Pengyun Zhu, Qiheng Sun, Long Wen, Yanbo Wang, Yang Cao, Junxu Liu, Deyi Xiong, Jinfei Liu, Zhibo Wang, Kui Ren. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Personalized federated learning (pFL) has emerged as a promising paradigm for mitigating client heterogeneity in distributed machine learning. In cross-device scenarios, however, the continuous generation of sensitive data by clients introduces severe communication bottlenecks and privacy risks, limiting the effectiveness of existing pFL methods. To ad dress these challenges, we propose Fed-EHP, a novel privacy preserving and communication-efficient framework for hetero geneous pFL. The originality of Fed-EHP lies in its task-specific synergistic integration of three customized components within a unified fog-assisted architecture: 1) Data-aware client clustering at the fog layer to alleviate statistical heterogeneity and reduce communication load; 2) MIFE-based secure aggregation to ensure strong privacy protection against inference attacks while preserving model utility; and 3) Cluster-driven personalized knowledge distillation to effectively address model heterogeneity and boost personalization across devices and fog nodes. To demonstrate privacy guarantee and security of the proposed framework, we provide a formal security analysis. We also con duct extensive experiments on MNIST, Fashion-MNIST, CIFAR 10, and CIFAR-100. Fed-EHP consistently delivers notable im provements in both accuracy and communication efficiency over state-of-the-art pFL methods. These results demonstrate that our integrated and customized framework enables capabilities and performance gains that are unattainable using existing techniques in isolation, establishing Fed-EHP as a practical and reliable solution for real-world heterogeneous federated learning.

Recently, reconstruction-based methods have gained attention for AIGC image detection. These methods leverage pre-trained diffusion models to reconstruct inputs and measure residuals for distinguishing real from fake images. Their key advantage lies in reducing reliance on dataset-specific artifacts and improving generalization under distribution shifts. However, they are limited by significant inefficiency due to multi-step inversion and reconstruction, and their reliance on diffusion backbones further limits generalization to other generative paradigms such as GANs. In this paper, we propose a novel fake image detection framework, called R$^{2}$BD, built upon two key designs: (1) G-LDM, a unified reconstruction model that simulates the generation behaviors of VAEs, GANs, and diffusion models, thereby broadening the detection scope beyond prior diffusion-only approaches; and (2) a residual bias calculation module that distinguishes real and fake images in a single inference step, which is a significant efficiency improvement over existing methods that typically require 20$+$steps. Extensive experiments on the benchmark from 10 public datasets demonstrate that R$^{2}$BD is over 22× faster than existing reconstruction-based methods while achieving superior detection accuracy. In cross-dataset evaluations, it outperforms state-of-the-art methods by an average of 13.87%, showing strong efficiency and generalization across diverse generative methods. The code and dataset used for evaluation are available athttps://github.com/QingyuLiu/RRBD.

Watermarking for diffusion images has drawn considerable attention due to the widespread use of text-to-image diffusion models and the increasing need for their copyright protection. Recently, advanced watermarking techniques, such as Tree-Ring, integrate watermarks by embedding traceable patterns (e.g., Rings) into the latent distribution during the diffusion process. Such methods disrupt the original semantics of the generated images due to the inevitable distribution shift caused by the watermarks, thereby limiting their practicality, particularly in digital art creation. In this work, we present Semantic-aware Pivotal Tuning Watermarks (PT-Mark), a novel invisible watermarking method that preserves both the semantics of diffusion images and the traceability of the watermark. PT-Mark preserves the original semantics of the watermarked image by gradually aligning the generation trajectory with the original (pivotal) trajectory while maintaining the traceable watermarks during whole diffusion denoising process. To achieve this, we first compute the salient regions of the watermark at each diffusion denoising step as a spatial prior to identify areas that can be aligned without disrupting the watermark pattern. Guided by the region, we then introduce an additional pivotal tuning branch that optimizes the null-text embedding to align the semantics while preserving the watermarks. Extensive evaluations demonstrate that PT-Mark can preserve the original semantics of the diffusion images while integrating robust watermarks. It achieves a 10% improvement in the performance of semantic preservation compared to state-of-the-art watermarking methods, while also showing comparable robustness against real-world perturbations and four times greater efficiency. The code is available athttps://github.com/annpion/PT-Mark.

Recently, Large Language Models (LLMs) have been in tegrated into many real-world applications like Code Copilot. These applications have significantly expanded the attack surface of LLMs, ex posing them to complex real-world jailbreak threats. Despite the promising advances in actively finding jailbreak vulnerabilities of LLMs (i.e., red teaming) in general contexts, identifying these threats in complex domain-specific contexts (e.g, mathematical LLMs) remains underexplored. In this paper, we study whether the context these real-world LLM applications work in, including different system prompts, tools, and scenarios of tasks, give rise to context-specific jailbreak threats. Particularly, we adapt general jailbreak prompts to the context of the target application via LLM rewriting to generate context-specific attacks. By measuring the differences in jailbreak responses between general attacks and context-specific attacks, we reveal that customized domain specific LLMs are more vulnerable in their specific context. Motivated by this observation, we propose a context-aware red teaming approach, RedAgent, to generate context-specific jailbreak attacks towards customized LLM applications. Through effectively retrieving and updating structured knowledge in an agent system, RedAgent efficiently perceive and utilize contextual information to adapt the jailbreak prompts to the target contexts. Extensive experiments show that our system can jailbreak most black-box LLMs within just five queries, improving the efficiency of existing red teaming methods by two times. Further, RedAgent can effectively jailbreak customized LLM applications. By generating context-specific jailbreak prompts towards 60 trending applications on the marketplace of OpenAI, we discover 600 vulnerabilities of these real world applications with only two queries per vulnerability.

Multimodal language models (LMs) have shown significant potential for applications across various domains but remain vulnerable to adversarial attacks. Current research in white-box or black-box settings generally struggles with unrealistic attack assumptions and limited efficacy of targeted attacks. This paper introduces CoGA, a novel gray-box collaborative adversarial attack method for multimodal LMs. Under our gray-box settings, attackers have access only to the victim model’s input encoders. With the guidance of different modalities, we perturb the embedding representations from encoders to disrupt the semantic alignment across modalities, ultimately causing inaccurate outputs on various downstream tasks. Specifically, we integrate text embeddings into the loss calculations of the image attack and utilize image embeddings to guide the ranking of vulnerable words and the selection of final samples. Extensive experiments demonstrate that our method achieves superior attack performance across diverse models and tasks, suggesting the shared vulnerability of multimodal LMs in confronting adversarial challenges. Our work provides new insights into the security of multimodal LMs, facilitating the deployment of more robust and secure models in practical applications.

Federated learning (FL) as a distributed machine learning paradigm can be applied to edge intelligence scenarios for collaborative machine learning model building. Unfortunately, existing privacy-preserving FL applied to this scenario still faces three challenges: data heterogeneity, model heterogeneity, and privacy heterogeneity. Despite numerous privacy-preserving FL techniques proposed, they still cannot effectively address these three challenges. To solve this problem, we propose HeteroFed, a heterogeneous privacy-preserving FL framework for edge intelligence. Our HeteroFed contains heterogeneous model construction, dynamic gradient clipping, adaptive noise addition, and deviation-aware model aggregation. Specifically, we first use the heterogeneous model construction mechanism to enable personalized model training for different smart devices. Then, we propose a dynamic gradient clipping mechanism to perform dynamically adjusted gradient clipping on models uploaded by smart devices to limit the magnitude of gradients. Finally, we propose an adaptive noise addition mechanism to customize differential privacy protection for smart device models based on their convergence status. Furthermore, to mitigate the influence of noise perturbations on model performance, we propose a deviation-aware model aggregation mechanism for accurate model aggregation. Theoretical analysis demonstrates that HeteroFed achieves heterogeneous differential privacy. Extensive experiments show that HeteroFed outperforms similar methods, improving global model accuracy by 18%, 15%, 13%, and 18% on the MNIST, Fashion-MNIST, CIFAR-10, and THUCNews datasets, respectively.

Vehicular edge computing (VEC) is a promising technique for handling computation-intensive and delay-sensitive tasks by offloading them to roadside units (RSUs) or base stations (BSs) equipped with edge computing servers. However, the uneven spatial-temporal distribution of vehicles causes load imbalances among edge servers. To address this challenge, we propose a two-layer collaborative VEC network paradigm that incorporates offloading modes such as vehicle-to-RSU (V2R), vehicle-to-BS (V2B), and RSU-to-RSU collaboration. Within this framework, task offloading and resource allocation are jointly optimized to maximize system utility, which integrates revenue, delay, and energy consumption, while ensuring that vehicular tasks meet their delay requirements. Given the problem’s complexity and scalability concerns, we introduce a distributed framework and propose the joint task offloading and resource allocation (JTORA) algorithm. This algorithm decomposes the original problem into two sub-problems: task offloading and resource allocation. The task offloading sub-problem is modeled as a potential game and solved using the multi-agent twin delayed deep deterministic policy gradient (MATD3) framework. Based on the offloading decisions, the resource allocation sub-problem is further divided into multiple convex optimization problems. The system utility, derived from task offloading and resource allocation decisions, serves as a reward to iteratively evaluate, train the learning model, and refine the offloading strategy. Theoretical analysis confirms that the JTORA algorithm converges to the Nash equilibrium (NE). Simulations using real traffic data validate the proposed algorithm’s effectiveness and superiority over existing methods. Specifically, the JTORA algorithm improves overall system utility by reducing task processing delays and energy consumption while increasing the task completion rate.

The ubiquity of WiFi infrastructure has motivated significant research into WiFi-based indoor positioning systems as practical alternatives to GNSS. While deep learning approaches show promise, existing models face three critical limitations: (1) inadequate modeling of long-range feature dependencies, (2) difficulty in correcting time-of-flight (ToF) offsets induced by device clock asynchrony, and (3) prohibitive computational costs for environmental adaptation through model retraining. This paper introduces SwinULoc, a novel U-shaped indoor positioning framework that synergizes Swin Transformer blocks with 2D CSI heatmap processing. Our architecture uniquely addresses these challenges through three key innovations: First, the integration of shifted window attention mechanisms enables effective learning of long-range signal correlations. Second, a multi-access-point fusion strategy enhanced with skip connections achieves precise ToF offset correction through cross-device pattern analysis and multi-scale feature integration. Third, a transfer learning paradigm reduces retraining costs by 75% compared to conventional approaches. Extensive evaluations demonstrate SwinULoc's superiority, achieving 70% higher positioning accuracy than state-of-the-art baselines while requiring only 1/4 of the training resources for new environments.

Mobile users can offload their tasks to adjacent edge servers to enhance service quality. These servers require suitable reimbursements to cover the operational and energy consumption costs incurred while assisting with offloaded tasks. Although previous studies have examined market mechanisms for multiple users offloading tasks to multiple servers, most of them have not investigated the market mechanism for splittable task offloading, where tasks can be divided into multiple subtasks and offloaded to multiple servers. In this work, we propose a novel edge computing marketplace that focuses on splittable task offloading in multi-user multi-server scenarios with the aim of maximizing social welfare. Designing such a marketplace presents several challenges. First, the problem of task and computing resource division introduced in this context results in a complex solution space, and the division decisions are interdependent. Second, the users and edge servers have conflicting objectives and hidden utility/cost information. To overcome these challenges and achieve socially optimal market operation, we devise an Iterative DoublE Auction (IDEA) mechanism.IDEAemploys a broker to facilitate the interactions between users and edge servers and induces truthful reporting of hidden information through iterative updates to the allocation and pricing rules. Rigorous theoretical analysis and extensive simulations demonstrate the effectiveness of the proposedIDEAmechanism in achieving optimal social performance.

Language Models (LMs) are prone to ''memorizing'' training data, including substantial sensitive user information. To mitigate privacy risks and safeguard the right to be forgotten, machine unlearning has emerged as a promising approach for enabling LMs to efficiently ''forget'' specific texts. However, despite the good intentions, is textual unlearning really as effective and reliable as expected? To address the concern, we first propose Unlearning Likelihood Ratio Attack+ (U-LiRA+), a rigorous textual unlearning auditing method, and find that unlearned texts can still be detected with very high confidence after unlearning. Further, we conduct an in-depth investigation on the privacy risks of textual unlearning mechanisms in deployment and present the Textual Unlearning Leakage Attack (TULA), along with its variants in both black- and white-box scenarios. We show that textual unlearning mechanisms could instead reveal more about the unlearned texts, exposing them to significant membership inference and data reconstruction risks. Our findings highlight that existing textual unlearning actually gives a false sense of unlearning, underscoring the need for more robust and secure unlearning mechanisms.

Recently, federated learning (FL) has been considered a promising and well-suited technique for edge computing applications, such as intelligent traffic control, autonomous driving, and mobile crowdsensing. However, since each edge device may perform individual-specific tasks, they often have heterogeneous data distributions that impact the performance of collaborative training models. Personalized FL (PFL) has then received considerable attention to tackle this problem. Many existing PFL works often employ knowledge distillation to mitigate the negative effects of data heterogeneity. Nevertheless, these works often neglect the fact that the knowledge transferred from the teacher models is not completely correct, which limits the personalization performance of edge devices. In this work, we leverage the knowledge contained in global features to explore the potential of global models and propose a novel uncertainty-driven feature distillation framework called FedUFD. Specifically, we design an uncertainty estimation module in local models, by estimating the uncertainty of the personalized feature distribution, FedUFD can measure the difficulty of learning different personalized features, and then combine the global features to distill the corresponding personalized features. Extensive experiments show that FedUFD outperforms fourteen state-of-the-art PFL frameworks in edge computing, beating the best-performing traditional and personalized baselines by up to 45.45% and 3.55%, respectively.

In fields like autonomous driving, strict constraints are imposed on the computing latency of deep neural network (DNN) inference tasks on edge servers. However, it is typical for edge servers to execute multiple tasks in parallel to serve multiple users, causing severe latency jitter due to resource competition, which seriously affects timeliness. Existing works ignore the computing jitter and regard computing latency as a deterministic value, failing to meet the timeliness requirement. To address this issue, we propose Malva, a framework for finegrained online pruning for DNN tasks, allowing flexible pruning at runtime based on jitter conditions. Specifically, Malva first partitions the DNN model into blocks and applies early exiting and pruning methods to create block variants. Then, the Malva scheduler flexibly selects the variant to be executed or exits early according to urgency and jitter conditions. Moreover, we propose a novel urgency-aware prediction strategy to estimate the accuracy impact of variants with incomplete pathway information during scheduling. Stress testing shows Malva can strictly maintain a zero deadline miss rate and significantly increase the stress required to cause the first deadline miss while still outperforming state-of-the-art methods in accuracy.

The widespread deployment of large language models (LLMs) allows users to access their capabilities via black-box APIs, but backdoor attacks pose serious security risks for API users by hijacking the model behavior. This highlights the importance of backdoor detection technologies to help users audit LLMs before use. However, most existing LLM backdoor defenses require white-box access or costly reverse engineering, limiting their practicality for resource-constrained users. Moreover, they mainly target classification tasks, leaving broader generative scenarios underexplored. To solve the problem, this paper introduces ICLScan, a lightweight framework that exploits targeted in-context learning (ICL) as illumination for backdoor detection in black-box LLMs, which effectively supports generative tasks without additional training or model modifications. ICLScan is based on our finding of backdoor susceptibility amplification: LLMs with pre-embedded backdoors are highly susceptible to new trigger implantation via ICL. Including only a small ratio of backdoor examples (containing ICL-triggered input and target output) in the ICL prompt can induce ICL trigger-specific malicious behavior in backdoored LLMs. ICLScan leverages this phenomenon to detect backdoored LLMs by statistically analyzing whether the success rate of new trigger injection via targeted ICL exceeds a threshold. It requires only multiple queries to estimate the backdoor success rate, overcoming black-box access and computational resource limitations. Extensive experiments across diverse LLMs and backdoor attacks demonstrate ICLScan's effectiveness and efficiency, achieving near-perfect detection performance (precision/recall/F1-score/ROC-AUC all approaching 1) with minimal additional overhead across all settings.

Abstract Artificial intelligence (AI) is revolutionizing both industries and reshaping the global economy. However, the rapid advancement of AI technologies brings significant security and privacy challenges. Recent incidents highlight vulnerabilities in AI systems, such as data leakage and malicious code injection, leading to severe financial losses and privacy breaches. Although existing studies have discussed specific security threats, they often lack detailed granularity and cover a limited scope. In this survey, we fill this gap by systematically categorizing and analyzing the threats and countermeasures in AI systems, which span both the training and inference stages, encompass centralized and distributed settings, and address both conventional and foundation AI models. By reviewing existing literature, we aim to provide AI researchers and practitioners with a thorough understanding of system vulnerabilities and current countermeasures. We hope to inspire further research into robust solutions, ultimately contributing to the development of resilient AI technologies.

Adversarial training has been widely explored for mitigating attacks against deep models. However, a critical limitation of existing works is that robustness enhancement is at the cost of noticeable accuracy degradation. To achieve a better trade-off between robustness and accuracy, we propose the Vanilla Feature Distillation Adversarial Training (VFDAT), which conducts knowledge distillation from a pre-trained model (optimized towards high accuracy) to guide adversarial training model towards generating high-quality and well-separable features by constraining the obtained features of natural and adversarial examples. More specifically, both adversarial examples and their natural counterparts are forced to be aligned in feature space by distilling predictive representations from a pre-trained natural model. In this way, the adversarial training model can be updated towards maximally preserving the accuracy as gaining robustness. A key advantage of our method is that it can be universally adapted to and boost existing works. Exhaustive experiments on various datasets, classification models, and adversarial training algorithms demonstrate the effectiveness of our proposed method.

