made onboard each EV. To address the lack of EV mobility charge data, we created a hybrid dataset using empirical Chicago city taxi mobility data adding synthetic EV charging event states. We conducted multiple experiments over various battery charge levels to understand how far ahead in time next charge location could be predicted, achieving reliable predictions up to 3 days before requiring next charge. Finally, this study laid a foundation for future EV mobility research by providing a novel EV mobility charge dataset.

Training deep neural networks (DNNs) requires large datasets and powerful computing resources, which has led some owners to restrict redistribution without permission. Watermarking techniques that embed confidential data into DNNs have been used to protect ownership, but these can degrade model performance and are vulnerable to watermark removal attacks. Recently, DeepJudge was introduced as an alternative approach to measuring the similarity between a suspect and a victim model. While DeepJudge shows promise in addressing the shortcomings of watermarking, it primarily addresses situations where the suspect model copies the victim’s architecture. In this study, we introduce DeepTaster, a novel DNN fingerprinting technique, to address scenarios where a victim’s data is unlawfully used to build a suspect model. DeepTaster can effectively identify such DNN model theft attacks, even when the suspect model’s architecture deviates from the victim’s. To accomplish this, DeepTaster generates adversarial images with perturbations, transforms them into the Fourier frequency domain, and uses these transformed images to identify the dataset used in a suspect model. The underlying premise is that adversarial images can capture the unique characteristics of DNNs built with a specific dataset. To demonstrate the effectiveness of DeepTaster, we evaluated the effectiveness of DeepTaster by assessing its detection accuracy on three datasets (CIFAR10, MNIST, and Tiny-ImageNet) across three model architectures (ResNet18, VGG16, and DenseNet161). We conducted experiments under various attack scenarios, including transfer learning, pruning, fine-tuning, and data augmentation. Specifically, in the Multi-Architecture Attack scenario, DeepTaster was able to identify all the stolen cases across all datasets, while DeepJudge failed to detect any of the cases.

Existing integrity verification approaches for deep models are designed for private verification (i.e., assuming the service provider is honest, with white-box access to model parameters). However, private verification approaches do not allow model users to verify the model at run-time. Instead, they must trust the service provider, who may tamper with the verification results. In contrast, a public verification approach that considers the possibility of dishonest service providers can benefit a wider range of users. In this paper, we propose PublicCheck, a practical public integrity verification solution for services of run-time deep models. PublicCheck considers dishonest service providers, and overcomes public verification challenges of being lightweight, providing anti-counterfeiting protection, and having fingerprinting samples that appear smooth. To capture and fingerprint the inherent prediction behaviors of a run-time model, PublicCheck generates smoothly transformed and augmented encysted samples that are enclosed around the model's decision boundary while ensuring that the verification queries are indistinguishable from normal queries. PublicCheck is also applicable when knowledge of the target model is limited (e.g., with no knowledge of gradients or model parameters). A thorough evaluation of PublicCheck demonstrates the strong capability for model integrity breach detection (100% detection accuracy with less than 10 black-box API queries) against various model integrity attacks and model compression attacks. PublicCheck also demonstrates the smooth appearance, feasibility, and efficiency of generating a plethora of encysted samples for fingerprinting.

Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection, which can be deployed on pervasive Internet of Things (IoT) and edge devices. A large amount of data is often required to train an object detector with satisfactory accuracy. However, due to the intensive workforce involved with collecting and annotating large datasets, data curation task is often outsourced to a third party (e.g., Amazon Mechanical Turk) or volunteers. This work reveals severe vulnerabilities in this data curation pipeline. We propose TransCAB, the first work to craft clean-annotated images to stealthily implant the backdoor into the object detectors later trained on them by the data curator/user even when the data curator can manually audit the images and fully controls the training process. Existing clean-label poisoned images are only shown in classification tasks but not non-classification tasks, in particular, object detection due to unique challenges faced, generally owing to the complexity of having multiple objects within each frame (image), including the victim and non-victim objects. Furthermore, we demonstrate that the backdoor effect of both cloaking and misclassification are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical object as trigger (i.e., T-shirt). The efficacy of our TransCAB is ensured by constructively i) applying the image-camouflage attack that abuses the image-scaling function widely used by the deep learning framework (i.e., PyTorch), ii) incorporating the devised clean image replica technique, and iii) combining identified poison data selection criteria given constrained attacking budget. Extensive experi-ments on YOLOv3, YOLOv4, CenterNet, and Faster R-CNN affirm that TransCAB exhibits more than 90% attack success rate under various real-world scenes even when a very small (i.e., 0.14%) dataset fraction is poisoned. In addition, the small set of poisoned images crafted on one detector (i.e., YOLOv3) can be effectively transferred to insert a backdoor on another detector (i.e., CenterNet). A comprehensive video demo is at https://youtu.be/MA7L_LpXkp4, where a poison rate of merely 0.14% is set for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor. Our collected dataset with T-shirt as a natural trigger (about 11,350 frames in total) is open to the public at https://github.com/inconstance/T-shirt-natural-backdoor-dataset, which is the first relatively large-scale natural trigger backdoor dataset.

