Text-to-image diffusion models have achieved remarkable progress in image synthesis, but their potential misuse for generating unauthorized or harmful content has raised growing safety concerns. This has created an urgent need for safe diffusion-based image generation methods that can selectively suppress sensitive concepts while preserving the model's general generative capability. Existing concept erasure approaches typically rely on either model fine-tuning or closed-form editing. However, they often suffer from two major limitations: (1 insufficient or excessive erasure, where the former fails to suppress target concepts and the latter disrupts benign semantics; and (2 degradation of non-target concepts, where removing target concepts undermines the generation of unrelated concepts, especially in multi-concept scenarios. To address these issues, we propose the Singular Value Eraser (SVEraser), a lightweight concept erasure module that removes specific concepts by optimizing singular-value offsets of weight matrices. Operating in a compact yet expressive singular-value space, SVEraser enables precise concept removal while reducing side effects on unrelated content. Moreover, once trained for different concepts, multiple SVErasers can be flexibly combined for multi-concept erasure. To further reduce interference, we introduce an eraser activation mechanism that adaptively selects the appropriate SVErasers during inference based on the input prompt. Extensive experiments on copyrighted objects, artistic styles, and explicit content demonstrate that our method achieves accurate target concept removal while preserving non-target semantics, providing a practical and reliable solution for safe diffusion-based image generation.

Penetration testing is a popular technique for identifying system vulnerabilities, requiring skilled professionals and several weeks to complete. Existing automated penetration testing systems based on multi-agent and large language models(LLMs) are unable to efficiently complete the testing process due to gaps in stage assessment, workflow control and task execution capabilities compared to human expertise.To bridge these gaps, we propose an improved automated penetration testing framework. Our framework employs a Controller that manages the execution of agents across stages, ensuring efficient workflow management and preventing insufficient execution or unnecessary token consumption. Additionally, our framework separates services and potential exploits into individual tasks, minimizing interference and enhancing the effectiveness of each agent’s exploration. Our framework also integrates user-defined tools, allowing agents to invoke these tools through prompt engineering, which bridges the gap between LLMs and human capabilities in penetration testing. We evaluate our framework using the real-world AI-Pentest-Benchmark dataset, and the results demonstrate that it outperforms or matches state-of-the-art methods in terms of task completion rates, while achieving token usage ranging from 29.42% to 88.83% of the baseline. Evaluations also demonstrate the contribution of user-defined tools to the penetration testing process from effectiveness to efficiency.

The proliferation of deep learning-based video forgery, known as DeepFakes, poses a significant threat to information integrity and digital security, particularly in real-time communication scenarios. Existing detection methods often struggle with three critical challenges: performance degradation due to video compression, a limited capacity to detect subtle audio-visual semantic inconsistencies, and excessive computational latency for real-time deployment. This paper introduces a lightweight, multi-modal framework designed to address these limitations. Our method employs a dual-stream architecture for parallel analysis of visual and auditory signals. Key contributions include: a novel dynamic frequency band selection module that adaptively isolates and enhances faint forgery artifacts from heavily compressed video streams; a phoneme-aligned cross-modal verification system that precisely quantifies lip-audio temporal desynchronization to detect semantic mismatches; and a lightweight hybrid architecture integrating ResNet3D and Mamba for efficient spatiotemporal modeling. Validated on benchmarks like CelebDF and FaceForensics++, our method achieves a state-of-the-art trade-off, delivering accuracy competitive with leading methods at a fraction of the computational cost, thus enabling practical real-time deployment.

Tensor robust principal component analysis (TRPCA) is a classical way for low-rank tensor recovery, which minimizes the convex surrogate of tensor rank by shrinking each tensor singular value equally. However, for real-world visual data, large singular values represent more significant information than small singular values. In this paper, we propose a nonconvex TRPCA (N-TRPCA) model based on the tensor adjustable logarithmic norm. Unlike TRPCA, our N-TRPCA can adaptively shrink small singular values more and shrink large singular values less. In addition, TRPCA assumes that the whole data tensor is of low rank. This assumption is hardly satisfied in practice for natural visual data, restricting the capability of TRPCA to recover the edges and texture details from noisy images and videos. To this end, we integrate nonlocal self-similarity into N-TRPCA, and further develop a nonconvex and nonlocal TRPCA (NN-TRPCA) model. Specifically, similar nonlocal patches are grouped as a tensor and then each group tensor is recovered by our N-TRPCA. Since the patches in one group are highly correlated, all group tensors have strong low-rank property, leading to an improvement of recovery performance. Experimental results demonstrate that the proposed NN-TRPCA outperforms existing TRPCA methods in visual data recovery. The demo code is available at https://github.com/qguo2010/NN-TRPCA.

Abstract Advanced Persistent Threats (APTs) achieves internal networks penetration through multiple methods, making it difficult to detect attack clues solely through boundary defense measures. To address this challenge, some research has proposed threat detection methods based on provenance graphs, which leverage entity relationships such as processes, files, and sockets found in host audit logs. However, these methods are generally inefficient, especially when faced with massive audit logs and the computational resource-intensive nature of graph algorithms. Effectively and economically extracting APT attack clues from massive system audit logs remains a significant challenge. To tackle this problem, this paper introduces the ProcSAGE method, which detects threats based on abnormal behavior patterns, offering high accuracy, low cost, and independence from expert knowledge. ProcSAGE focuses on processes or threads in host audit logs during the graph construction phase to effectively control the scale of provenance graphs and reduce performance overhead. Additionally, in the feature extraction phase, ProcSAGE considers information about the processes or threads themselves and their neighboring nodes to accurately characterize them and enhance model accuracy. In order to verify the effectiveness of the ProcSAGE method, this study conducted a comprehensive evaluation on the StreamSpot dataset. The experimental results show that the ProcSAGE method can significantly reduce the time and memory consumption in the threat detection process while improving the accuracy, and the optimization effect becomes more significant as the data size expands.