Backdoor attacks pose significant security risks to deep neural networks (DNNs). These attacks involve models that make intentionally incorrect (and potentially targeted) predictions on poisoned inputs containing carefully crafted triggers, while operating normally with clean inputs. Prior studies have investigated the invisibility of backdoor triggers to improve attack stealthiness. However, they primarily concentrate on achieving invisibility solely in the spatial domain, ignoring the generation of invisible triggers in the frequency and feature domains. This constraint makes the poisoned images vulnerable to detection by recent defense mechanisms. To tackle this problem, we introduce a Triple stealthy BAckdoor attack approach, termed TriBA, which simultaneously ensures the invisibility of triggers in all the spatial, frequency, and feature domains, to achieve desirable attack performance, while ensuring strong stealthiness. Specifically, we initially utilize Wavelet Transform to embed the high-frequency information from the trigger image into the clean image to ensure effective attack performance. Then, to achieve strong stealthiness across both spatial and frequency domains, we integrate Fourier Transform and Cosine Transform to blend the poisoned image and clean image in the frequency domain. Furthermore, TriBA adopts an attack strategy to make the backdoor features similar to clean features in the feature space, which guarantees trigger invisibility in the feature domain while maintaining attack effectiveness. We theoretically prove the effectiveness of this strategy. Finally, TriBA has been comprehensively evaluated on four datasets against popular image classifiers, demonstrating a marked improvement over existing state-of-the-art backdoor attacks in terms of both attack success rate and stealthiness.

Federated learning (FL) is a distributed machine learning framework that enables multiple clients to collaboratively train models without raw data exchange. Prior studies on FL mainly focus on optimizing learning performance, enhancing privacy preservation, and improving attack resilience. However, little work studies how to mitigate the unfairness of federated trained models while unfair models would make discriminatory decisions toward certain groups or populations (e.g., favoring males over females), leading to serious ethical concerns. Thus, it is crucial to mitigate model unfairness in FL, yet challenging as this requires centralized access to each data point's fairness-sensitive information (e.g., race, gender), which is prohibited in FL. In this work, we propose a novel fair FL framework FedUFA, where the server can aggregate clients’ learned knowledge in an unbiased manner, to obtain fair and high-usability federated trained models. Specifically, to unearth the bias in clients’ local data and account for potentially heterogeneous local models, we propose a knowledge distillation-based FL scheme, where clients’ knowledge of learned features on a public dataset is amalgamated to the server for aggregation. We train an unbiased feature mapper at the server to remove fairness-sensitive latent features and extract fair representations from clients’ submitted raw features. In particular, we design an adversarial training method to train the mapper, which involves apredictoraiming to maximize the prediction accuracy on the FL task and adiscriminatorintending to help identify fairness-sensitive features. Extensive experiments on real-world datasets demonstrate the effectiveness of FedUFA.

Face-swapping DeepFakes have become an escalating societal concern, attracting increasing attention in recent years. To counter this, we investigate a new proactive defense framework to prevent individuals from being victimized in DeepFake videos. The core idea of this framework is to contaminate the inputs of DeepFake models by disrupting face detectors, based on the observation that face detectors are commonly used to automatically extract victim faces in most DeepFake techniques. Once the face detectors malfunction, the faces will not be correctly extracted, thereby impairing the training or synthesis stages of DeepFake models. To achieve this, we describe a strategy named FacePoison, which fools face detectors by adding dedicated adversarial perturbations to video frames. Building upon this, we introduce VideoFacePoison, an extended strategy that can efficiently propagate FacePoison across video frames instead of applying it individually to each frame, thus significantly reducing the computational overhead while retaining favorable attack performance. This framework is validated on five face detectors, and extensive experiments against eleven different DeepFake models demonstrate the effectiveness of disrupting face detectors to hinder DeepFake generation. The source code is publicly available at: https://github.com/OUC-VAS/FacePoison.

Federated learning (FL) is susceptible to poisoning attacks. To defend against such threats, robust aggregation rules (AGRs) are typically deployed on the server to identify or filter clients’ potentially malicious submissions based on statistical similarity. Recently, knowledge distillation (KD) has been widely used in FL to facilitate collaborative learning among clients that have heterogeneous model architectures by aggregating and distilling architecture-independent model outputs (i.e., logits). However, the KD process introduces a novel poisoning attack surface, where adversaries can manipulate local model output logits to ruin the global model performance. To fully reveal and explore such a new security vulnerability and effectively poison the global model in the existence of robust AGRs, in this paper, we propose the first untargeted poisoning attack scheme to KD-based FL under robust AGRs, named ManipulatingKD. It manipulates compromised clients to send well-designed malicious logits during the KD process. To ensure attack effectiveness and stealthiness, ManipulatingKD models attacks as constrained optimization problems. This allows for crafting satisfactory malicious logits that are statistically similar to benign logits but can generate poisoned aggregated logits to provide deviated supervision and mislead the global model. Extensive experiments demonstrate the effectiveness of ManipulatingKD under both non-robust and robust AGRs. Particularly, under robust AGRs, the global model accuracy degradation caused by our attacks can exceed 2× that of state-of-the-art attacks.

Recently, point clouds have been widely used in computer vision, whereas their collection is time-consuming and expensive. As such, point cloud datasets are the valuable intellectual property of their owners and deserve protection. To detect and prevent unauthorized use of these datasets, especially for commercial or open-sourced ones that cannot be sold again or used commercially without permission, we intend to identify whether a suspicious third-party model is trained on our protected dataset under the black-box setting. We achieve this goal by designing ascalableclean-label backdoor-based dataset watermark for point clouds that ensures both effectiveness and stealthiness. Unlike existing clean-label watermark schemes, which were susceptible to the number of categories, our method can watermark samples from all classes instead of only from the target one. Accordingly, it can still preserve high effectiveness even on large-scale datasets with many classes. Specifically, we perturb selected point clouds with non-target categories in both shape-wise and point-wise manners before inserting trigger patterns without changing their labels. The features of perturbed samples are similar to those of benign samples from the target class. As such, models trained on the watermarked dataset will have a distinctive yet stealthy backdoor behavior,$i.e$., misclassifying samples from the target class whenever triggers appear, since the trained DNNs will treat the inserted trigger pattern as a signal to deny predicting the target label. We also design a hypothesis-test-guided dataset ownership verification based on the proposed watermark. Extensive experiments on benchmark datasets are conducted, verifying the effectiveness of our method and its resistance to potential removal methods. The codes are available athttps://github.com/weic0810/PointNCBW.

Adversarial patch attacks pose a significant threat to deep learning models in real-world applications, such as autonomous driving, due to their physical feasibility and ease of deployment. Although several defenses exist, they often have limitations, such as requiring prior knowledge of adversarial patches, being tied to specific model architectures, or struggling to balance robustness with accuracy on clean inputs. In this work, we propose a novel Mask-Reconstruction-assisted Adversarial Training (MRAT) framework to enhance model robustness against adversarial patches while preserving accuracy. To achieve this, we first develop an adversarial example generation method that applies masks comprising randomly positioned square blocks with adversarial perturbations to clean images. This technique generates diverse adversarial examples for training, preventing the model from overfitting to a specific type of adversarial patch. To maintain accuracy on clean inputs while enhancing adversarial robustness, we incorporate a mask-reconstruction task into standard adversarial training paradigms. This task utilizes feature representations extracted from the backbone to reconstruct clean versions of adversarial examples. By jointly optimizing the reconstruction network and the classification model, the feature representations of adversarial examples retain essential features of their original images, leading to robust feature extraction and high classification accuracy. Extensive experimental results in both digital and physical domains demonstrate that MRAT significantly enhances the model’s defensive performance against adversarial patch attacks while maintaining high accuracy on clean inputs. Our code is available at: https://github.com/wanggroupAI/AI_Security/tree/main/Adversarial%20Example/MRAT.

Malware remains a major cybersecurity threat, driving increased adoption of machine learning (ML)-based analysis methods. However, these ML solutions face challenges in producing explainable and human-readable results, limiting their practical deployment. Large language models (LLMs) offer a promising alternative for transparent ML malware analysis through analyzing character-level features. Despite this potential, the redundant nature of binary files and ambiguous reasoning patterns pose fundamental challenges in applying LLMs to malware binary analysis. To address these challenges, we propose Anti-Virus Agent (AV-Agent), a framework based on large language models for malware detection. AV-Agent implements a streamlined feature processing pipeline, including multi-layer hierarchical feature classifiers, character feature extraction, and two-phase reasoning. By capturing critical malware features, AV-Agent leverages frontier LLMs’ inherent knowledge to achieve transparent and effective malware analysis. Experimental results on a representative dataset indicate that AV-Agent attains comparable performance to analogous machine learning methods, while also providing an explainable malware analysis process. Additionally, the experiments analyzed the parameter settings of AV-Agent and characteristics of experimental results, demonstrating that AV-Agent achieved optimal performance under the specified parameter conditions while maintaining sufficient stability in malware classification outcomes. These findings demonstrate that LLMs exhibit tremendous potential in human-like reasoning analysis of malware.

To efficiently execute tasks, computation resource requesters (CRRs) with limited resources can offload their tasks to nearby computation resource providers (CRPs) with spare computing capacity. These CRPs require appropriate incentives to compensate for their incurred costs when helping process the offloaded tasks. Although several mechanisms have been designed to incentivize CRPs, none of them have investigated the incentive mechanism considering price-setting and price-taking CRPs simultaneously. In this work, we propose an incentive framework for task offloading in the edge computing marketplace that includes both price-setting and price-taking CRPs. We model the CRR's interactions with both types of CRPs as a three-stage Stackelberg game to maximize the profit for both the CRR and CRPs. We prove the existence of a unique subgame perfect equilibrium (SPE) of the formulated game and further develop iterative algorithms for the CRR and price-setting CRPs to achieve the equilibrium. Through the designed algorithms, each CRP does not require complete information about the CRR and other CRPs. Extensive simulations demonstrate that offloading tasks to both price-setting and price-taking CRPs achieves higher profits for the CRR and price-setting CRPs compared to offloading tasks solely to price-setting CRPs. Additionally, the obtained SPE can achieve near-optimal social welfare.

Due to the collaborative machine learning nature of Federated Learning (FL), it enables the training of machine learning models on large-scale distributed datasets in edge computing environments. Nevertheless, the application of FL in edge computing still faces three crucial challenges: resource constraint, privacy leakage, and Byzantine failures. Unfortunately, current approaches lack the ability to effectively balance these three challenges. In this paper, we propose FedEdge, a cost-efficient and secure FL for edge computing. FedEdge contains two main mechanisms: adaptive compression perturbation and dynamic update filtering. The adaptive compression perturbation mechanism reduces the communication overhead, provides different levels of privacy protection for edge nodes, and prevents Byzantine attacks. The dynamic update filtering mechanism is used to further filter Byzantine attacks and limit the impact of adaptive compression perturbation on the global model performance. The experimental results on the MNIST, CIFAR-10, CIFAR-100, and CelebA datasets demonstrate the effectiveness of FedEdge against free-riders, label-flipping, and sign-flipping attacks. Theoretical analysis also demonstrate that FedEdge can still converge even when the majority of edge nodes are malicious.

Backdoor attacks pose serious security threats to deep neural networks (DNNs). Backdoored models make arbitrarily (targeted) incorrect predictions on inputs containing well-designed triggers, while behaving normally on clean inputs. Prior researches have explored the invisibility of backdoor triggers to enhance attack stealthiness. However, most of them only focus on the invisibility in the spatial domain, neglecting the generation of invisible triggers in the frequency domain. This limitation renders the generated poisoned images easily detectable by recent defense methods. To address this issue, we propose a DUal stealthy BAckdoor attack method named DUBA, which simultaneously considers the invisibility of triggers in both the spatial and frequency domains, to achieve desirable attack performance, while ensuring strong stealthiness. Specifically, we first use Wavelet Transform to embed the high-frequency information of the trigger image into the clean image to ensure attack effectiveness. Then, to attain strong stealthiness, we incorporate Fourier Transform and Cosine Transform to mix the poisoned image and clean image in the frequency domain. Moreover, DUBA adopts a novel attack strategy, training the model with weak triggers and attacking with strong triggers to further enhance attack performance and stealthiness. DUBA is evaluated extensively on four datasets against popular image classifiers, showing significant superiority over state-of-the-art backdoor attacks in attack success rate and stealthiness.

Large Language Models (LLMs) have shown impressive performance in natural language tasks, but their outputs can exhibit undesirable attributes or biases. Existing methods for steering LLMs toward desired attributes often assume unbiased representations and rely solely on steering prompts. However, the representations learned from pre-training can introduce semantic biases that influence the steering process, leading to suboptimal results. We propose LLMGuardrail, a novel framework that incorporates causal analysis and adversarial learning to obtain unbiased steering representations in LLMs. LLMGuardrail systematically identifies and blocks the confounding effects of biases, enabling the extraction of unbiased steering representations. Experiments demonstrate LLMGuardrail's effectiveness in steering LLMs toward desired attributes while mitigating biases. Our work contributes to developing safe and reliable LLMs that align with desired attributes.

Despite the promising advances in deepfake detection on current datasets, detecting visual deepfakes in real-world scenarios (e.g., deepfake videos and live streaming on YouTube) remains a challenge due to the inherent quality degradation such as unpredictable compression employed by social media platforms. Such degradation perturbs discernible forgery clues and diminishes the effectiveness of deepfake detection methods, raising a critical safety concern to the misuse of forgery faces in real-world scenarios. In this paper, we aim to understand the impacts of real-world degradation on the robustness of deepfake detection. Particularly, we investigate the risk of degraded deepfakes towards their detection on two real-world scenarios (i.e., deepfake videos and deepfake live streaming on social media platforms). By measuring the effects of real-world degradations on the performance and representation capabilities of detection models, we reveal that real-world deepfakes can be simulated via common degradation operations (e.g., JPEG compression) as they are perceptually similar to deepfake detectors. By analyzing the training dynamics under different sequences of training samples, we observe that the training order of deepfakes progressing from non-degraded (easy) to heavily degraded (hard) enhances the adaptability of detection models to various degradation in real-world scenarios. Drawing from these observations, we present a novel deepfake detection method ProFake to enhance the robustness of deepfake detection against real-world quality degradations. ProFake enables quality-adaptive learning via progressively degrade, detect and assign weights for the training samples driven by the feedback of model performance and image quality, which ensures that our model gradually focuses on more challenging samples to achieve quality-adaptive deepfake detection. Extensive experiments show that compared with existing methods, ProFake improves deepfake detection accuracy by an average of over 10 % in real-world scenarios and by an average of over 30 % in heavily degraded scenarios, while maintaining comparable performance in detecting high-quality deepfakes.

Decentralized federated learning (DFL) facilitates collaborative model training across multiple connected clients without a central coordination server, thereby avoiding the single point of failure in traditional centralized federated learning (CFL). However, DFL exhibits increased susceptibility to Byzantine attacks owing to the lack of a responsible central server. Furthermore, a benign client in DFL may be dominated by Byzantine clients (more than half of its neighbors are malicious), posing significant challenges for robust model training. In this work, we propose DFL-Dual, a novel Byzantine-robust DFL method through dual-domain client clustering and trust bootstrapping. Specifically, we first propose to leverage both data-domain and model-domain distance metrics to identify client discrepancies. Then, we design a trust evaluation mechanism centered on benign clients, which enables them to evaluate their neighbors. Building upon the dual-domain distance metric and trust evaluation mechanism, we further develop a two-stage clustering and trust bootstrapping technique to exclude Byzantine clients from local model aggregation. We extensively evaluate the proposed DFL-Dual method through rigorous experimentation, demonstrating its remarkable performance superiority over existing robust CFL and DFL schemes.

Federated Learning (FL) exhibits privacy vulnerabilities under gradient inversion attacks (GIAs), which can extract private information from individual gradients. To enhance privacy, FL incorporates Secure Aggregation (SA) to prevent the server from obtaining individual gradients, thus effectively resisting GIAs. In this paper, we propose a stealthy label inference attack to bypass SA and recover individual clients’ private labels. Specifically, we conduct a theoretical analysis of label inference from the aggregated gradients that are exclusively obtained after implementing SA. The analysis results reveal that the inputs (embeddings) and outputs (logits) of the final fully connected layer (FCL) contribute to gradient disaggregation and label restoration. To preset the embeddings and logits of FCL, we craft a fishing model by solely modifying the parameters of a single batch normalization (BN) layer in the original model. Distributing client-specific fishing models, the server can derive the individual gradients regarding the bias of FCL by resolving a linear system with expected embeddings and the aggregated gradients as coefficients. Then the labels of each client can be precisely computed based on preset logits and gradients of FCL’s bias. Extensive experiments show that our attack achieves large-scale label recovery with 100% accuracy on various datasets and model architectures.

Federated learning (FL) is widely used in edge environments as a privacy-preserving collaborative learning paradigm. However, edge devices often have heterogeneous computation capabilities and data distributions, hampering the efficiency of co-training. Existing works develop staleness-aware semi-asynchronous FL that reduces the contribution of slow devices to the global model to mitigate their negative impacts. But this makes data on slow devices unable to be fully leveraged in global model updating, exacerbating the effects of data heterogeneity. In this paper, to cope with both system and data heterogeneity, we propose a clustering and two-stage aggregation-based Efficient Asynchronous Federated Learning (EAFL) framework, which can achieve better learning performance with higher efficiency in heterogeneous edge environments. In EAFL, we first propose a gradient similarity-based dynamic clustering mechanism to cluster devices with similar system and data characteristics together dynamically during the training process. Then, we develop a novel two-stage aggregation strategy consisting of staleness-aware semi-asynchronous intra-cluster aggregation and data size-aware synchronous inter-cluster aggregation to efficiently and comprehensively aggregate training updates across heterogeneous clusters. With that, the negative impacts of slow devices and Non-IID data can be simultaneously alleviated, thus achieving efficient collaborative learning. Extensive experiments demonstrate that EAFL is superior to state-of-the-art methods.