Abstract ECG signal is widely used in most cardiology e‐health systems. Patients may be monitored continuously for at least 12 h a day. Therefore, the ECG signal size transmitted to a hospital server during continuous monitoring is significant. Furthermore, transmission of the large size ECG signal is a power consuming process. ECG compression is one of the proposed solutions to overcome this problem. In this paper, a new fractal‐based ECG lossy compression technique is proposed. It is clear that fractal can use ECG signal self similarity characteristics efficiently to achieve high compression ratios. The proposed technique is based on developing the fractal model in conjunction with Iterated Function System. Fractal is well known as a time consuming technique, and therefore, new mathematical development is proposed to potentially reduce fractal computations. Experiments have proven the significant performance of fast fractal in comparison with the traditional version. Furthermore, the resultant compression ratios are close to the traditional fractal results and higher than other existing techniques.

Split learning (SL) enables data privacy preservation by allowing clients to collaboratively train a deep learning model with the server without sharing raw data. However, SL still has limitations such as potential data privacy leakage and high computation for clients. In this paper, we propose to binarize the SL local layers for faster computation (up to 17.5 times less forward-propagation time in both training and inference phases on mobile devices) and reduced memory usage (up to 32 times less memory and bandwidth requirements). More importantly, the binarized SL (B-SL) model can reduce privacy leakage from SL smashed data with merely a small degradation in model accuracy. To further enhance privacy preservation, we also propose two novel approaches: 1) training with additional local leak loss and 2) applying differential privacy, which could be integrated separately or concurrently into the B-SL model. Experimental results with different datasets have affirmed the benefits of the B-SL models compared with several benchmark models. The effectiveness of B-SL models against feature-space hijacking attack (FSHA) is also illustrated. Our results have demonstrated B-SL models are promising for lightweight IoT/mobile applications with high privacy-preservation requirements such as mobile healthcare applications.

By adopting advanced Internet of Things (IoT) technology to sense and collect traffic-related information to improve traffic safety and efficiency, the vehicular ad hoc network (VANET) is becoming a prominent application that changes human driving experiences in the current era. Because frequent data exchange occurs in open environments, VANETs are inherently vulnerable to security and privacy attacks. In history, many certificateless aggregate signature (CLAS) schemes with conditional privacy-preserving (CPP) have been proposed to ensure the authenticity and integrity of the exchanged data and protect users’ privacy. However, we reveal that the state-of-the-art schemes cannot be deployed in practical VANET applications by proposing concrete signature forgery attacks. To this end, we propose a new CLAS-based authentication scheme with CPP for VANETs. The rigorous security proofs based on the standard cryptographic assumption show that the scheme has enhanced security. Moreover, theoretical analysis and experimental evaluation illustrate the practicality of our design.

The healthcare Internet of Things (IoT) is rapidly becoming an invaluable tool in the healthcare industry. However, sharing data in healthcare IoT raises many security and privacy concerns, such as how to ensure data integrity, source authentication, and data privacy. Redactable signature schemes (${{\sf RSS}}$s) could be a feasible solution to address this question because it allows a signature holder to independently delete the privacy-sensitive part of the authenticated data without invalidating the respective signature. This flexible data sharing mechanism not only protects data privacy but also saves bandwidth. However, the state-of-the-art${{\sf RSS}}$s suffer from either the costly public key management problem or the secret key escrow problem. Another drawback of these schemes lies in their computation and communication overheads and hence are quite expensive for constrained devices. To address these challenging issues, in this work, we first propose the notion of certificateless${{\sf RSS}}$. We then provide an efficient instantiation of our scheme and prove its security under cryptographic assumptions. Our construction supports batch verification and redaction control, which further saves bandwidth and enhances the security of shared data by preventing the dishonest holder from arbitrarily editing data. Moreover, the comparison analysis of theory and experiment with more recent works shows the practicability of our design.