Abstract Internal network attacks pose a serious security threat to enterprises and organizations, potentially leading to critical information leaks and network system damage. Hosts, as the core data and service bearers, are often primary targets of cyber attacks. Therefore, accurately identifying hosts with malicious behavior in the network is crucial. However, detecting malicious hosts on this intranet presents several challenges. Firstly, the network state is unstructured data that dynamically changes in real-time. Secondly, the large amount of normal traffic in the network drowns out the traces generated by malicious behaviors, leading to the problem of category imbalance. Lastly, the traditional graph neural network model has limitations in processing edge information and is unable to directly learn the information in netflow. To overcome these challenges, this paper proposes a malicious host detection system. The system extracts the Host Communication Graph by time slicing and uses a random undersampling method to balance samples. For malicious host detection, this paper proposes the Relational-Edge Graph Convolutional Network (RE-GCN) model, which can directly aggregate and learn features on edges and use them to accurately classify nodes, compared to other GNN models. Comparative experiments were conducted on various netflow datasets, demonstrating the effectiveness of our approach. Our approach outperformed other common GNN models in detecting malicious hosts.

Internet of Things (IoT) devices operate in an untrusted environment, and blockchain technology can provide a secure distributed collaboration method. However, the widespread distribution of heterogeneous devices in the IoT creates complex information asymmetry issues, leading to inefficient resource allocation. This is especially true when information asymmetry occurs in long-term cooperative relationships, where contract design often faces more complex incentive problems. This article focuses on studying long-term cooperation between IoT devices based on blockchain technology and proposes a solution to information asymmetry in long-term cooperation based on contract theory and reputation mechanism. 1) We design more flexible pricing strategies based on contract theory to attract more devices to become validators and provide different long-term job contracts to overcome information asymmetry issues in the cooperative process. 2) We propose a subjective reliability-linked reputation evaluation mechanism to construct the career of validators, which can constrain unethical behavior and incentivize validators to comply with rules and protect data security in long-term cooperation. Experimental results show that our scheme can improve device willingness to cooperate, overcome information asymmetry in long-term cooperation, improve the efficiency of computing resource allocation, reduce network security risks, achieve long-term trusted cooperation between devices, and provide effective security for the development of the IoT.

In multi-objective evolutionary neural architecture search (NAS), existing predictor-based methods commonly suffer from the rank disorder issue that a candidate high-performance architecture may have a poor ranking compared with the worse architecture in terms of the trained predictor.To alleviate the above issue, we aim to train a Pareto-wise end-to-end ranking classifier to simplify the architecture search process by transforming the complex multi-objective NAS task into a simple classification task. To this end, a classifier-based Pareto evolution approach is proposed, where an online classifier is trained to directly predict the dominance relationship between the candidate and reference architectures. Besides, an adaptive clustering method is designed to select reference architectures for the classifier, and an α-domination assisted approach is developed to address the imbalance issue of positive and negative samples. The proposed approach is compared with a number of state-of-the-art NAS methods on widely-used test datasets, and computation results show that the proposed approach is able to alleviate the rank disorder issue and outperforms other methods. Especially, the proposed method is able to find a set of promising network architectures with different model sizes ranging from 2M to 5M under diverse objectives and constraints.

Feature refinement and feature fusion are two key steps in convolutional neural networks–based salient object detection (SOD). In this article, we investigate how to utilize multiple guidance mechanisms to better refine and fuse extracted multi-level features and propose a novel multi-guidance SOD model dubbed as MGuid-Net. Since boundary information is beneficial for locating and sharpening salient objects, edge features are utilized in our network together with saliency features for SOD. Specifically, a self-guidance module is applied to multi-level saliency features and edge features, respectively, which aims to gradually guide the refinement of lower-level features by higher-level features. After that, a cross-guidance module is devised to mutually refine saliency features and edge features via the complementarity between them. Moreover, to better integrate refined multi-level features, we also present an accumulative guidance module, which exploits multiple high-level features to guide the fusion of different features in a hierarchical manner. Finally, a pixelwise contrast loss function is adopted as an implicit guidance to help our network retain more details in salient objects. Extensive experiments on five benchmark datasets demonstrate our model can identify salient regions of an image more effectively compared to most of state-of-the-art models.

Tensor robust principal component analysis (TRPCA) is an important algorithm for color image denoising by treating the whole image as a tensor and shrinking all singular values equally. In this paper, to improve the denoising performance of TRPCA, we propose a variant of TRPCA model. Specifically, we first introduce a nonconvex TRPCA (N-TRPCA) model which can shrink large singular values more and shrink small singular values less, so that the physical meanings of different singular values can be preserved. To take advantage of the structural redundancy of an image, we further group similar patches as a tensor according to nonlocal prior, and then apply the N-TRPCA model on this tensor. The denoised image can be obtained by aggregating all processed tensors. Experimental results demonstrate the superiority of the proposed denoising method beyond state-of-the-arts.