The proliferation of machine learning (ML) applications has given rise to a new and popular data marketplace paradigm. These marketplaces facilitate ML model requesters in obtaining data from data owners to train their desired models. To mitigate the privacy concerns of data owners, federated learning (FL) has been introduced, enabling collaborative model training without raw data trading. Furthermore, researchers have incorporated differential privacy (DP) techniques into FL, resulting in differentially private federated learning (DPFL) to enhance privacy preservation. However, existing designs of DPFL-based data marketplaces consider a simplified but unrealistic scenario where the model requester holds dominant market power, and data owners cannot set their own prices. In this work, we propose a novel DPFL-based data marketplace that accommodates both price-taking and price-setting data owners. We model the interactions among the model requester and these two types of data owners as a three-stage Stackelberg game, focusing on maximizing the model requester's profit. We rigorously establish that the formulated game is a convex game with a unique subgame perfect equilibrium. Moreover, we devise iterative algorithms to determine the equilibrium strategies for the model requester and price-setting data owners. Notably, our algorithms allow data owners to operate without requiring complete information about the model requester or other data owners. Numerical experiments demonstrate the superiority of our proposed three-stage framework in terms of the model requester's profitability compared to scenarios where only price-taking data owners are involved. Furthermore, we reveal that price competition among price-setting data owners reduces equilibrium market prices.

With AI systems widely deployed in societal applications, the fairness of these models is of increasing concern, for instance, hiring systems should recommend applicants impartially from different demographic groups, and risk assessment systems must eliminate racial inequity in the criminal justice system. Therefore, ensuring fairness in these models is crucial. In this paper, we propose Task-Free Fairness-Aware Adversarial Perturbation (TF-FAAP), a flexible approach for improving the fairness of black-box deployed models by adding perturbations on input samples that blind their fairness-related attribute information without modifying the model's parameters or structures. The proposed TF-FAAP consists of a discriminator and a generator to create universal fairness-aware perturbations for a variety of tasks. The former aims to distinguish fairnessrelated attributes, and the latter generates perturbations to make the discriminator's prediction distribution of fairness-related attributes uniform. To preserve the utility of perturbed samples, we maximize the mutual information between their representations and corresponding original samples, retaining more original samples' information. In addition, the perturbation generated by TF-FAAP has a high transferability, i.e., the perturbations learned on one dataset can also alleviate the unfairness of a model trained on a different dataset. The extensive experimental evaluation demonstrated the effectiveness and superior performance of our method.

Deep unsupervised domain adaptation (UDA) has significantly boosted the performance of deep models on different domains by transferring knowledge from a source domain to a target domain. However, its robustness against adversarial attacks has not been explored due to the challenges of highly non-convex deep models and different data distribution. In this paper, we give the first attempt to analyze the vulnerability of deep UDA and propose a label-free poisoning attack (LFPA), which injects poisoning data into the training data to mislead adaptation between the two domains without ground truth in target domain. Specifically, we design an unsupervised adversarial loss as the attack goal, in which the pseudo-labels are used to approximate the ground-truth. Since retraining the model will gradually degrade the attack performance, we also add a regularization term to the unsupervised loss, which eliminates negative interactions between the training goal and the attack goal. To accelerate the craft of poisons, we select influential samples as the initial poisons and propose a fast reverse-mode optimization method which updates poisons according to the approximate truncated gradients. Experimental results on multiple state-of-the-art deep UDA methods demonstrate the effectiveness of the proposed LFPA and the high sensitivity of UDA to poisoning attacks.

Swift advancements in large language model (LLM) technologies lead to widespread research and applications, particularly in integrating LLMs with auxiliary tools, known as tool-using LLM agents. However, amid user interactions, the transmission of private information to both LLMs and tools poses considerable privacy risks to users. In this paper, we delve into current privacy-preserving solutions for LLMs and outline three pivotal challenges for tool-using LLM agents: generalization to both open-source and closed-source LLMs and tools, compliance with privacy requirements, and applicability to unrestricted tasks. To tackle these challenges, we present PrivacyAsst, the first privacy-preserving framework tailored for tool-using LLM agents, encompassing two solutions for different application scenarios. First, we incorporate a homomorphic encryption scheme to ensure computational security guarantees for users as a safeguard against both open-source and closed-source LLMs and tools. Moreover, we propose a shuffling-based solution to broaden the framework's applicability to unrestricted tasks. This solution employs an attribute-based forgery generative model and an attribute shuffling mechanism to craft privacy-preserving requests, effectively concealing individual inputs. Additionally, we introduce an innovative privacy concept,$t$-closeness in image data, for privacy compliance within this solution. Finally, we implement PrivacyAsst, accompanied by two case studies, demonstrating its effectiveness in advancing privacy-preserving artificial intelligence.

The increasing prevalence of deep neural networks (DNNs) in industrial artificial intelligence systems (IAISs) promotes the development of industrial automation. However, the growing employment of DNNs also exposes them to various attacks. Recent studies have shown that the data preprocessing process of DNNs is vulnerable to image-scaling attack. Such attacks can craft an attack image, which looks like a given source image but becomes a different target image after being scaled to the target size. The attack images generated by existing image-scaling attacks are easily perceivable to the human visual system, significantly degrading the attack's stealthiness. In this paper, we investigate image-scaling attack from the perspective of signal processing. We unearth that the root cause of the weak deceiving effects of existing image-scaling attack images lies in the introduction of additional high-frequency signals during their construction. Thus, we propose an enhanced image-scaling attack (EIS), which employs adversarial images crafted based on the source (“clean”) images as the target images. Those adversarial images preserve the “clean” pixel information of source images, thereby significantly mitigating the emergence of additional high-frequency signals in the attack images. Specifically, we consider three realistic threat models covering deep models' training and inference phases. Correspondingly, we design three strategies tailored to generate adversarial images with vicious patterns. These patterns are subsequently integrated into the attack images, which can mislead a model with target input size after the necessary scaling operation. Extensive experiments validate the superior performance of the proposed image-scaling attack compared to the original one.

Federated Learning (FL) is susceptible to the gradient leakage attack (GLA), which can recover local private training data from the shared gradients or model updates. To ensure privacy, differential privacy is applied in FL by clipping and adding noise to local gradients (i.e., Local Differential Privacy (LDP)) or the global model update (i.e., Central Differential Privacy (CDP)). However, the effectiveness of DP in defending GLAs needs to be thoroughly investigated since some works briefly verify that DP can guard FL against GLAs while others question its defense capability. In this paper, we empirically evaluate CDP and LDP on the resistance of GLAs, and pay close attention to the trade-offs between privacy and utility in FL. Our findings reveal that: 1) existing GLAs can be defended by CDP using a per-layer clipping strategy and LDP with a reasonable privacy guarantee and 2) both CDP and LDP ensure the trade-off between privacy and utility in training shallow model, but cannot guarantee this trade-off in deeper model training (e.g., ResNets). Triggered by the crucial role of clipping operation for DP, we propose an improved attack that incorporates the clipping operation into existing GLAs without requiring additional information. The experimental results show our attack can destruct the protection of CDP and weaken the effectiveness of LDP. Overall, our work validates the effectiveness as well as reveals the vulnerability of DP under GLAs. We hope this work can provide guidance on utilizing DP for defending against GLA in FL and inspire the design of future privacy-preserving FL.

The significance of RFID-based information collection is becoming increasingly visible as more and more sensor-augmented RFID systems are deployed. Tag information collection aims at efficiently and accurately collecting valuable information from target objects attached with RFID tags. Polling-based information collection can effectively avoid response collisions between RFID tags, and it is widely adopted to accurately inventory tags. However, in the traditional polling mode, a polling vector can only be used to query a tag at a time, which is inefficient. In this paper, we design a double polling mode to improve the utilization of polling vectors, which can simultaneously interrogate a pair of tags. Afterwards, several techniques are developed to reduce the polling vector length. Firstly, the Basic Double Polling-based protocol (BDP) employs double indexes to collect information, which greatly reduces the number of polling vectors. Secondly, the Segmented Double Polling-based protocol (SDP) divides the double indexes into several segments to cut the polling vector length down. Thirdly, the Partial Double Polling-based protocol (PDP) replaces the double index with the size of the empty segment between two adjacent non-zero indexes to further reduce the average polling vector length. Finally, the Differential Double Polling-based protocol (DDP) utilizes the size of the empty segment between two double indexes to improve the utilization of polling vectors. After that, extensive theoretical analyses and simulations are conducted, which demonstrate the feasibility and effectiveness of the proposed protocols.

In mobile edge computing (MEC), users can offload tasks to nearby MEC servers to reduce computation cost. Considering that the size of offloaded tasks could disclose user location information, several location privacy-preserving task offloading mechanisms have been proposed under the single-server scenario. However, to the best of our knowledge, none of them could provide a strict privacy protection guarantee or be applicable to the multi-server scenario where the user's location can be inferred more accurately if servers collude with each other. In this paper, we propose a novel location privacy-aware task offloading framework (LPA-Offload) for both single-server and multi-server scenarios, which provides strict and provable location privacy protection while achieving efficient task offloading. Specifically, we propose a location perturbation mechanism that allows each user to perturb its real location within a rational perturbation region and provides a differential privacy guarantee. To make a satisfactory offloading strategy, we propose a perturbation region determination mechanism and an offloading strategy generation mechanism that adaptively select a proper perturbation region according to the customized privacy factor, and then generate an optimal offloading strategy based on the perturbed location within the decided region. The determination of the perturbation region could achieve personalized privacy requirements while reducing computation cost. LPA-Offload is proved to satisfy$(\epsilon,\delta)$-differential privacy, and the experiments demonstrate the effectiveness of our framework.

With the widespread application of 5G and the Internet of things (IoT), edge computing and cloud computing have been collaboratively utilized for task offloading and processing. However, though the massive devices (e.g., smartphones) are organized into multi-cells, most of the existing works do not explore the computation offloading for edge-cloud computing under inter-cell interference. Thus, the offloading decisions may be inappropriate as the transmission rate is overestimated. To address this issue, we propose COMEC, a novel Computation Offloading scheme in Multi-cell networks with Edge-Cloud collaboration, which could minimize the total cost in terms of delay and energy consumption. Specifically, we first formulate COMEC as an optimization problem taking into account inter-cell interference. Then, considering the offloading decisions of all users are coupled, a non-cooperative game is formulated to minimize the total cost of each user in a distributed manner. We prove that this game is a general (ordinal) potential game and possesses a pure strategy Nash equilibrium (NE). Based on the finite improvement property of the potential game, we develop the corresponding computation offloading algorithm to achieve the NE. Finally, simulation results show that the proposed scheme can achieve superior performance in overall system cost compared with other baselines.

Privacy-preserving federated learning, as one of the privacy-preserving computation techniques, is a promising distributed and privacy-preserving machine learning (ML) approach for Internet of Medical Things (IoMT), due to its ability to train a regression model without collecting raw data of data owners (DOs). However, traditional interactive federated regression training (IFRT) schemes rely on multiple rounds of communication to train a global model and are still under various privacy and security threats. To overcome these problems, several noninteractive federated regression training (NFRT) schemes have been proposed and applied in a variety of scenarios. However, there are still several challenges: 1) how to protect the privacy of DOs' local dataset; 2) how to realize highly scalable regression training without linear dependence on sample dimension; 3) how to tolerate DOs' dropout; and 4) how to enable DOs to verify the correctness of aggregated results returned from the cloud service provider (CSP). In this article, we propose two practical noninteractive federated learning schemes with privacy-preserving for IoMT, named homomorphic encryption based NFRT (HE-NFRT) and double-masking protocol based NFRT (Mask-NFRT), respectively, which are based on a comprehensive consideration of NFRT, privacy concerns, high-efficiency, robustness, and verification mechanism. The security analyses display that our proposed schemes are able to protect the privacy of DOs' local training data, resist collusion attack, and support strong verification to each DO. The performance evaluation results demonstrate that our proposed HE-NFRT scheme is desirable for a high-dimensional and high-security IoMT application while Mask-NFRT scheme is desirable for a high-dimensional and large-scale IoMT application.

Federated learning (FL) requires frequent uploading and updating of model parameters, which is naturally vulnerable to gradient leakage attacks (GLAs) that reconstruct private training data through gradients. Although some works incorporate differential privacy (DP) into FL to mitigate such privacy issues, their performance is not satisfactory since they did not notice that GLA incurs heterogeneous risks of privacy leakage (RoPL) with respect to gradients from different communication rounds and clients. In this paper, we propose an Adaptive Privacy-Preserving Federated Learning (Adp-PPFL) framework to achieve satisfactory privacy protection against GLA, while ensuring good performance in terms of model accuracy and convergence speed. Specifically, a leakage risk-aware privacy decomposition mechanism is proposed to provide adaptive privacy protection to different communication rounds and clients by dynamically allocating the privacy budget according to the quantified RoPL. In particular, we exploratively design a round-level and a client-level RoPL quantification method to measure the possible risks of GLA breaking privacy from gradients in different communication rounds and clients respectively, which only employ the limited information in general FL settings. Furthermore, to improve the FL model training performance (i.e., convergence speed and global model accuracy), we propose an adaptive privacy-preserving local training mechanism that dynamically clips the gradients and decays the noises added to the clipped gradients during the local training process. Extensive experiments show that our framework outperforms the existing differentially private FL schemes on model accuracy, convergence, and attack resistance.

Face recognition service providers protect face privacy by extracting compact and discriminative facial features (representations) from images, and storing the facial features for real-time recognition. However, such features can still be exploited to recover the appearance of the original face by building a reconstruction network. Although sev-eral privacy-preserving methods have been proposed, the enhancement offace privacy protection is at the expense of accuracy degradation. In this paper, we propose an adver-sarial features-based face privacy protection (AdvFace) approach to generate privacy-preserving adversarial features, which can disrupt the mapping from adversarial features to facial images to defend against reconstruction attacks. To this end, we design a shadow model which simulates the attackers' behavior to capture the mapping function from facial features to images and generate adversarial la-tent noise to disrupt the mapping. The adversarial features rather than the original features are stored in the server's database to prevent leaked features from exposing facial information. Moreover, the AdvFace requires no changes to the face recognition network and can be implemented as a privacy-enhancing plugin in deployed face recognition systems. Extensive experimental results demonstrate that Adv Face outperforms the state-of-the-art face privacy-preserving methods in defending against reconstruction at-tacks while maintaining face recognition accuracy.

Transferability of adversarial examples is critical for black-box deep learning model attacks. While most existing studies focus on enhancing the transferability of untargeted adversarial attacks, few of them studied how to generate transferable targeted adversarial examples that can mislead models into predicting a specific class. Moreover, existing transferable targeted adversarial attacks usually fail to sufficiently characterize the target class distribution, thus suffering from limited transferability. In this paper, we propose the Transferable Targeted Adversarial Attack (TTAA), which can capture the distribution information of the target class from both label-wise and feature-wise perspectives, to generate highly transferable targeted adversarial examples. To this end, we design a generative adversarial training framework consisting of a generator to produce targeted adversarial examples, and feature-label dual discriminators to distinguish the generated adversarial examples from the target class images. Specifically, we design the label discriminator to guide the adversarial examples to learn label-related distribution information about the target class. Meanwhile, we design a feature discriminator, which extracts the feature-wise information with strong cross-model consistency, to enable the adversarial examples to learn the transferable distribution information. Furthermore, we introduce the random perturbation dropping to further enhance the transferability by augmenting the diversity of adversarial examples used in the training process. Experiments demonstrate that our method achieves excellent performance on the transferability of targeted adversarial examples. The targeted fooling rate reaches 95.13% when transferred from VGG-19 to DenseNet-121, which significantly outperforms the state-of-the-art methods.

Explaining deep models in a human-understandable way has been explored by many works that mostly explain why an input causes a corresponding prediction (i.e., Why P?). However, seldom they could handle those more complex causal questions like "Why P rather than Q?" and "Why one is P, while another is Q?", which would better help humans understand the behavior of deep models. Considering the insufficient study on such complex causal questions, we make the first attempt to explain different causal questions by contrastive explanations in a unified framework, i.e., Counterfactual Contrastive Explanation (CCE), which visually and intuitively explains the aforementioned questions via a novel positive-negative saliency-based explanation scheme. More specifically, we propose a content-aware counterfactual perturbing algorithm to stimulate contrastive examples, from which a pair of positive and negative saliency maps could be derived to contrastively explain why P (positive class) rather than Q (negative class). Beyond existing works, our counterfactual perturbation meets the principles of validity, sparsity, and data distribution closeness at the same time. In addition, by slightly adjusting the objective of perturbation, our framework can adapt to different causal questions. Extensive experimental evaluation demonstrates the effectiveness and superior performance of the proposed CCE on different benchmark metrics for interpretability, including Sanity Check, Class Deviation Score and Insertion-Deletion tests. A user study is conducted and the results show that user confidence is increasing significantly when presented with CCE compared to standard saliency map baselines.

Network pruning aims to compress models while minimizing loss in accuracy. With the increasing focus on bias in AI systems, the bias inheriting or even magnification nature of traditional network pruning methods has raised a new perspective towards fairness-aware network pruning. Straightforward pruning plus debias methods and recent designs for monitoring disparities of demographic attributes during pruning have endeavored to enhance fairness in pruning. However, neither simple assembling of two tasks nor specifically designed pruning strategies could achieve the optimal trade-off among pruning ratio, accuracy, and fairness. This paper proposes an end-to-end learnable framework for fairness-aware network pruning, which optimizes both pruning and debias tasks jointly by adversarial training against those final evaluation metrics like accuracy for pruning, and disparate impact (DI) and equalized odds (DEO) for fairness. In other words, our fairness-aware adversarial pruning method would learn to prune without any handcraft rules. Therefore, our approach could flexibly adapt to variate network structures. Exhaustive experimentation demonstrates the generalization capacity of our approach, as well as superior performance on pruning and debias simultaneously. To highlight, the proposed method could preserve the SOTA pruning performance while significantly improving fairness by around 50% as compared to traditional pruning methods.