Location trajectories collected by smartphones and other devices represent a valuable data source for applications such as location-based services. Likewise, trajectories have the potential to reveal sensitive information about individuals, e.g., religious beliefs or sexual orientations. Accordingly, trajectory datasets require appropriate sanitization. Due to their strong theoretical privacy guarantees, differential private publication mechanisms receive much attention. However, the large amount of noise required to achieve differential privacy yields structural differences, e.g., ship trajectories passing over land. We propose a deep learning-based Reconstruction Attack on Protected Trajectories (RAoPT), that leverages the mentioned differences to partly reconstruct the original trajectory from a differential private release. The evaluation shows that our RAoPT model can reduce the Euclidean and Hausdorff distances between the released and original trajectories by over 68 % on two real-world datasets under protection with ε ≤ 1. In this setting, the attack increases the average Jaccard index of the trajectories’ convex hulls, representing a user’s activity space, by over 180 %. Trained on the GeoLife dataset, the model still reduces the Euclidean and Hausdorff distances by over 60 % for T-Drive trajectories protected with a state-of-the-art mechanism (ε = 0.1). This work highlights shortcomings of current trajectory publication mechanisms, and thus motivates further research on privacy-preserving publication schemes.

Cyber-phishing attacks recently became more precise, targeted, and tailored by training data to activate only in the presence of specific information or cues. They are adaptable to a much greater extent than traditional phishing detection. Hence, automated detection systems cannot always be 100% accurate, increasing the uncertainty around expected behavior when faced with a potential phishing email. On the other hand, human-centric defence approaches focus extensively on user training but face the difficulty of keeping users up to date with continuously emerging patterns. Therefore, advances in analyzing the content of an email in novel ways along with summarizing the most pertinent content to the recipients of emails is a prospective gateway to furthering how to combat these threats. Addressing this gap, this work leverages transformer-based machine learning to (i) analyze prospective psychological triggers, to (ii) detect possible malicious intent, and to (iii) create representative summaries of emails. We then amalgamate this information and present it to the user to allow them to (i) easily decide whether the email is "phishy" and (ii) self-learn advanced malicious patterns.

Many Machine Learning (ML) based phishing detection algorithms are not adept to recognise "concept drift"; attackers introduce small changes in the statistical characteristics of their phishing attempts to successfully bypass detection. This leads to the classification problem of frequent false positives and false negatives, and a reliance on manual reporting of phishing by users. Profiler is a distributed phishing risk assessment tool that combines three email profiling dimensions: (1) threat level, (2) cognitive manipulation, and (3) email content type to detect email phishing. Unlike pure ML-based approaches, Profiler does not require large data sets to be effective and evaluations on real-world data sets show that it can be useful in conjunction with ML algorithms to mitigate the impact of concept drift.

Abstract The edge authentication of graphs has been studied in the literature because graphs are one of the most widely used data organization structures. The majority of such schemes cannot be used to authenticate general directed graphs (GDGs); other schemes cannot be used for addressing either the issue of dynamic update or the issue of information leakage (such as the existence of nodes/edges and structural relationship of the graph). Also, all the existing schemes do not consider the forward security: if the signer’s secret key has been compromised, all previously generated signatures remain valid. This property provides high-level security protection for authentication schemes. To address these issues, in this work, we propose a forward-secure edge authentication scheme for GDGs. Observe that existing such schemes can only give a proof such that ‘there is an edge between nodes $u$ and $v$’. Our scheme, however, can directly give a proof such that ‘there is no edge between nodes $u$ and $v$’, which makes the function of edge authentication schemes more diverse. Moreover, our proposed scheme is proven to be secure against an adaptive chosen-message adversary in the random oracle model. To show its desirable performance, we analyze the computational costs of our scheme and compare it with other related schemes in terms of features.