Action recognition has long been a fundamental and intriguing problem in artificial intelligence. The task is challenging due to the high dimensionality nature of an action, as well as the subtle motion details to be considered. Current state-of-the-art approaches typically learn from articulated motion sequences in the straightforward 3D Euclidean space. However, the vanilla Euclidean space is not efficient for modeling important motion characteristics such as the joint-wise angular acceleration, which reveals the driving force behind the motion. Moreover, current methods typically attend to each channel equally and lack theoretical constrains on extracting task-relevant features from the input. In this paper, we seek to tackle these challenges from three aspects: (1) We propose to incorporate an acceleration representation, explicitly modeling the higher-order variations in motion. (2) We introduce a novel Stream-GCN network equipped with multi-stream components and channel attention, where different representations (i.e., streams) supplement each other towards a more precise action recognition while attention capitalizes on those important channels. (3) We explore feature-level supervision for maximizing the extraction of task-relevant information and formulate this into a mutual information loss. Empirically, our approach sets the new state-of-the-art performance on three benchmark datasets, NTU RGB+D, NTU RGB+D 120, and NW-UCLA.

Face recognition has made significant advances with the development of deep learning and has begun to be deployed in some unrestricted scenarios. Many smartphones, for example, have infrared sensors that allow them to capture clear images even in low-light conditions. Face authentication under complex environmental conditions can thus be accomplished by matching NIR-VIS face images across modalities. However, existing NIR-VIS datasets lack enough variation in face attributes and are insufficient for real-world scenarios. To address the aforementioned issues, we first propose a 300-person NIR-VIS cross-modality face dataset with a variety of attributes. Based on modal information removal, we proposed a NIR-VIS cross-modal face recognition model. We can effectively extract modal information by constraining the similarity distribution of modalities and then using the orthogonal loss to remove modal information from identity features. The method achieves excellent results on our dataset and CASIA NIR-VIS 2.0 dataset.

The malicious use and widespread dissemination of deepfake pose a significant crisis of trust. Current deepfake detection models can generally recognize forgery images by training on a large dataset. However, the accuracy of detection models degrades significantly on images generated by new deepfake methods due to the difference in data distribution. To tackle this issue, we present a novel incremental learning framework that improves the generalization of deepfake detection models by continual learning from a small number of new samples. To cope with different data distributions, we propose to learn a domain-invariant representation based on supervised contrastive learning, preventing overfit to the insufficient new data. To mitigate catastrophic forgetting, we regularize our model in both feature-level and label-level based on a multi-perspective knowledge distillation approach. Finally, we propose to select both central and hard representative samples to update the replay set, which is beneficial for both domain-invariant representation learning and rehearsal-based knowledge preserving. We conduct extensive experiments on four benchmark datasets, obtaining the new state-of-the-art average forgetting rate of 7.01 and average accuracy of 85.49 on FF++, DFDC-P, DFD, and CDF2. Our code is released at \textcolorblue https://github.com/DeepFakeIL/DFIL.

Deepfake has taken the world by storm, triggering a trust crisis. Current deepfake detection methods are typically inadequate in generalizability, with a tendency to overfit to image contents such as the background, which are frequently occurring but relatively unimportant in the training dataset. Furthermore, current methods heavily rely on a few dominant forgery regions and may ignore other equally important regions, leading to inadequate uncovering of forgery cues.

A privacy policy serves as an online internet protocol crafted by service providers, which details how service providers collect, process, store, manage, and use personal information when users engage with applications. However, these privacy policies are often filled with technobabble and legalese, making them "incomprehensible''. As a result, users often agree to all terms unknowingly, even some terms may conflict with the law, thereby posing a considerable risk to personal privacy information. One potential solution to alleviate this challenge is to automatically summarize privacy policies using NLP techniques. However, existing techniques primarily focus on extracting key sentences, resulting in comparatively shorter agreements, but failing to address the poor readability caused by the "incomprehensible'' of technobabble and legalese. Moreover, research on Chinese application privacy policy summarization is currently almost nonexistent, and there is a lack of a high-quality corpus suitable for addressing readability issues. To tackle these challenges, we introduce a fine-grained CAPP-130 corpus and a TCSI-pp framework. CAPP-130 contains 130 Chinese privacy policies from popular applications that have been carefully annotated and interpreted by legal experts, resulting in 52,489 annotations and 20,555 rewritten sentences. TCSI-pp first extracts sentences related to the topic specified by users and then uses a generative model to rewrite the sentences into comprehensible summarization. Built upon TSCI-pp, we construct a summarization tool TSCI-pp-zh by selecting RoBERTa from six classification models for sentence extraction and selecting mT5 from five generative models for sentence rewriting. Experimental results show that TCSI-pp-zh outperforms GPT-4 and other baselines in Chinese application privacy policy summarization, demonstrating exceptional readability and reliability. Our data, annotation guidelines, benchmark models, and source code are publicly available at https://github.com/EnlightenedAI/CAPP-130.

With the rich sensing ability and extensive usage of various sensors, mobile crowdsensing (MCS) has become a new paradigm to collect sensing data for various sensing applications. In the modern urban environment, the multisource sensing information and the difference of mobile users make the sensing scenario more and more complex. To improve the applicability of different sensing scenarios, it is necessary to design a heterogeneous user recruitment mechanism for multiple heterogeneous tasks. However, most of the prior works focus on the recruitment of single-type users for homogeneous tasks without considering the heterogeneity of tasks (e.g., spatiotemporal characteristics, sensor requirements, etc.) and users (e.g., personal preferences, carrying sensors, etc). In this article, we propose the problem of heterogeneous user recruitment of multiple heterogeneous tasks (HURoTs) in MCS, with the goal of minimizing the total platform payment and maximizing the task coverage ratio. The HURoT problem is proved to be NP-hard, which is divided into multiple subproblems in different sensing cycles. Moreover, by introducing the user’s utility function, we propose three greedy-based user recruitment algorithms to obtain near-optimal solutions. Extensive experiments are conducted to validate the effectiveness of the proposed schemes.

Privacy protection and incentive mechanism are two fundamental problems in federated learning (FL), which aim at protecting the privacy of data owners and stimulating them to share more resources, respectively. Recent works have proposed differential privacy (DP) based privacy-preserving incentive mechanisms to solve both problems simultaneously. However, almost all of them took the privacy level as the only incentive item, without considering other factors, such as data quantity and quality. Moreover, an untrusted server can further infer sensitive information from the bids that reflect the true costs of data owners. To solve these problems, in this paper, we propose a dual-privacy preserving and quality-aware incentive mechanism, PrivAim, for federated learning. Specifically, it utilizes differential privacy to protect the local models and true costs against the untrusted parameter server, and carefully designs a multi-dimensional reverse auction mechanism to incentivize data owners with high quality and low cost to participate in FL without knowing the true bids. We theoretically prove that PrivAim satisfies$\Delta b$-truthfulness, individual rational, computational efficiency, and differential privacy. Extensive experiments show that PrivAim can effectively protect bid privacy, and achieve at least 21% and 6% improvement on social welfare and model accuracy, respectively, compared to the state-of-the-art.

Heterogeneous model aggregation (HMA) is an effective paradigm that integrates on-device trained models heterogeneous in architecture and target task into a comprehensive model. Recent works adopt knowledge distillation to amalgamate the knowledge of learned features and predictions from heterogeneous on-device models to realize HMA. However, most of them ignore that the disclosure of learned features exposes on-device models to privacy attacks. Moreover, the aggregated model may suffer from the imbalanced supervision caused by the uneven distribution of amalgamated knowledge about each class and show class bias. In this article, to address these issues, we propose a response-based class-balanced heterogeneous model aggregation mechanism, called CBHMA. It can effectively achieve HMA in a privacy-preserving manner and alleviate class bias in the aggregated model. Specifically, CBHMA aggregates on-device models by using only their response information to reduce their privacy leakage risk. To mitigate the impact of imbalanced supervision, CBHMA quantitatively measures the imbalanced supervision level for each class. Based on that, CBHMA customizes fine-grained misclassification costs for each class and utilizes such costs to adjust the importance of each class (more importance to classes with weaker supervision) in the response-based HMA algorithm. Extensive experiments on two real-world datasets demonstrate the effectiveness of CBHMA.

Federated learning (FL) has emerged as an ideal privacy-preserving learning technique which can train a global model in a collaborative way while preserving the private data in the local. However, recent advances have demonstrated that FL is still vulnerable to inference attacks, such as reconstruction attack and membership inference. Among these attacks, the property inference attack, aiming to infer properties of the training data that are irrelevant with the learning objective, has not received too much attention while resulting in severe privacy leakage. Existing property inference attack approaches either cannot achieve satisfactory performance when the global model has converged or under dynamic FL where participants can drop in and drop out freely. In this paper, we propose a novel poisoning-assisted property inference attack (PAPI-attack) against FL. The key insight is that there exists underlying discriminative ability in the periodic model updates, which reflects the change of the data distribution, especially the occurrence of the sensitive property. Thus, a binary attack model can be constructed by a malicious participant for inferring the unintended information. More importantly, we present a property-specific poisoning mechanism by modifying the label of training data from the adversary to distort the decision boundary of shared (global) model in FL. Consequently, benign participants are induced to disclose more information about the sensitive property. Extensive experiments on real-world datasets demonstrate that PAPI-attack outperforms the state-of-the-art property inference attacks against FL.

Deep neural networks (DNNs) have achieved remarkable success in various tasks (e.g., image classification, speech recognition, and natural language processing (NLP)). However, researchers have demonstrated that DNN-based models are vulnerable to adversarial examples, which cause erroneous predictions by adding imperceptible perturbations into legitimate inputs. Recently, studies have revealed adversarial examples in the text domain, which could effectively evade various DNN-based text analyzers and further bring the threats of the proliferation of disinformation. In this paper, we give a comprehensive survey on the existing studies of adversarial techniques for generating adversarial texts written by both English and Chinese characters and the corresponding defense methods. More importantly, we hope that our work could inspire future studies to develop more robust DNN-based text analyzers against known and unknown adversarial techniques. We classify the existing adversarial techniques for crafting adversarial texts based on the perturbation units, helping to better understand the generation of adversarial texts and build robust models for defense. In presenting the taxonomy of adversarial attacks and defenses in the text domain, we introduce the adversarial techniques from the perspective of different NLP tasks. Finally, we discuss the existing challenges of ad-versarial attacks and defenses in texts and present the future research directions in this emerging and challenging field.

Reverse auction-based incentive mechanisms have been commonly proposed to stimulate mobile users to participate in crowdsensing, where users submit bids to the platform to compete for interested tasks. Recent works pointed out that bid is a private information which can reveal sensitive information of users (e.g., location privacy), and proposed bidding-preserving mechanisms with differential privacy against inference attack. However, all these mechanisms rely on a trusted platform, and would fail in bid protection completely when the platform is untrusted. In this paper, we design novel privacy-preserving incentive mechanisms to protect users’ true bid information against the honest-but-curious platform while minimizing the social cost of winner selection. To this end, instead of uploading the true bid to the platform, a differentially private bid obfuscation function is designed with the exponential mechanism, which helps each user to obfuscate bids locally and submit obfuscated bids to the platform. Two solutions are proposed for the platform to solve the winner selection problem with the obfuscated information, which is proved to be NP-hard. Moreover, we further propose a novel task-bid pair protection truthful incentive mechanism to further prevent privacy leakage from the set of interested tasks, where each user encrypts his interested tasks via homomorphic encryption locally, and an encrypted task clustering method is proposed to group users with the same interested tasks into the same cluster for winner selection with users’ encrypted task-bid pairs. Both of theoretical analysis and extensive experiments demonstrate the effectiveness of proposed mechanisms against the untrusted platform.

Compressed sensing (CS) has been identified as a good candidate for user detection in grant-free non-orthogonal multiple access (NOMA) by exploiting the inherent sparsity of user activity. However, most of the existing CS-based user detection schemes do not fully utilize the temporal correlation of user activity in NOMA and rely heavily on the unrealistic assumption that the number of active users is known in advance. To address these issues, we propose a temporal correlation enhanced multiuser detection scheme to achieve efficient and pragmatic multiuser detection. First, using 1-bit memory to piggyback the information on whether the active users still have data to transmit, the base station can realize that the active users in the current time slot will turn to be silent or remain active. Then, to make explicit use of the temporal correlation of active user sets, a cross validation based adaptive subspace pursuit (CVASP) algorithm is developed by utilizing the reported information on prior active users. The proposed CVASP is a highly practical algorithm that does not require any prior knowledge of the number of active users or the noise level, as the cross validation technique could properly determine the stopping condition. Extensive simulation results demonstrate that the proposed mechanism could achieve almost the same performance as compared to the existing state of art CS-based multiuser detection algorithms while eliminating the need for any prior knowledge.

Prioritizing fairness is of central importance in artificial intelligence (AI) systems, especially for those societal applications, e.g., hiring systems should recommend applicants equally from different demographic groups, and risk assessment systems must eliminate racism in criminal justice. Existing efforts towards the ethical development of AI systems have leveraged data science to mitigate biases in the training set or introduced fairness principles into the training process. For a deployed AI system, however, it may not allow for retraining or tuning in practice. By contrast, we propose a more flexible approach, i.e., fairness-aware adversarial perturbation (FAAP), which learns to perturb input data to blind deployed models on fairness-related features, e.g., gender and ethnicity. The key advantage is that FAAP does not modify deployed models in terms of param-eters and structures. To achieve this, we design a discriminator to distinguish fairness-related attributes based on latent representations from deployed models. Meanwhile, a perturbation generator is trained against the discriminator, such that no fairness-related features could be extracted from perturbed inputs. Exhaustive experimental evaluation demonstrates the effectiveness and superior performance of the proposed FAAP. In addition, FAAP is validated on real-world commercial deployments (inaccessible to model pa-rameters), which shows the transferability of FAAP, foreseeing the potential of black-box adaptation.

Mobile Edge Computing (MEC) is a new paradigm where mobile users can offload computation tasks to the nearby MEC server to reduce their resource consumption. Some works have pointed out that the true amount of offloaded tasks may reveal the sensitive information (e.g., device usage pattern and location information) of users, and proposed several privacy-preserving offloading mechanisms. However, to the best of our knowledge, none of them can provide strict and provable privacy guarantee. In this paper, we focus on the privacy leakage issue in computation offloading in MEC with a honest-but-curious server, and propose a novel online privacy-preserving computation offloading mechanism, called OffloadingGuard, to generate efficient offloading strategies for users in real time, which provide strict user privacy guarantee while minimizing the total cost of task computation. To this end, we design a deep reinforcement learning-based offloading model which allows each user to adaptively determine the satisfactory perturbed offloading ratio according to the time-varying channel state at each time slot to achieve trade-off between user privacy and computation cost. In particular, to strictly protect the true amount of offloaded tasks and prevent the untrusted MEC server from revealing mobile users’ privacy, a range-constrained Laplace distribution is designed to obfuscate the original offloading ratio of each user and restrict the perturbed offloading ratio in a rational range. OffloadingGuard is proved to satisfy ϵ-differential privacy, and extensive experiments demonstrate its effectiveness.

With the explosive growth of mobile and Internet of Things (IoT) applications, increasing Mobile Edge Computing (MEC) systems have been developed by diverse Edge Service Providers (ESPs), opening a new computing market with stiff competition. However, considering the spatiotemporally varying features of computation tasks, taking over all the received tasks alone may greatly degrade the service performance of the MEC system and lead to poor economical benefit. To this end, this paper proposes a two-layer collaboration model for ESPs. Each ESP can balance the computation workload among the internal edge nodes from the ESP and offload part of computation tasks to the ESP external edge servers from other ESPs. For internal load balancing, we propose a task balancing scheme based on the Alternating Direction Method of Multipliers (ADMM) to manage the computation tasks within the edge nodes of the ESP, such that the computation delay can be minimized. For external task offloading, we formulate a game-based pricing and task allocation scheme to derive the best game strategy, aiming at maximizing the total revenue of each ESP. Extensive simulation results demonstrate that the proposed schemes can achieve improved performance in terms of system revenue and stability, as well as computation delay.

Earpiece mode of smartphones is often used for confidential communication. In this paper, we proposed a remote(>2m) and motion-resilient attack on smartphone earpiece. We developed an end-to-end eavesdropping system mmEve based on a commercial mmWave sensor to recover speech emitted from smartphone earpiece. The rationale of the attack is based on our observation that, soundwaves emitted from the smartphone's earpiece have a strong correlation with reflected mmWaves from the smartphone's rear. However, we find the recovered speech suffers from the sensor's self-noise and smartphone user's motion which limit attack distance to less than 2m, causing limited threats in real world. We modeled the motion interference under mmWave sensing and proposed a motion-resilient solution by optimizing the fitting function on I/Q plane. To achieve a practical attack with reasonable attack distance, we developed a GAN-based denoising scheme to eliminate the noise pattern of the sensor, which boosted the attack range to 6--8m. We evaluated mmEve with extensive experiments and find 23 different models of smartphones manufactured by Samsung, Huawei, etc. can be compromised by the proposed attack.

The integration of deep learning on Speaker Recognition (SR) advances its development and wide deployment, but also introduces the emerging threat of adversarial examples. However, only a few existing studies investigate its practical threat in physical domain, which either evaluate its feasibility only by directly replaying generated adversarial examples, or explore the partial channel interference for robustness improvement. In this paper, we propose a physical adversarial example attack, PhyTalker, which could generate and inject perturbations on voices in a live-streaming manner on attacking various SR models in different physical channels. Compared with the typical adversarial example for digital attacks, PhyTalker generates a subphoneme-level perturbation dictionary to decouple the perturbation optimization and injection. Moreover, we introduce the channel augmentation to compensate both device and environmental distortions, as well as model ensemble to improve the perturbation transferability. Finally, PhyTalker recognizes and localizes the latest recorded phoneme to determine the corresponding perturbations for real-time broadcasting. Extensive experiments are conducted with a large-scale corpus in real physical scenarios, and results show that PhyTalker achieves an overall Attack Success Rate (ASR) of 85.5% in attacking mainstream SR systems and Mel Cepstral Distortion (MCD) of 2.45dB in human audibility.

In S&P 21, Jia et al. proposed a new concept/mechanism named proof-of-learning (PoL), which allows a prover to demonstrate ownership of a machine learning model by proving integrity of the training procedure. It guarantees that an adversary cannot construct a valid proof with less cost (in both computation and storage) than that made by the prover in generating the proof. A PoL proof includes a set of intermediate models recorded during training, together with the corresponding data points used to obtain each recorded model. Jia et al. claimed that an adversary merely knowing the final model and training dataset cannot efficiently find a set of intermediate models with correct data points. In this paper, however, we show that PoL is vulnerable to “adversarial examples”! Specifically, in a similar way as optimizing an adversarial example, we could make an arbitrarily-chosen data point “generate” a given model, hence efficiently generating intermediate models with correct data points. We demonstrate, both theoretically and empirically, that we are able to generate a valid proof with significantly less cost than generating a proof by the prover.

Radio frequency identification (RFID) systems have achieved wide applications in various scenarios, such as warehouse management, logistic tracking, smart transportation, etc. Despite the enormous benefits from the RFID systems, the security issues are still of great concern, such as the cloning attacks. In this article, we focus on the detection of probabilistic cloning attacks for the anonymous RFID systems, in which each cloned genuine tag suffers attacks from its clone tags with a certain probability. We propose an efficient detection protocol against the probabilistic cloning attacks in anonymous RFID systems named DAP, which can detect the probabilistic cloning attacks with the required detection reliability$\alpha$if at least one tag is attacked with the probability no less than the threshold$P_T$. The proposed DAP protocol fully utilizes the inconsistency and unreconcilable collision caused by the probabilistic cloning attacks to effectively detect the probabilistic cloning attacks.The parameters are theoretically analyzed to maximize the detection efficiency. The extensive simulations are conducted and the results demonstrate the effectiveness of the proposed DAP protocol.

Mobile crowdsensing (MCS) is an emerging paradigm that leverages pervasive smart terminals equipped with various embedded sensors to collect sensory data for wide applications. As the sensing scale increases in MCS, the design of efficient task allocation becomes crucial. However, many prior task allocation schemes, which ignore the time for task-performing, are not applicable to the scenario where mobile users with limited time budgets are able to undertake multiple sensing tasks. In this article, we focus on the task allocation in time dependent crowdsensing systems and formulate the time dependent task allocation problem, in which both the sensing duration and the user's sensing capacity are considered. We prove that the task allocation problem is NP-hard and propose an efficient task allocation algorithm called optimized allocation scheme of time-dependent tasks (OPAT), which can maximize the sensing capacity of each mobile user. The extensive simulations are conducted to demonstrate the effectiveness of the proposed OPAT scheme.

Mechanisms built upon geo-indistinguishability render location privacy, where a user can submit obfuscated locations to Location-Based Service providers but still be able to correctly utilize services. However, these mechanisms are vulnerable under inference attacks. Particularly, with background knowledge of a user’s obfuscated locations, an attacker can infer actual locations by carrying out long-term observation attacks. Unfortunately, how to defend long-term observation attacks in the field of differential location privacy remains open. In this paper, we first demonstrate the vulnerabilities of existing mechanisms under long-term observation attacks. In light of these vulnerabilities, we devise a novel mechanism, referred to as Eclipse, which bridges the gap between location protection and usability of services. Specifically, we harness geo-indistinguishability and$k$-anonymity to obfuscate locations and hide each location based on an anonymity set. As a result, our mechanism effectively perturbs the distribution of locations and suppresses leakage under long-term observation attacks. Moreover, the set of possible outputs is utilized to minimize the impacts to usability and correctness. We formally define and rigorously prove the security of the proposed mechanism by leveraging differential privacy. Moreover, we implement the proposed mechanism and conduct a series of experiments on real-world datasets to demonstrate its efficacy and efficiency.

Incentive mechanisms are essential for stimulating adequate worker participation to achieve good truth discovery performance in mobile crowdsensing (MCS) systems. However, most of existing incentive mechanisms only consider compensating workers’ sensing cost, while the cost incurred by potential privacy leakage has been largely neglected. Moreover, none of existing privacy-preserving incentive mechanisms has incorporated workers’ different privacy preferences to provide personalized payments for them. In this paper, we propose a contract-based personalized privacy-preserving incentive mechanism for truth discovery in MCS systems, named Paris-TD, which provides personalized payments for workers as a compensation for privacy cost while achieving accurate truth discovery. The basic idea is that the platform offers a set of different contracts to workers with different privacy preferences, and each worker chooses to sign a contract which specifies a privacy-preserving degree (PPD) and the corresponding payment the worker will receive if she submits perturbed data with that PPD. Specifically, we respectively design a set of optimal contracts analytically under both full and incomplete information models, which maximize the truth discovery accuracy under a given budget, while satisfying the individual rationality and incentive compatibility properties. The feasibility and effectiveness of Paris-TD are validated through experiments on both synthetic and real-world datasets.

Differential privacy (DP) has gained popularity in truth discovery recently due to its strong privacy guarantee. However, existing DP mechanisms for streaming data publication are not suitable for truth discovery as they fail to consider the different reliabilities of individuals, while the DP-based approaches for truth discovery are not suitable for streaming data because they ignore the correlations between truths over time. Directly applying these existing methods to streaming crowdsourced data would lead to low accuracy of the discovered truth. To solve this problem, in this paper, we propose an edge computing based privacy-preserving truth discovery mechanism, named PrivSTD, for streaming crowdsourced data to realize high accuracy of discovered truth while protecting the privacy of workers. Specifically, edge servers are introduced between the untrusted cloud server and workers to securely calculate the local truths and workers’ reliabilities. A truth-dependent budget recycle mechanism is proposed for each edge server to adaptively determine the perturbed timestamp and allocate the privacy budget according to the changing pattern of local truths. Besides, a reliability-based perturbation mechanism is proposed to reduce the perturbation magnitude on the basis of worker's reliability. We theoretical analyze the data utility and computation cost of PrivSTD, and prove that PrivSTD can satisfy$w$-event ($\epsilon,\delta$)-differential privacy. Extensive experimental results on synthetic and real-world datasets demonstrate that PrivSTD achieves better utility than the state-of-the-art approaches.

Sign language recognition (SLR) bridges the communication gap between the hearing-impaired and the ordinary people. However, existing SLR systems either cannot provide continuous recognition or suffer from low recognition accuracy due to the difficulty of sign segmentation and the insufficiency of capturing both finger and arm motions. The latest system, SignSpeaker, has a significant limit in recognizing two-handed signs with onlyonesmartwatch. To address these problems, this paper designs a novel real-time end-to-end SLR system, called DeepSLR, to translate sign language into voices to help people “hear” sign language. Specifically, two armbands embedded with an IMU sensor and multi-channel sEMG sensors are attached on the forearms to capture both coarse-grained arm movements and fine-grained finger motions. We propose an attention-based encoder-decoder model with a multi-channel convolutional neural network (CNN) to realize accurate, scalable, and end-to-end continuous SLR without sign segmentation. We have implemented DeepSLR on a smartphone and evaluated its effectiveness through extensive evaluations. The average word error rate of continuous sentence recognition is 10.8 percent, and it takes less than 1.1s for detecting signals and recognizing a sentence with 4 sign words, validating the recognition efficiency and real-time ability of DeepSLR in real-world scenarios.

Truth discovery is an effective paradigm which could reveal the truth from crowdsouced data with conflicts, enabling data-driven decision-making systems to make quick and smart decisions. The increasing privacy concern promotes users to perturb or encrypt their private data before outsourcing, which poses significant challenges for truth discovery. Although several privacy-preserving truth discovery mechanisms have been proposed, none of them take personal privacy expectation into consideration. In this work, we propose a novel personalized privacy-preserving truth discovery (PPPTD) framework over crowdsourced data streams to achieve timely and accurate truth discovery while guaranteeing the protection of individual privacy. The key challenges of PPPTD lie in improving the accuracy of truth estimation from the perturbed streaming data with personalized protection level. To address these challenges, we first develop a personalized budget initialization mechanism to quantify each user’s privacy protection requirement, and allocate personalized privacy budgets to users according to their privacy requirements. Then we propose a deviation-aware weighted aggregation method to improve the accuracy of truth discovery from streaming data with varying degrees of perturbation. In order to achieve privacy-utility tradeoff, we further propose an influence-aware adaptive budget adjustment mechanism that adaptively re-allocates privacy budgets to users based on the evolution of their influence in the weighted aggregation. We prove that PPPTD can achieve$\epsilon $-differential privacy over the whole data generated by users and satisfy individual personalized privacy requirements. Extensive experiments on two real-world datasets demonstrate the effectiveness of PPPTD.

Transferability of adversarial examples is of central importance for attacking an unknown model, which facilitates adversarial attacks in more practical scenarios, e.g., black-box attacks. Existing transferable attacks tend to craft adversarial examples by indiscriminately distorting features to degrade prediction accuracy in a source model without aware of intrinsic features of objects in the images. We argue that such brute-force degradation would introduce model-specific local optimum into adversarial examples, thus limiting the transferability. By contrast, we propose the Feature Importance-aware Attack (FIA), which disrupts important object-aware features that dominate model decisions consistently. More specifically, we obtain feature importance by introducing the aggregate gradient, which averages the gradients with respect to feature maps of the source model, computed on a batch of random transforms of the original clean image. The gradients will be highly correlated to objects of interest, and such correlation presents invariance across different models. Besides, the random transforms will preserve intrinsic features of objects and suppress model-specific information. Finally, the feature importance guides to search for adversarial examples to-wards disrupting critical features, achieving stronger transferability. Extensive experimental evaluation demonstrates the effectiveness and superior performance of the proposed FIA, i.e., improving the success rate by 9.5% against normally trained models and 12.8% against defense models as compared to the state-of-the-art transferable attacks. Code is available at: https://github.com/hcguoO0/FIA

Federated Learning (FL) is a new distributed machine learning (ML) approach which enables thousands of mobile devices to collaboratively train artificial intelligence (AI) models using local data without compromising user privacy. Although FL represents a promising computing paradigm, such training process can not be fully realized without an appropriate economic mechanism that incentivizes the participation of heterogeneous clients. This work targets social cost minimization, and studies the incentive mechanism design in FL through a procurement auction. Different from existing literature, we consider a practical scenario of FL where clients are selected and scheduled at different global iterations to guarantee the completion of the FL job, and capture the distinct feature of FL that the number of global iterations is determined by the local accuracy of all participants to balance between computation and communication. Our auction framework$A_{FL}$first decomposes the social cost minimization problem into a series of winner determination problems (WDPs) based on the number of global iterations. Then to solve each WDP,$A_{FL}$invokes a greedy algorithm to determine the winners, and a payment algorithm for computing remuneration to winners. Finally,$A_{FL}$returns the best solution among all WDPs. Theoretical analysis proves that$A_{FL}$is truthful, individual rational, computationally efficient, and achieves a near-optimal social cost. We further conduct large-scale simulation studies based on the real-world data. Simulation results show that$A_{FL}$can reduce the social cost by up to 75% compared with state-of-the-art algorithms.

Users usually have different privacy demands when they contribute individual data to a dataset that is maintained and queried by others. To tackle this problem, several personalized differential privacy (PDP) mechanisms have been proposed to render statistical information of the entire dataset without revealing individual privacy. However, existing mechanisms produce query results with low accuracy, which leads to poor data utility. This is primarily because (1) some users are over protected; (2) utility is not explicitly included in the design objective. Poor data utility impedes the adoption of PDP in the real-world applications. In this paper, we present an adaptive personalized differential privacy framework, called AdaPDP. Specifically, to maximize data utility in different cases, AdaPDP adaptively selects underlying noise generation algorithms and calculates the corresponding parameters based on the type of query functions, data distributions and privacy settings. In addition, AdaPDP performs multiple rounds of utility-aware sampling to satisfy different privacy requirements for users. Our privacy analysis shows that the proposed framework renders rigorous privacy guarantee. We conduct extensive experiments on synthetic and real-world datasets to demonstrate the much less utility losses of the proposed framework over various query functions.

Exploiting the sparse nature of user activity, compressed sensing (CS) has been a powerful technique to realize efficient user detection in grant-free nonorthogonal multiple access (NOMA). However, most of the existing CS-based multiuser detection schemes merely independently incorporate the temporal correlation in frame-based transmission or spatial correlation induced by multiantenna reception, leading to unsatisfactory user detection performance. Driven by the observation in the CS theory that the signal recovery performance could be enhanced by an increased number of sparse vectors with a common support set, in this article, we propose a novel joint user activity identification and channel estimation (JUICE) framework by integrating the temporal correlation of active user sets with multiantenna reception, which could achieve superior user detection performance. Specifically, we first formulate the JUICE as a Kronecker CS (KCS) problem to model the CS measurement process, by fully extracting the spatial-temporal structure of user activity. Then, based on the mined spatial-temporal structure of user activity, an adaptive subspace pursuit algorithm is developed, i.e., spatial-temporal structure enhanced adaptive subspace pursuit (STS-ASP), which could realize efficient multiuser detection. A distinct advantage of the proposed algorithm is that it does not require any prior knowledge (e.g., the number of active users and the noise level), by adaptively acquiring the number of active users and employing the cross-validation technique to appropriately terminate the iterative procedures. Extensive experimental evaluation is conducted, and the results corroborate the superiority of the proposed framework compared with the existing CS-based multiuser detection methods.

Federated learning (FL) is a privacy-preserving distributed machine learning framework, which involves training statistical models over a number of mobile users (i.e., workers) while keeping data localized. However, recent works have demonstrated that workers engaged in FL are still susceptible to advanced inference attacks when sharing model updates or gradients, which would discourage them from participating. Most of the existing incentive mechanisms for FL mainly account for workers’ resource cost, while the cost incurred by potential privacy leakage resulting from inference attacks has rarely been incorporated. To address these issues, in this paper, we propose a contract-based personalized privacy-preserving incentive for FL, named Pain-FL, to provide customized payments for workers with different privacy preferences as compensation for privacy leakage cost while ensuring satisfactory convergence performance of FL models. The core idea of Pain-FL is that each worker agrees on a customized contract, which specifies a kind of privacy-preserving level (PPL) and the corresponding payment, with the server in each round of FL. Then, the worker perturbs her calculated stochastic gradients to be uploaded with that PPL in exchange for that payment. In particular, we respectively derive a set of optimal contracts analytically under both complete and incomplete information models, which could optimize the convergence performance of the finally learned global model, while bearing some desired economic properties, i.e., budget feasibility, individual rationality, and incentive compatibility. An exhaustive experimental evaluation of Pain-FL is conducted, and the results corroborate its practicability and effectiveness.

This article proposes unsupervised truth-finding algorithms that combine consideration of multi-modal content features with analysis of propagation patterns to evaluate the veracity of observations in social sensing applications. A key social sensing challenge is to develop effective algorithms for estimating both the reliability of sources and the veracity of their observations without prior knowledge. In contrast to prior solutions that use labeled examples to learn content features that are correlated with veracity, our approach is entirely unsupervised. Hence, given no prior training data, we jointly learn the importance of different content features together with the veracity of observations using propagation patterns as an indicator of perceived content reliability. A novel penalized expectation maximization (PEM) algorithm is proposed to improve the quality of estimation results for observations bolstered by multiple features. In addition, we develop a constrained expectation maximum likelihood with multiple features (CEM-MultiF) that introduces a novel constraint to boost the probability of correctness of some claims. Finally, we evaluate the performance of the proposed algorithms, called EM-Multi, CEM-Multi and PEM-MultiF, respectively, on real-world data sets collected from Twitter. The evaluation results demonstrate that the proposed algorithms outperform the existing fact-finding approaches, and offer tunable knobs for controlling robustness/performance trade-offs in the presence of malicious sources.

Searchable symmetric encryption (SSE) allows the data owner to outsource an encrypted database to a remote server in a private manner while maintaining the ability for selectively search. So far, most existing solutions focus on an honest-but-curious server, while security designs against a malicious server have not drawn enough attention. A few recent works have attempted to construct verifiable SSE that enables the data owner to verify the integrity of search results. Nevertheless, these verification mechanisms are highly dependent on specific SSE schemes, and fail to support complex queries. A general verification mechanism is desired that can be applied to all SSE schemes. In this work, instead of concentrating on a central server, we explore the potential of the smart contract, an emerging blockchain-based decentralized technology, and construct decentralized SSE schemes where the data owner can receive correct search results with assurance without worrying about potential wrongdoings of a malicious server. We study both public and private blockchain environments and propose two designs with a trade-off between security and efficiency. To better support practical applications, the multi-user setting of SSE is further investigated where the data owner allows authenticated users to search keywords in shared documents. We implement prototypes of our two designs and present experiments and evaluations to demonstrate the practicability of our decentralized SSE schemes.