Wireless medical sensor networks (WMSNs) have aroused widespread attention in recent years with the development of Internet of Things (IoT) technology. WMSNs offer many new opportunities for healthcare professionals to monitor patients and patient self-monitoring. To overcome the resource (such as memory and power) limitations of sensors and attain data security of patients’ private medical information, researchers have designed plenty of work for securing WMSNs. For years, certificate-based aggregate signature (CBAS) schemes have been put forward for WMSNs to prevent patients’ sensitive medical data from being tampered with and damaged. In this work, we analyze the security flaws of a very recent CBAS scheme proposed by Vermaet al.(2021) by presenting two types of security attacks. We later propose a CBAS scheme with user anonymity protection for WMSNs and prove its security based on the standard cryptographic assumption. The performance comparison results from theory and experiment illustrate the practicality of our design.

Federated learning (FL) and split learning (SL) are state-of-the-art distributed machine learning techniques to enable machine learning training without accessing raw data on clients or end devices. However, their comparative training performance under real-world resource-restricted Internet of Things (IoT) device settings remains barely studied. This work provides empirical comparisons of FL and SL in real-world IoT settings regarding (i) learning performance with heterogeneous data distributions and (ii) on-device execution overhead. Our analyses in this work demonstrate that the learning performance of SL is better than FL under an imbalanced data distribution but worse than FL under an extreme non-IID data distribution. Recently, FL and SL are combined to form splitfed learning (SFL) to leverage each of their benefits (e.g., parallel training of FL and lightweight on-device computation requirement of SL). Our work considers FL, SL, and SFL, and mounts them on Raspberry Pi devices to evaluate their performance, including training time, communication overhead, power consumption, and memory usage with resource-restricted IoT devices. Besides evaluations, we apply two optimizations. First, we generalize SFL by carefully examining the possibility of a hybrid type of model training at the server-side. The generalized SFL merges sequential (dependent) and parallel (independent) processes of model training and thus is beneficial to a system with a large scale of IoT devices, specifically at the server-side operations. Second, we propose pragmatic techniques to substantially reduce the communication overhead by up to four times for the SL and (generalized) SFL.

Detection-based defense approaches are effective against adversarial attacks without compromising the structure of the protected model. However, they could be bypassed by stronger adversarial attacks and are limited in their ability to handle high-fidelity images. In this paper, we explore an effective detection-based defense against adversarial attacks on images (including high-resolution images) by extending the investigation beyond a single-instance perspective to incorporate its transformations as well. Our intuition is that the essential characteristics of a valid image are generally not affected by non-essential style transformations, for example, a slight variation in the facial expression of a portrait would not alter its identification. In contrast, adversarial examples are designed to affect only a single instance at a time, with unpredictable effects on a set of transformations of the instance. Consequently, we leverage a controllable generative mechanism to conduct the non-essential style transformations for a given image via modification along the style axis in the latent space. Next, the consistency of prediction between the given input and its style transformations is used to distinguish adversarial instances. Based on experiments on three image datasets, including high-resolution images, we demonstrated that our defense could detect 90–100 percent of adversarial examples produced by various state-of-the-art adversarial attacks, with a low false-positive rate.

The diversity and quantity of data warehouses, gathering data from distributed devices such as mobile devices, can enhance the success and robustness of machine learning algorithms. Federated learning enables distributed participants to collaboratively learn a commonly shared model while holding data locally. However, it is also faced with expensive communication and limitations due to the heterogeneity of distributed data sources and lack of access to global data. In this paper, we investigate a practical distributed learning scenario where multiple downstream tasks (e.g., classifiers) could be efficiently learned from dynamically updated and non-iid distributed data sources while providing local data privatization. We introduce a new distributed/collaborative learning scheme to address communication overhead via latent compression, leveraging global data while providing privatization of local data without additional cost due to encryption or perturbation. This scheme divides learning into (1) informative feature encoding, and transmitting the latent representation of local data to address communication overhead; (2) downstream tasks centralized at the server using the encoded codes gathered from each node to address computing overhead. Besides, a disentanglement strategy is applied to address the privatization of sensitive components of local data. Extensive experiments are conducted on image and speech datasets. The results demonstrate that downstream tasks with the compact latent representations with the privatization of local data can achieve comparable accuracy to centralized learning.