Recent studies demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples, which would seriously threaten security-sensitive applications. Existing works synthesized the adversarial examples by perturbing the original/benign images by leveraging the$\mathcal {L}_p$-norm to penalize the perturbations, which restricts the pixel-wise distance between the adversarial images and correspondingly benign images. However, they added perturbations globally to the benign images without explicitly considering their content/spacial structure, resulting in noticeable artifacts especially in those originally clean regions, e.g., sky and smooth surface. In this paper, we propose an invisible adversarial attack, which synthesizes adversarial examples that are visually indistinguishable from benign ones. We adaptively distribute the perturbation according to human sensitivity to a local stimulus in the benign image, i.e., the higher insensitivity, the more perturbation. Two types of adaptive adversarial attacks are proposed: 1) coarse-grained and 2) fine-grained. The former conducts$\mathcal {L}_p$-norm regularized by the novel spatial constraints, which utilizes the rich information of the cluttered regions to mask perturbation. The latter, called Just Noticeable Distortion (JND)-based adversarial attack, utilizes the proposed JND$_p$metric for better measuring the perceptual similarity, and adaptively sets penalty by weighting the pixel-wise perceptual redundancy of an image. We conduct extensive experiments on the MNIST, CIFAR-10 and ImageNet datasets and a comprehensive user study with 50 participants. The experimental results demonstrate that JND$_p$is a better metric for measuring the perceptual similarity than$\mathcal {L}_p$-norm, and the proposed adaptive adversarial attacks can synthesize indistinguishable adversarial examples from benign ones and outperform the state-of-the-art methods.

Radio-Frequency Identification (RFID) is an emerging technology which has been widely applied in various scenarios, such as tracking, object monitoring, and social networks, etc. Cloning attacks can severely disturb the RFID systems, such as missed detection for the missing tags. Although there are some techniques with physical architecture design or complicated encryption and cryptography proposed to prevent the tags from being cloned, it is difficult to definitely avoid the cloning attack. Therefore, cloning attack detection and identification are critical for the RFID systems. Prior works rely on that each clone tag will reply to the reader when its corresponding genuine tag is queried. In this article, we consider a more general attack model, in which each clone tag replies to the reader's query with a predefined probability, i.e., attack probability. We concentrate on identifying the tags being attacked with the probability no less than a threshold $P_{t}$ with the required identification reliability $\alpha $ . We first propose a basic protocol to Identify the Probabilistic Cloning Attacks with required identification reliability for the large-scale RFID systems called IPCA. Then we propose two enhanced protocols called MS-IPCA and S-IPCA respectively to improve the identification efficiency. We theoretically analyze the parameters of the proposed IPCA, MS-IPCA and S-IPCA protocols to maximize the identification efficiency. Finally we conduct extensive simulations to validate the effectiveness of the proposed protocols.

Worker recruitment is an important problem in mobile crowdsourcing (MCS), which aims to find sufficient and suitable participants to perform tasks. However, existing worker recruitment approaches mainly focus on how to select the most suitable workers for tasks from a large worker pool, while the recruitment problem under insufficient workers (e.g., a new MCS system) has not been well addressed. In this paper, we focus on the insufficient participation problem of MCS systems with limited number of workers, and propose to leverage social network to recruit workers for task completion as well as expanding the worker pool. To this end, we propose a dynamic incentive mechanism, called SocialRecruiter, to encourage workers on the MCS platform to propagate tasks through social networks, so that inviting friends to join in the MCS platform to further propagate and complete tasks. Motivated by the SIR epidemic model, we propose a novel task-specific epidemic model to characterize the status change of users for task propagation and completion through social networks. In order to encourage task completion and propagation, the propagating reward and completing reward are provided according to workers’ actions. In particular, in order to maximize the task completion within the financial budget, the propagating and completing rewards are dynamically updated at each cycle according to real-time worker recruitment progress. The extensive experimental results on two real-world datasets demonstrate that SocialRecruiter outperforms the state-of-the-art approaches in terms of worker recruitment and task completion.

Worker recruitment in mobile crowdsensing systems aims to recruit the most suitable users to perform tasks with high quality and in real-time. Many worker recruitment or task matching mechanisms have been proposed, especially for crowdsourcing platforms, where content information of tasks from the implicit feedback of workers' attendance is extensively exploited to help workers find preferred tasks efficiently. Different from traditional crowdsourcing systems, tasks in mobile crowdsensing systems are usually time-sensitive and location-dependent which also play a crucial role in worker recruitment. However, these context information have not been effectively explored for user recruitment in mobile crowdsensing systems. In this paper, we propose a novel personalized task-oriented worker recruitment mechanism for mobile crowdsensing systems based on a careful characterization of workers' preference. In particular, we fully exploit the content information (e.g., task category, task description) together with the context information (e.g., task time, task location) from the implicit feedback of workers' attendance to accurately model workers' preference on tasks. Moreover, we regard the task-worker fitness prediction as a binary classification problem and utilize the Logit model to integrate the heterogeneous factors into a single framework to predict the matching probability of each task-worker pair. Finally, the workers with the highest matching probability are recruited proactively for each new task. Extensive experiments on real-world datasets demonstrate that the proposed mechanism achieves better performance than the benchmarks.

Pattern lock is an essential authentication method on mobile devices. Recent works on cracking pattern locks either require additional network facilities (e.g., WiFi hotspots) or suffer from strict constraints (e.g., physical closeness to the victim and good lighting). Being too susceptible to environment settings, these attacks are less effective in practice and cannot scale to a large number of users. To address these concerns, in this paper, we propose PatternListener+, a practical attack on pattern locks using the speakers and microphones on mobile devices. The speaker plays inaudible acoustic signals, which are reflected by the fingertip when the victim is drawing the pattern, and then recorded by the microphone. The recorded acoustic signals contain rich information of the fingertip motion that can be leveraged to infer the pattern. We carefully design a series of algorithms to eliminate the dynamic and static interferences, segment acoustic signals into fragments corresponding to all pattern lines, and recover each line composed of the pattern according to the signals. Finally, we recover the candidate pattern by mapping all line candidates into grid patterns with a tree structure. We implement a PatternListener+ prototype using off-the-shelf smartphones, and extensive experiments confirm the effectiveness and robustness of PatternListener+. The attack success rate is over 90 percent on 120 patterns in five attempts.

Factorization Machine (FM) has been a popular approach in supervised predictive tasks, such as click-through rate prediction and recommender systems, due to its great performance and efficiency. Recently, several variants of FM have been proposed to improve its performance. However, most of the state-of-the-art prediction algorithms neglected the field information of features, and they also failed to discriminate the importance of feature interactions due to the problem of redundant features. In this paper, we present a novel algorithm called Attention-over-Attention Field-aware Factorization Machine (AoAFFM) for better capturing the characteristics of feature interactions. Specifically, we propose the field-aware embedding layer to exploit the field information of features, and combine it with the attention-over-attention mechanism to learn both feature-level and interaction-level attention to estimate the weight of feature interactions. Experimental results show that the proposed AoAFFM improves FM and FFM with large margin, and outperforms state-of-the-art algorithms on three public benchmark datasets.

Truth discovery is an effective tool to unearth truthful answers in crowdsourced question answering systems. Incentive mechanisms are necessary in such systems to stimulate worker participation. However, most of existing incentive mechanisms only consider compensating workers' resource cost, while the cost incurred by potential privacy leakage has been rarely incorporated. More importantly, to the best of our knowledge, how to provide personalized payments for workers with different privacy demands remains uninvestigated thus far. In this paper, we propose a contract-based personalized privacy-preserving incentive mechanism for truth discovery in crowdsourced question answering systems, named PINTION, which provides personalized payments for workers with different privacy demands as a compensation for privacy cost, while ensuring accurate truth discovery. The basic idea is that each worker chooses to sign a contract with the platform, which specifies a privacy-preserving level (PPL) and a payment, and then submits perturbed answers with that PPL in return for that payment. Specifically, we respectively design a set of optimal contracts under both complete and incomplete information models, which could maximize the truth discovery accuracy, while satisfying the budget feasibility, individual rationality and incentive compatibility properties. Experiments on both synthetic and real-world datasets validate the feasibility and effectiveness of PINTION.

Although time-series data collected from users can be utilized to provide services for various applications, they could reveal sensitive information about users. Recently, local differential privacy (LDP) has emerged as the state-of-art approach to protect data privacy by perturbing data locally before outsourcing. However, existing works based on LDP perturb each data point separately without considering the correlations between consecutive data points in time-series. Thus, the important patterns of each time-series might be distorted by existing LDP-based approaches, leading to severe degradation of data utility. In this paper, we focus on real-time data collection under a honest-but-curious server, and propose a novel pattern-aware privacy-preserving approach, called PatternLDP, to protect data privacy while the pattern of time-series can still be preserved. To this end, instead of providing the same level of privacy protection at each data point, each user only samples remarkable points in time-series and adaptively perturbs them according to their impacts on local patterns. In particular, we propose a pattern-aware sampling method based on Piecewise Linear Approximation (PLA) to determine whether to sample and perturb current data point. To reduce the utility loss caused by pattern change after perturbation, we propose an importance-aware randomization mechanism to adaptively perturb sampled data locally while achieving better trade-off between privacy and utility. A novel metric-based w-event privacy is introduced to measure the privacy protection degree for pattern-rich time-series. We prove that PatternLDP can provide the above privacy guarantee, and extensive experiments on real-world datasets demonstrate that PatternLDP outperforms existing mechanisms and can effectively preserve the important patterns.

The massive photos shared through the social networks nowadays, e.g., Facebook and Instagram, have aided malicious entities to snoop private information, especially by utilizing deep neural networks (DNNs) to learn from those personal photos. To protect photo privacy against DNNs, recent advances adopting adversarial examples could successfully fool DNNs. However, they are sensitive to those image compression methods that are commonly used on social networks to reduce transmission bandwidth or storage space. A recent work proposed to resist JPEG compression, while the compression methods adopted in social networks are black boxes, and variation of compression methods would significantly degrade the resistance.

The DDoS attack is a serious threat to Internet of Things (IoT). As a new class of DDoS attack, Link-flooding attack (LFA) disrupts connectivity between legitimate IoT devices and target servers by flooding only a small number of links. In this paper, we propose an active LFA mitigation mechanism, called Linkbait, that is a proactive and preventive defense to throttle LFA for IoT. We propose a link obfuscation algorithm in Linkbait that selectively reroutes probing flows to hide target links from adversaries and mislead them to identify bait links as target links. To block attack traffic and further reduce the impact in IoT, we propose a compromised IoT devices detection algorithm that extracts unique traffic patterns of LFA for IoT and leverages support vector machine (SVM) to identify attack traffic. We evaluate the performance of Linkbait by using both real-world experiments and large-scale simulations. The experimental results demonstrate the effectiveness of Linkbait.

It is a fundamental issue to achieve efficient information collection in Internet of Things (IoT), where random (channel) access plays an indispensable role, especially when coordination among IoT end nodes is unachievable. Compressive sensing (CS) has been widely used in random access to facilitate energy efficient and accurate data collection. However, a joint sparsity structure, which commonly exists among signals acquired by different end nodes, has been long ignored by existing CS-based random access schemes, leading to insufficient energy efficiency and accuracy. In this article, capitalizing on this joint sparsity structure, we propose a structured compressive random access (SCRA) mechanism in order to achieve maximum energy efficiency with accuracy guarantee for data collection. Specifically, we first model the data loss induced by packet collisions during random access as an independent CS measurement process for each node, where the corresponding CS projection matrix is determined by the data loss pattern. Furthermore, in order to control the amount of data transmitted in the channel and alleviate the packet collisions, we employ the concept of sensing probability to perform random subsampling at each end node before transmission, where the optimal sensing probability is derived. Finally, we propose to jointly recover the set of original signals at all nodes based on the concept of group sparsity by formulating the data collection process as a single-measurement-vector problem in CS. The evaluation results validate the effectiveness of SCRA in utilizing the joint sparsity structure to obtain superior performance compared to the benchmark methods.

Radio-frequency identification (RFID) has pervasive applications in building ultralow-power ubiquitous networks, where backscatter communication during tag identification is neither reliable nor efficient. Inspired by the sparsity that only a few RFID tags communicate with the reader simultaneously, many compressed sensing (CS)-based schemes have been proposed to exploit the colliding tag responses to facilitate efficient tag identification. However, most of them suffer from huge ID search space and signature collision during the CS recovery process. To address these issues, we propose SCRIC, a novel sparsity-controlled RFID identification scheme using a random signature assignment, which achieves a faster and more robust identification performance. Specifically, to tackle identification failure caused by severe signature collision, we assign each active tag an access probability to control the sparsity and reduce signature collision. Theoretical analysis is given to prove that the signature collision probability of the proposed scheme is reduced compared with the existing random signature scheme and an optimal access probability is derived. Moreover, considering that conventional CS recovery algorithm relies heavily on the unpractical assumption that the active tag number is known precisely in advance, we integrate the cross validation (CV) into CS recovery algorithms and propose a greedy algorithm called the CV-based orthogonal matching pursuit (OMP-CV), which can reduce the tag identification false alarm rate without any prior knowledge. Extensive experimental results show that the proposed mechanism significantly outperforms the existing CS-based tag identification methods in terms of identification speed and robustness to noise.

Federated learning has emerged as an advanced privacy-preserving learning technique for mobile edge computing, where the model is trained in a decentralized manner by the clients, preventing the server from directly accessing those private data from the clients. This learning mechanism significantly challenges the attack from the server side. Although the state-of-the-art attacking techniques that incorporated the advance of Generative adversarial networks (GANs) could construct class representatives of the global data distribution among all clients, it is still challenging to distinguishably attack a specific client (i.e., user-level privacy leakage), which is a stronger privacy threat to precisely recover the private data from a specific client. To analyze the privacy leakage of federated learning, this paper gives the first attempt to explore user-level privacy leakage by the attack from a malicious server. We propose a framework incorporating GAN with a multi-task discriminator, called multi-task GAN - Auxiliary Identification (mGAN-AI), which simultaneously discriminates category, reality, and client identity of input samples. The novel discrimination on client identity enables the generator to recover user specified private data. Unlike existing works interfering the federated learning process, the proposed method works “invisibly” on the server side. Furthermore, considering the anonymization strategy for mitigating mGAN-AI, we propose a beforehand linkability attack which re-identifies the anonymized updates by associating the client representatives. A novel siamese network fusing the identification and verification models is developed for measuring the similarity of representatives. The experimental results demonstrate the effectiveness of the proposed approaches and the superior to the state-of-the-art.

Complex networks have become an active interdisciplinary field of research inspired by the empirical study of various networks. A subway network is a real-world example of complex networks in the transportation domain, which has attracted growing attention in network analysis recently. Analyzing human mobility patterns, specifically in ranking subway stations closely bounded by urban subway planning and individuals' travel experience, is still an open issue. In this paper, we propose a novel ranking method of station importance (SIRank) by utilizing human mobility patterns and improved PageRank algorithm. Specifically, by analyzing human mobility patterns of the subway system in Shanghai, we demonstrate both static and dynamic characteristics using two network models (Shanghai subway static network and Shanghai subway passenger network). In particular, the SIRank focuses on bi-directional passenger flow analysis between origins and destinations to iteratively generate the importance value for each station. We implement a range of the experiments to illustrate the effectiveness of SIRank using the real-world subway transaction datasets. The results demonstrate that the hit ratio in SIRank reaches 60% in the top five stations, which is much higher than that of ranking by a weighted mixed index (WMIRank) and ranking by node degree (NDRank) approaches.

With the unprecedented convenience brought by Apps on mobile devices, we are facing severe security attacks and privacy leakage caused by them since they may stealthily access unclaimed or unneeded permissions for some purposes. Many works strive to discover these malicious apps using program analysis techniques, however, they fail to tell users why an app needs to request the permission from users' perspective. In this paper, we leverage the power of the crowdsourced user reviews to understand why an app requests a permission. We propose a framework, called SmartPI, that automatically identifies functionality-relevant user reviews and infers the permission implication of them, bridging the gap between the functionalities and the actual behaviors of an app. In particular, we extract features from the platform documents to identify functionality-relevant user reviews from noisy crowdsourced user reviews with Natural Language Processing (NLP) techniques. The topic model is further adopted to infer the permission implications of apps from the functionality-relevant user reviews. More than 20,000 apps, 2,653,159 users, and 4,247,769 user reviews are crawled from Google Play as a real-world dataset to evaluate the performance of SmartPI. The experiments results show that the permission usage of apps can be better reflected by user reviews than the claimed descriptions of apps.

Incentive mechanisms have been commonly proposed to encourage people to participate in mobile crowdsensing (MCS). However, most of them set unchangeable rewards for sensing tasks, while the inherent inequality and on-demand feature of sensing tasks have been long ignored, especially for location-dependent sensing tasks (LDSTs). In this paper, we focus on location-dependent MCS systems and propose a demand-driven dynamic incentive mechanism that dynamically changes the rewards of sensing tasks at each sensing round in an on-demand way to balance their popularity. A demand indicator is introduced to characterize the demand of each sensing task by considering its deadline, completing progress, and number of potential participants. At each sensing round, we use the Analytic Hierarchy Process (AHP) to calculate the relative demands of all sensing tasks and then determine their rewards accordingly. Moreover, we consider two task selection problem with participatory users and opportunistic users, respectively, and prove that both of them are NP-hard. We propose an optimal dynamic programming based solution for participatory scenario and an optimal backtracking based solution for opportunistic scenario to help each user select tasks while maximizing its profit. Extensive experiments show that the demand-driven dynamic incentive mechanism outperforms existing incentive mechanisms.

Person re-identification (re-ID) is the task of matching person images across camera views, which plays an important role in surveillance and security applications. Inspired by great progress of deep learning, deep re-ID models began to be popular and gained state-of-the-art performance. However, recent works found that deep neural networks (DNNs) are vulnerable to adversarial examples, posing potential threats to DNNs based applications. This phenomenon throws a serious question about whether deep re-ID based systems are vulnerable to adversarial attacks. In this paper, we take the first attempt to implement robust physical-world attacks against deep re-ID. We propose a novel attack algorithm, called advPattern, for generating adversarial patterns on clothes, which learns the variations of image pairs across cameras to pull closer the image features from the same camera, while pushing features from different cameras farther. By wearing our crafted “invisible cloak”, an adversary can evade person search, or impersonate a target person to fool deep re-ID models in physical world. We evaluate the effectiveness of our transformable patterns on adversaries' clothes with Market1501 and our established PRCS dataset. The experimental results show that the rank-1 accuracy of re-ID models for matching the adversary decreases from 87.9% to 27.1% under Evading Attack. Furthermore, the adversary can impersonate a target person with 47.1% rank-1 accuracy and 67.9% mAP under Impersonation Attack. The results demonstrate that deep re-ID systems are vulnerable to our physical attacks.