Image-scaling is a typical operation that processes the input image before feeding it into convolutional neural network models. However, it is vulnerable to the newly revealed image-scaling attack. This work presents an image-scaling attack detection framework, Decamouflage, consisting of three independent detection methods: scaling, filtering, and steganalysis, to detect the attack through examining distinct image characteristics. Decamouflage has a pre-determined detection threshold that is generic. More precisely, as we have validated, the threshold determined from one dataset is also applicable to other different datasets. Extensive experiments show that Decamouflage achieves detection accuracy of 99.9% and 98.5% in the white-box and the black-box settings, respectively. We also measured its running time overhead on a PC with an Intel i5 CPU and 8GB RAM. The experimental results show that image-scaling attacks can be detected in milliseconds. Moreover, Decamouflage is highly robust against adaptive image-scaling attacks (e.g., attack image size variances).

In a typical e-healthcare system, it is common for users' physiological data collected by Internet-of-Things (IoT) devices to be processed and shared in a third-party environment. To improve service quality, healthcare data sharing in third-party environments needs to ensure the integrity, source authentication, and privacy of the data. Redactable signature schemes (RSSs) are designed to address this concern over the past decades. More concretely, an RSS allows a signature holder to delete privacy-sensitive parts of the signed data and derive a valid signature for the retained data without any help from the original signer. This also provides a flexible data sharing mechanism in a bandwidth-saving manner. However, almost all of the existing RSSs are built on top of public-key infrastructure (PKI) systems, which involve heavyweight public-key management problems and are not suitable for resource-limited IoT applications. Besides, we argue that the only known PKI independent RSS for IoT has some security flaws and requires a large storage space. In this work, we eliminate some of the costs associated with PKI and certificates (such as key managements and certificate verifications) in traditional RSS and propose the first identity-based RSS satisfying the requirements of protecting the integrity and source authentication with selective disclosure control for healthcare data sharing in IoT. We prove the security of the scheme in the random oracle model under the k-SDH assumption. Theoretical comparison and experimental analysis show that our construction has a practical performance. As an extension, we also discuss how to extend our design to achieve fine-grained redaction control, which provides a feasible strategy for a signer to prevent additional redaction or arbitrary redaction from dishonest signature holders.

A new collaborative learning, called split learning, was recently introduced, aiming to protect user data privacy without revealing raw input data to a server. It collaboratively runs a deep neural network model where the model is split into two parts, one for the client and the other for the server. Therefore, the server has no direct access to raw data processed at the client. Until now, the split learning is believed to be a promising approach to protect the client's raw data; for example, the client's data was protected in healthcare image applications using 2D convolutional neural network (CNN) models. However, it is still unclear whether the split learning can be applied to other deep learning models, in particular, 1D CNN.

Federated learning (FL) and split neural networks (SplitNN) are state-of-art distributed machine learning techniques to enable machine learning without directly accessing raw data on clients or end devices. In theory, such distributed machine learning techniques have great potential in distributed applications, in which data are typically generated and collected at the client-side while the collected data should be processed by the application deployed at the server-side. However, there is still a significant gap in evaluating the performance of those techniques concerning their practicality in the Internet of Things (IoT)-enabled distributed systems constituted by resource-constrained devices. This work is the first attempt to provide empirical comparisons of FL and SplitNN in real-world IoT settings in terms of learning performance and device implementation overhead. We consider a variety of datasets, different model architectures, multiple clients, and various performance metrics. For the learning performance (i.e., model accuracy and convergence time), we empirically evaluate both FL and SplitNN under different types of data distributions such as imbalanced and non-independent and identically distributed (non-IID) data. We show that the learning performance of SplitNN is better than FL under an imbalanced data distribution but worse than FL under an extreme non-IID data distribution. For implementation overhead, we mount both FL and SplitNN on Raspberry Pi devices and comprehensively evaluate their overhead, including training time, communication overhead, power consumption, and memory usage. Our key observations are that under the IoT scenario where the communication traffic is the primary concern, FL appears to perform better over SplitNN because FL has a significantly lower communication overhead compared with SplitNN. However, our experimental results also demonstrate that neither FL or SplitNN can be applied to a heavy model, e.g., with several million parameters, on resource-constrained IoT devices because its training cost would be too expensive for such devices. Source code is released and available: https://github.com/Minki-Kim95/Federated-Learning-and-Split-Learning-with-raspberry-pi.