Reverse auction-based incentive mechanisms have been commonly proposed to stimulate mobile users to participate in crowdsensing, where users submit bids to the platform to compete for tasks. Recent works pointed out that bid is a private information which can reveal sensitive information of users (e.g., location privacy), and proposed bid-preserving mechanisms with differential privacy against inference attack. However, all these mechanisms rely on a trusted platform, and would fail in bid protection completely when the platform is untrusted (e.g., honest-but-curious). In this paper, we focus on the bid protection problem in mobile crowdsensing with an untrusted platform, and propose a novel privacy-preserving incentive mechanism to protect users' true bids against the honest-but-curious platform while minimizing the social cost of winner selection. To this end, instead of uploading the true bid to the platform, a differentially private bid obfuscation function is designed with the exponential mechanism, which helps each user to obfuscate bids locally and submit obfuscated task-bid pairs to the platform. The winner selection problem with the obfuscated task-bid pairs is formulated as an integer linear programming problem and proved to be NP-hard. We consider the optimization problem at two different scenarios, and propose a solution based on Hungarian method for single measurement and a greedy solution for multiple measurements, respectively. The proposed incentive mechanism is proved to satisfy ε-differential privacy, individual rationality and γ-truthfulness. The extensive experiments on a real-world data set demonstrate the effectiveness of the proposed mechanism against the untrusted platform.

Federated learning, i.e., a mobile edge computing framework for deep learning, is a recent advance in privacy-preserving machine learning, where the model is trained in a decentralized manner by the clients, i.e., data curators, preventing the server from directly accessing those private data from the clients. This learning mechanism significantly challenges the attack from the server side. Although the state-of-the-art attacking techniques that incorporated the advance of Generative adversarial networks (GANs) could construct class representatives of the global data distribution among all clients, it is still challenging to distinguishably attack a specific client (i.e., user-level privacy leakage), which is a stronger privacy threat to precisely recover the private data from a specific client. This paper gives the first attempt to explore user-level privacy leakage against the federated learning by the attack from a malicious server. We propose a framework incorporating GAN with a multi-task discriminator, which simultaneously discriminates category, reality, and client identity of input samples. The novel discrimination on client identity enables the generator to recover user specified private data. Unlike existing works that tend to interfere the training process of the federated learning, the proposed method works “invisibly” on the server side. The experimental results demonstrate the effectiveness of the proposed attacking approach and the superior to the state-of-the-art.

As emojis become prevalent in personal communications, people are always looking for new, interesting emojis to express emotions, show attitudes, or simply visualize texts. In this study, we collected more than thirty million tweets mentioning the word “emoji” in a one-year period to study emoji requests on Twitter. First, we filtered out bot-generated tweets and extracted emoji requests from the raw tweets using a comprehensive list of linguistic patterns. Then, we examined patterns of new emoji requests by exploring their time, locations, and context. Finally, we summarized users' advocacy behaviors and identified expressions of equity, diversity, and fairness issues due to unreleased but expected emojis, and concluded the significance of new emojis on society. To the best of our knowledge, this paper is the first to conduct a systematic, large-scale study on new emoji requests.

With the proliferation of the smart Internet of Things (IoT) devices based on Android system, malicious Android applications targeting for IoT devices have received more and more attention due to the concern of privacy leakage and property loss. However, existing malware detection approaches based on static or dynamic analysis are not scalable to the evolvement of malware and cannot extract enough valid semantics in application programming interface (API) level, failing to detect new malware. In this paper, we propose EveDroid, a scalable and event-aware Android malware detection system, which exploits the behavioral patterns in different events to effectively detect new malware based on the insight that events can reflect apps' possible running activities. Unlike existing approaches using API calls as features directly, we propose to use event group to describe apps' behaviors in event level, which can capture higher level of semantics than in API level. In event group, we adopt function clusters to represent behaviors in each event so that behaviors hidden in events can still be captured as time goes on, which enables EveDroid to detect new malware in the event level. The function clusters can generalize API calls into vectors based on their API composition to capture new API calls, which makes EveDroid scalable to malware evolving. Moreover, a neural network is specifically designed to aggregate the multiple events and automatically mine the semantic relationship among them. We train the system and evaluate its F1-measure on a dataset of 14 956 benign and 28 848 malicious Android apps released in different years. The experimental results show that EveDroid outperforms other malware detection systems.

When deploying radio frequency (RF)-powered sensor networks for mission-critical applications such as security surveillance, it is often required to maximize or guarantee the quality of surveillance. Both placing and scheduling the charging/working modes of sensors are of key importance in order to continuously ensure a satisfying quality of surveillance. Traditionally, sensor placement and scheduling have been considered separately. The first decision regards where to place the sensors, and then when to activate them. In this paper, we study simultaneous sensor placement and charging/working scheduling problem for fusion-based detection in RF-powered sensor networks. The problem is formulated as a constrained optimization problem and proved to be NP-complete. Two greedy heuristic algorithms, joint optimization greedy algorithm with fixed fusion radius (JOGA-FFR) and joint optimization greedy algorithm with dynamic fusion radius (JOGA-DFR) based on fixed and dynamic fusion radiuses, respectively, are presented to solve the problem. We validate our approaches through extensive numerical simulations as well as simulations based on real data traces collected from a vehicle detection experiment. The results show that, our proposed algorithms always outperform two-stage greedy algorithm (TSGA), an algorithm that optimizes sensor placement and scheduling separately, in all the simulation scenarios, and are near optimal in small-scale networks. Besides, JOGA-DFR outperforms JOGA-FFR under certain specific sensing model settings, but more often has a comparable performance with JOGA-FFR. JOGA-FFR is thus more recommended for its lower complexity.

Compressive sensing (CS) has been widely used in the Internet of Things (IoT) to achieve efficient information collection. However, existing works have mainly focused on utilizing CS to lower the sampling rate or reduce the number of transmissions, without explicitly accounting for the heterogeneity of energy consumption in IoT environments. In this paper, we propose a CS-based prejudiced random sensing strategy (PRSS) that explicitly considers the heterogeneous energy consumption of IoT sensor nodes at different locations, in order to accurately attain a desired tradeoff between the overall energy consumption and the sensing accuracy. Specifically, each sensor node participates in sensing via distributed random access based on an assigned sensing probability, which is determined by its energy consumption in sending the sensed data, data collision rate and its contribution to recovery accuracy. We employ the statistical restricted isometry property as a practical indicator of the recovery accuracy and derive a sufficiently good recovery error bound based on it. Accordingly, we devise a novel convex optimization framework to find the most energy-efficient sensing probability assignment strategy with accuracy guarantee. We evaluate the PRSS using real-world sea surface temperature data traces. Comparative simulations corroborate that the PRSS can significantly reduce energy consumption and prolong network lifetime without sacrificing sensing accuracy.

This paper introduces a novel hand-free human-computer interaction system called AirMouse, which turns a common pair of glasses into a mouse to enable the interaction between computers and humans, especially for disabled people. The basic idea is to simulate mouse operations with head activities without using hands. To this end, an embedded device is attached to a pair of glasses, which leverages the gyroscope to accurately detect head activities and map them to corresponding mouse operations on devices (e.g., computers and smart TVs). In particular, AirMouse uses activities to simulate mouse operations instead of tracking the gaze or the head movements in the real-time manner. This provides flexibility to users allowing them to control devices even far away or not at front of the devices. We implement a prototype of AirMouse with the personalized pretraining module and the motion detection module, which is featured with low-cost, accurate, easy-to-use and real-time interaction, and evaluate AirMouse with 20 volunteers. The experimental results show that AirMouse achieves accurate, reliable, and real-time activity recognition and interaction. Specially, the technique of AirMouse can be integrated into wearable devices (e.g., smart glasses) to enrich their interaction functionalities.

Location information of workers are usually required for optimal task allocation in mobile crowdsensing, which however raises severe concerns of location privacy leakage. Although many approaches have been proposed to protect the locations of users, the location protection for task allocation in mobile crowdsensing has not been well explored. In addition, to the best of our knowledge, none of existing privacy-preserving task allocation mechanisms can provide personalized location protection considering different protection demands of workers. In this paper, we propose a personalized privacy-preserving task allocation framework for mobile crowdsensing that can allocate tasks effectively while providing personalized location privacy protection. The basic idea is that each worker uploads the obfuscated distances and personal privacy level to the server instead of its true locations or distances to tasks. In particular, we propose a Probabilistic Winner Selection Mechanism (PWSM) to minimize the total travel distance with the obfuscated information from workers, by allocating each task to the worker who has the largest probability of being closest to it. Moreover, we propose a Vickrey Payment Determination Mechanism (VPDM) to determine the appropriate payment to each winner by considering its movement cost and privacy level, which satisfies the truthfulness, profitability, and probabilistic individual rationality. Extensive experiments on the real-world datasets demonstrate the effectiveness of the proposed mechanisms.

The continuous publication of aggregate statistics over crowd-sourced data to the public has enabled many data mining applications (e.g., real-time traffic analysis). Existing systems usually rely on a trusted server to aggregate the spatio-temporal crowd-sourced data and then apply differential privacy mechanism to perturb the aggregate statistics before publishing to provide strong privacy guarantee. However, the privacy of users will be exposed once the server is hacked or cannot be trusted. In this paper, we study the problem of real-time crowd-sourced statistical data publishing with strong privacy protection under an untrusted server. We propose a novel distributed agent-based privacy-preserving framework, called DADP, that introduces a new level of multiple agents between the users and the untrusted server. Instead of directly uploading the check-in information to the untrusted server, a user can randomly select one agent and upload the check-in information to it with the anonymous connection technology. Each agent aggregates the received crowd-sourced data and perturbs the aggregated statistics locally with Laplace mechanism. The perturbed statistics from all the agents are further combined together to form the entire perturbed statistics for publication. In particular, we propose a distributed budget allocation mechanism and an agent-based dynamic grouping mechanism to realize global w-event ε-differential privacy in a distributed way. We prove that DADP can provide w-event ε-differential privacy for real-time crowd-sourced statistical data publishing under the untrusted server. Extensive experiments on real-world datasets demonstrate the effectiveness of DADP..

As 360-degree videos grow dramatically in popularity, more applications demand the ability to stream 360-degree videos to wirelessly connected devices, such as smartphone headsets. However, the limited capacity and the unstable network conditions make wireless networks ill-suited to the requirements of 360-degree videos--high resolution and low delay. One common approach is to take advantage of the fact that the viewer only watches a small portion of the video around the field of view (FOV). This allows for better allocation of network bandwidth by prioritizing content the viewer actually watches. Previous efforts on 360-degree videos have largely focused on adapting the encoded bitrate to optimize video quality in the time-varying FOV. This paper follows the general FOV-aware approach but uses a different technique. Rather than adapting bitrate, we explore the opportunities of a custom underlying transport protocol for 360-degree videos. In particular, we make a case for using Forward Error Correction (FEC) coding over UDP to reduce video streaming delay (a key limitation of all TCP-based approaches). We present Dante, an FOV-aware UDP-based video streaming protocol that adapts to changing network conditions by dynamically choosing FEC redundancy levels based on how close the video content is to the FOV region. Experimental results show that Dante improves video quality (PSNR) by 20% to 30% over traditional UDP-based video streaming protocols and 40% over FOV-aware DASH.

Pattern lock has been widely used for authentication to protect user privacy on mobile devices (e.g., smartphones and tablets). Several attacks have been constructed to crack the lock. However, these approaches require the attackers to be either physically close to the target device or able to manipulate the network facilities (e.g., wifi hotspots) used by the victims. Therefore, the effectiveness of the attacks is highly sensitive to the setting of the environment where the users use the mobile devices. Also, these attacks are not scalable since they cannot easily infer patterns of a large number of users. Motivated by an observation that fingertip motions on the screen of a mobile device can be captured by analyzing surrounding acoustic signals on it, we propose PatternListener, a novel acoustic attack that cracks pattern lock by leveraging and analyzing imperceptible acoustic signals reflected by the fingertip. It leverages speakers and microphones of the victim's device to play imperceptible audio and record the acoustic signals reflected from the fingertip. In particular, it infers each unlock pattern by analyzing individual lines that are the trajectories of the fingertip and composed of the pattern. We propose several algorithms to construct signal segments for each line and infer possible candidates of each individual line according to the signal segments. Finally, we produce a tree to map all line candidates into grid patterns and thereby obtain the candidates of the entire unlock pattern. We implement a PatternListener prototype by using off-the-shelf smartphones and thoroughly evaluate it using 130 unique patterns. The real experimental results demonstrate that PatternListener can successfully exploit over 90% patterns in five attempts.

With the rich sensing capacity and ubiquitous usage of smartphones, crowdsensing leveraging the power of the crowd of mobile users has become an effective technique to collect data for various sensing applications. Many incentive mechanisms have been proposed to encourage people to participate in crowdsensing. However, most of them set unchangeable rewards for sensing tasks, while the inherent inequality and on-demand feature of sensing tasks have been long ignored, especially for location-dependent sensing tasks. In this paper, we focus on location-dependent crowdsensing systems and propose a demand-based dynamic incentive mechanism that dynamically changes the rewards of sensing tasks at each sensing round in an on-demand way to balance their popularity. A demand indicator is introduced to characterize the demand of each sensing task by considering its deadline, completing progress, and number of potential participants. At each sensing round, we use the Analytic Hierarchy Process to calculate the relative demands of all sensing tasks and then determine their rewards accordingly. Moreover, we prove that the distributed task selection problem with time budget is NP-hard. We propose an optimal dynamic programming based solution and a greedy solution to help each user select tasks while maximizing its profit. Extensive experiments show that the demand-based dynamic incentive mechanism outperforms existing incentive mechanisms.

Event-based social networks (EBSNs) are the newly emerging social platforms for users to publish events online and attract others to attend events offline. The content information of events plays an important role in event recommendation. However, the content-based approaches in existing event recommender systems cannot fully represent the preference of each user on events since most of them focus on exploiting the content information from events' perspective, and the bag-of-words model, commonly used by them, can only capture word frequency but ignore word orders and sentence structure. In this paper, we shift the focus from events' perspective to users' perspective, and propose a Deep User Modeling framework for Event Recommendation (DUMER) to characterize the preference of users by exploiting the contextual information of events that users have attended. Specifically, we utilize convolutional neural network (CNN) with word embedding to deeply capture the contextual information of a user's interested events and build up a user latent model for each user. We then incorporate the user latent model into probabilistic matrix factorization (PMF) model to enhance the recommendation accuracy. We conduct experiments on the real-world dataset crawled from a typical EBSN, Meetup.com, and the experimental results show that DUMER outperforms the compared benchmarks.

In recent years, many schemes have been proposed to disseminate Emergency Warning Messages (EWMs) in VANETs. However, various problems such as broadcast storm, hidden terminal and connectivity issues still persist to reduce the efficacy of these systems. In this paper, we propose a novel Social Utility-based Dissemination Scheme (SUDS) for Emergency Warning Messages in Vehicular Social Networks (VSNs). We utilize social properties of nodes such as centrality, interests and friendships to mitigate broadcast storm and hidden terminal problems. Furthermore, we employ the hybrid architecture of VSNs to solve connectivity and contact duration-related issues in sparse and high mobility environments. For this purpose, we devise a dual-strategy-based mechanism, where vehicles communicate with each other in a distributed or centralized manner according to the required situation. In order to evaluate the performance of proposed scheme, we have conducted extensive experiments for a highway scenario under varying vehicular density, vehicular speed and distance, in comparison with the state-of-the-art dissemination schemes. Simulation results have demonstrated the superiority of SUDS over the compared protocols in terms of delivery ratio, transmission delay and total number of transmissions. We have also demonstrated the positive effects of hybrid architecture of VSNs on various network parameters.

Radio frequency identification (RFID) systems can be applied to efficiently identify the missing items by attaching them with tags. Prior missing tag identification protocols concentrated on identifying all of the tags. However, there may be some scenarios in which we just care about the key tags instead of all tags, making it inefficient to merely identify the missing key tags due to the interference of replies from the ordinary tags (i.e., nonkey tags). In this paper, we propose to investigate the problem of efficiently and completely identifying the missing key tags for anonymous RFID systems in which the tag privacy is required to be well protected. First, we propose a vector-based missing key tag identification protocol called VEKI. Then we propose an improved protocol called iVEKI, which consists of two phases: 1) ordinary tag deactivation and 2) missing key tag identification. The parameters of the proposed VEKI and iVEKI protocols are theoretically optimized to maximize the time efficiency. Finally, we conduct extensive simulations to evaluate the proposed VEKI and iVEKI protocols and the simulation results illustrate that they outperform other existing protocols in terms of execution time.

Narrowband Internet of Things (NB-IoT) is a new cellular technology introduced by the third generation partnership (3GPP) providing low-power and wide-area coverage for IoT. In this paper, we consider the scenario that NB-IoT is deployed in an heterogeneous network and the quality of the direct link from the NB-IoT user equipment (TIE) to the serving base station (BS) cannot satisfy the quality of service requirement for transmission of vital sensing data. Thereupon, device-to-device (D2D) communication is adopted as a routing extension to NB-IoT systems, and thus, enables two-hop routes between NB-IoT TIE and the serving BS via a set of D2D relays. As the candidate TIE relays work in duty cycle to save energy, we derive a model to select a set of TIE relays and perform opportunistic D2D communication according to a working schedule. Two optimization problems are formulated aiming at achieving optimal expected delivery ratio (EDR) and expected two-hop delay, respectively. Dynamic programming-based algorithms are proposed to solve the optimization problems and obtain the optimal working schedule of the relays. Simulation results demonstrate that our proposed maxEDR and minEED algorithms improves the system performance compared with other state-of-the-art algorithms.

Nowadays gigantic crowd-sourced data from mobile devices have become widely available in social networks, enabling the possibility of many important data mining applications to improve the quality of our daily lives. While providing tremendous benefits, the release of crowd-sourced social network data to the public will pose considerable threats to mobile users' privacy. In this paper, we investigate the problem of real-time spatio-temporal data publishing in social networks with privacy preservation. Specifically, we consider continuous publication of population statistics and design RescueDP-an online aggregate monitoring framework over infinite streams with w-event privacy guarantee. Its key components including adaptive sampling, adaptive budget allocation, dynamic grouping, perturbation and filtering, are seamlessly integrated as a whole to provide privacy-preserving statistics publishing on infinite time stamps. Moreover, we further propose an enhanced RescueDP with neural networks to accurately predict the values of statistics and improve the utility of released data. Both RescueDP and the enhanced RescueDP are proved satisfying w-event privacy. We evaluate the proposed schemes with real-world as well as synthetic datasets and compare them with two w-event privacy-assured representative methods. Experimental results show that the proposed schemes outperform the existing methods and improve the utility of real-time data sharing with strong privacy guarantee.

Barcode-based visible light communication (VLC) over screen-camera links has attracted great research interest recently due to its many desirable properties, including being free of charge, free of complex network configurations, and its well-controlled communication security. However, existing VLC systems over screen-camera links suffer from low-communication capacity and reliability, and a lack of transmission feedback from the receiver. In this paper, we design RainBar+, an online robust high-goodput color barcode-based VLC system with realtime feedback, to fully guarantee the communication reliability and exploit the communication capacity under a different link quality. To the best of our knowledge, this is the first system that provides a feasible feedback mechanism to enable the sender to retransmit the lost frames and optimize the barcode configurations. To this end, RainBar+ is designed from three orthogonal perspectives: optimizing the encoding capacity of each frame, fully utilizing the transmission capacity of the sender by solving the frame synchronization problem and adaptively adjusting the barcode configurations, and enabling the selective retransmission via realtime feedback with the speaker-microphone link. Extensive experiments with two commercial off-the-shelf smartphones show that RainBar+ outperforms existing systems and can support realtime high-goodput data communication in dynamic environments.

Digital password lock has been commonly used on mobile devices as the primary authentication method. Researches have demonstrated that sensors embedded on mobile devices can be employed to infer the password. However, existing works focus on either each single keystroke inference or entire password sequence inference, which are user‐dependent and require huge efforts to collect the ground truth training data. In this paper, we design a novel side‐channel attack system, called Niffler, which leverages the user‐independent features of movements of tapping consecutive buttons to infer unlocking passwords on smartphones. We extract angle features to reflect the changing trends and build a multicategory classifier combining the dynamic time warping algorithm to infer the probability of each movement. We further use the Markov model to model the unlocking process and use the sequences with the highest probabilities as the attack candidates. Moreover, the sensor readings of successful attacks will be further fed back to continually improve the accuracy of the classifier. In our experiments, 100,000 samples collected from 25 participants are used to evaluate the performance of Niffler. The results show that Niffler achieves 70% and 85% accuracy with 10 attempts in user‐independent and user‐dependent environments with few training samples, respectively.

Event-based Social Networks (EBSNs) which bridge the gap between online and offline interactions among users have received increasing popularity. The unique cold-start nature makes event recommendation more challenging than traditional recommendation problems, since even for two events with the same content, they may not happen at the same time, the same location, or be organized by the same host. Existing event recommendation algorithms mainly exploit the basic context information (e.g., location, time and content), while the social influence of event hosts and group members have been ignored. In this paper, we propose a Social Information Augmented Recommender System (SIARS), which fully exploits the social influence of event hosts and group members together with basic context information for event recommendation. In particular, we combine the information of EBSNs and other social networks to characterize the social influence of event hosts, and take interactions between group members into consideration for event recommendation. In addition, we propose a new content-aware recommendation model using the topic model to find the most similar topic the event belongs to, and a new location-aware recommendation model integrating location popularity with location distribution for event recommendation. Extensive experiments on real-world datasets demonstrate that SIARS outperforms other recommendation algorithms.

Radio frequency identification (RFID), which promotes the rapid development of Internet of Things (IoT), has been an emerging technology and widely deployed in various applications such as warehouse management, supply chain management, and social networks. In such applications, objects can be efficiently managed by attaching them with low-cost RFID tags and carefully monitoring them. The missing objects, therefore, can be identified by the readers in the RFID system. Most of prior missing tag identification protocols consider the ideal scenario that all the tags' IDs are known to the reader, which ignore that some tags with unknown IDs, called unknown tags, may be present in the system. In this paper, we investigate the problem of efficiently identifying the missing tags with a predefined reliability for large-scale RFID systems with unknown tags. We first propose a basic efficient and reliable missing tag identification protocol called B-ERMI. Then we propose an enhanced protocol called E-ERMI to further improve the efficiency. The parameters of our proposed ERMI protocols are optimized to minimize the execution time. We also conduct extensive simulations to evaluate the proposed ERMI protocols and the simulation results illustrate that the ERMI protocols outperform other existing ones.

With the increasing development of cloud computing, how to securely outsource prohibitively expensive computation to unfaithful clouds has caught more and more attention. Large-scale systems of linear matrix equations (LME) are com-monly deployed in scientific and engineering fields, which is a computationally complex task. Thus, it is necessary to design a protocol for practically outsourcing large-scale systems of LME to a malicious cloud. For this purpose, we propose a protocol called OutLME in this paper. In OutLME, we adopt a special permutation technique for the client to transform the original lin-ear matrix equation into a randomized one and decrypt the result returned from cloud into the right one of original problem. As to robust cheating resistance, we propose an effective verification algorithm by utilizing the algebraic property of matrix-vector operations. In addition, both the chosen permutation technique and result verification mechanism incur close-to-zero additional cost on both the cloud and the client, so our proposed protocol is efficient. In the end, the theoretical analysis and the experimental evaluation are provided to demonstrate the validity of OutLME.

Advances in cloud computing have greatly motivated data owners to outsource their huge amount of personal multimedia data and/or computationally expensive tasks onto the semi-trusted cloud by leveraging its abundant resources for cost saving and flexibility. From the privacy perspective, however, the outsourced multimedia data and its originated applications may reveal the data owner's private information, such as the personal identity, locations or even financial profiles. This observation has recently aroused new research interest on privacy-preserving computations over outsourced multimedia data. In this paper, we propose an effective privacy-preserving computation outsourcing protocol for the prevailing scale-invariant feature transform (SIFT) over massive encrypted image data. We first show that previous solutions to this problem have either efficiency/security or practicality issues, and none can well preserve the important characteristics of the original SIFT in terms of distinctiveness and robustness. We for the first time present a new privacy-preserving outsourcing protocol for SIFT with the preservation of its key characteristics, by randomly splitting the original image data, carefully distributing the feature extraction computations to two independent cloud servers and further leveraging the garbled circuit for secure keypoints comparisons. We both carefully analyze and extensively evaluate the security and effectiveness of our design. The results show that our solution is practically secure, outperforms the state-of-the-art and performs comparably to the original SIFT in terms of various characteristics, including rotation invariance, image scale invariance, robust matching across affine distortion and change in 3D viewpoint.

Nowadays gigantic crowd-sourced data collected from mobile phone users have become widely available, which enables the possibility of many important data mining applications to improve the quality of our daily lives. While providing tremendous benefits, the release of these data to the public will pose a considerable threat to mobile users' privacy. To solve this problem, the notion of differential privacy has been proposed to provide privacy with theoretical guarantee, and recently it has been applied in streaming data publishing. However, most of the existing literature focus on either event-level privacy on infinite streams or user-level privacy on finite streams. In this paper, we investigate the problem of real-time spatiotemporal crowd-sourced data publishing with privacy preservation. Specifically, we consider continuous publication of population statistics for monitoring purposes and design RescueDP-an online aggregate monitoring scheme over infinite streams with privacy guarantee. RescueDP's key components include adaptive sampling, adaptive budget allocation, dynamic grouping, perturbation and filtering, which are seamlessly integrated as a whole to provide privacy-preserving statistics publishing on infinite time stamps. We show that RescueDP can achieve w-event privacy over data generated and published periodically by crowd users. We evaluate our scheme with real-world as well as synthetic datasets and compare it with two w-event privacy-assured representative benchmarks. Experimental results show that our solution outperforms the existing methods and improves the utility with strong privacy guarantee.

Using low duty-cycle is the most common technique to extend the system lifetime in WSNs. However, it also implies limited throughput and long delay and the penalty is even higher under variable traffic patterns. In this paper, we present iQueue-MAC, a hybrid CSMA/TDMA MAC that adapts to variable/bursty traffic. With light load, iQueue-MAC uses a contention-based CSMA mechanism that provides low delay with scattered transmissions. When traffic increases, detected by a forming backlog in the sender, iQueue-MAC changes to a contention-free TDMA mechanism allocating transmission slots. Thus, iQueue-MAC mitigates packet buffering and reduces packet delay, combining the best of TDMA and CSMA. In this paper we also show how iQueue-MAC can operate in both single and multi channel modes. We implemented it on SIM32W108 chips together with other reference WSN protocols for comparison. iQueue-MAC exhibits similar figures during light traffic. However, with bursty traffic its throughput can be five times that of CoSenS and Ri-MAC-MC and its delay 20 times lower. Finally, iQueue-MAC is able to effectively use multiple channels, duplicating its throughput when compared to single channel operation.

Physical layer (PHY) security has aroused great research interest in recent years, exploiting physical uncertainty of wireless channels to provide communication secrecy without placing any computational restrictions on the adversaries under the information-theoretic security model. Particularly, researches have been focused on investigating Wyner's Wiretap Channel for constructing practical wiretap codes that can achieve simultaneous transmission secrecy and reliability. While theoretically sound, PHY security through the wiretap channel has never been realized in practice, and the feasibility and physical limitations of implementing such channels in the real world are yet to be well understood. In this paper, we design and implement a practical opportunistic secret communication system over the wireless wiretap channel for the first time to our best knowledge. We show that, our system can achieve nearly perfect secrecy given a fixed codeword length by carefully controlling the structure of the parity-check matrix of wiretap codes to strike the proper balance between the transmission rate and secrecy. Our system is implemented and evaluated extensively on a USRP N210-based testbed. The experimental results demonstrate the physical limitations and the feasibility of building practical wiretap channels in both the worst channel case and the case where the sender has only the knowledge of instantaneous channel capacities. Our system design and implementation successfully attempts towards bridging the gap between the theoretical wiretap channel and its practice, alleviating the unrealistic and strong assumptions imposed by the theoretical model.

Color barcode-based visible light communication (VLC) over screen-camera links has attracted great research interest in recent years due to its many desirable properties, including free of charge, free of interference, free of complex network configuration and well-controlled communication security. To achieve high-throughput barcode streaming, previous systems separately address design challenges such as image blur, imperfect frame synchronization and error correction etc., without being investigated as an interrelated whole. This does not fully exploit the capacity of color barcode streaming, and these solutions all have their own limitations from a practical perspective. This paper proposes RainBar, a new and improved color barcode-based visual communication system, which features a carefully-designed high-capacity barcode layout design to allow flexible frame synchronization and accurate code extraction. A progressive code locator detection and localization scheme and a robust color recognition scheme are proposed to enhance system robustness and hence the decoding rate under various working conditions. An extensive experimental study is presented to demonstrate the effectiveness and flexibility of RainBar. Results on Android smartphones show that our system achieves higher average throughput than previous systems, under various working environments.

End-to-end delay measurement has been an essential element in the deployment of real-time services in networked systems. Traditional methods of delay measurement based on time domain analysis, however, are not efficient as the network scale and the complexity increase. We propose a novel theoretical framework to analyze the end-to-end delay distributions of networked systems from the frequency domain. We use a signal flow graph to model the delay distribution of a networked system and prove that the end-to-end delay distribution is indeed the inverse Laplace transform of the transfer function of the signal flow graph. Two efficient methods, Cramer’s rule-based method and the Mason gain rule-based method, are adopted to obtain the transfer function. By analyzing the time responses of the transfer function, we obtain the end-to-end delay distribution. Based on our framework, we propose an efficient method using the dominant poles of the transfer function to work out the bottleneck links of the network. Moreover, we use the framework to study the network protocol performance. Theoretical analysis and extensive evaluations show the effectiveness of the proposed approach.

Existing social networking services recommend friends to users based on their social graphs, which may not be the most appropriate to reflect a user's preferences on friend selection in real life. In this paper, we present Friendbook, a novel semantic-based friend recommendation system for social networks, which recommends friends to users based on their life styles instead of social graphs. By taking advantage of sensor-rich smartphones, Friendbook discovers life styles of users from user-centric sensor data, measures the similarity of life styles between users, and recommends friends to users if their life styles have high similarity. Inspired by text mining, we model a user's daily life as life documents, from which his/her life styles are extracted by using the Latent Dirichlet Allocation algorithm. We further propose a similarity metric to measure the similarity of life styles between users, and calculate users' impact in terms of life styles with a friend-matching graph. Upon receiving a request, Friendbook returns a list of people with highest recommendation scores to the query user. Finally, Friendbook integrates a feedback mechanism to further improve the recommendation accuracy. We have implemented Friendbook on the Android-based smartphones, and evaluated its performance on both small-scale experiments and large-scale simulations. The results show that the recommendations accurately reflect the preferences of users in choosing friends.

With advances in vehicle-to-vehicle communication, future vehicles will have access to a communication channel through which messages can be sent and received when two get close to each other. This enabling technology makes it possible for authenticated users to send queries to those vehicles of interest, such as those that are located within a geographic region, over multiple hops for various application goals. However, a naive method that requires flooding the queries to each active vehicle in a region will incur a total communication overhead that is proportional to the size of the area and the density of vehicles. In this paper, we study the problem of spatial queries for vehicle networks by investigating probabilistic methods, where we only try to obtain approximate estimates within desired confidence intervals using only sublinear overheads. We consider this to be particularly useful when spatial query results can be made approximate or not precise, as is the case with many potential applications. The proposed method has been tested on snapshots from real world vehicle network traces.

Barrier coverage is a critical issue in wireless sensor networks for security applications (e.g., border protection), the performance of which is highly related with locations of sensor nodes. Existing work on barrier coverage mainly assume that sensor nodes have accurate location information, however, little work explores the effects of location errors on barrier coverage. In this paper, we study the barrier coverage problem when sensor nodes have location errors and deploy mobile sensor nodes to improve barrier coverage if the network is not barrier covered after initial deployment. We analyze the relationship between the true distance and the measured distance of two stationary sensor nodes and derive the minimum number of mobile sensor nodes needed to connect them with a guarantee when nodes location errors. Furthermore, we propose a fault tolerant weighted barrier graph, based on which we prove that the minimum number of mobile sensor nodes needed to form barrier coverage with a guarantee is the length of the shortest path on the graph. Simulation results validate the correctness of our analysis.

ABSTRACT There are some biometrics‐based three‐factor remote user authentication schemes proposed by researchers for ensure high security features for network‐based application systems. Recently, Das pointed out the security flaws of Li and Hwang's three‐factor remote user authentication scheme, and proposed an enhanced biometrics‐based three‐factor remote user authentication scheme. Das's scheme overcomes the defects of Li and Hwang's scheme, and maintains the advantages of Li and Hwang's scheme at the same time. However, after detailed analysis, we find that Das's scheme remains vulnerable to forgery attack and stolen smart card attack; at the same time, Das's scheme cannot provide the session key agreement after the mutual authentication. To provide more security features, we design a three‐factor remote user authentication scheme with key agreement using biometrics. Copyright © 2013 John Wiley & Sons, Ltd.

Barrier coverage is a critical issue in wireless sensor networks for security applications (e.g., border protection) where directional sensors (e.g., cameras) are becoming more popular than omni-directional scalar sensors (e.g., microphones). However, barrier coverage cannot be guaranteed after initial random deployment of sensors, especially for directional sensors with limited sensing angles. In this paper, we study how to efficiently use mobile sensors to achieve \(k\) -barrier coverage. In particular, two problems are studied under two scenarios. First, when only the stationary sensors have been deployed, what is the minimum number of mobile sensors required to form \(k\) -barrier coverage? Second, when both the stationary and mobile sensors have been pre-deployed, what is the maximum number of barriers that could be formed? To solve these problems, we introduce a novel concept of weighted barrier graph (WBG) and prove that determining the minimum number of mobile sensors required to form \(k\) -barrier coverage is related with finding \(k\) vertex-disjoint paths with the minimum total length on the WBG. With this observation, we propose an optimal solution and a greedy solution for each of the two problems. Both analytical and experimental studies demonstrate the effectiveness of the proposed algorithms.

Along with the rapid increasing energy consumption, the energy cost of Internet data centers (IDCs) has been skyrocketing. A novel scheme of geographical load balancing was proposed to reduce electricity bills for service providers. However, one important challenge faced by service providers has not been considered properly. In service systems, the service delay faced by consumers includes the queuing delay and the transmission delay. While existing work only consider the queuing delay, the transmission delay introduced by geographical load balancing has been overlooked. It is one of the most important factors affecting the quality of service for real-time service systems. In this paper, we take the transmission delay into our design consideration and formulate a mixed-integer nonlinear programming (MINLP) problem with coupled constraint to achieve the optimal load balancing and energy cost management for IDCs while meeting the service-level agreements (SLA) of consumers. A novel heuristic based branch and bound with feedback (HBBF) algorithm is proposed to decouple the MINLP problem with coupled constraint efficiently. Extensive performance evaluations based on real electricity price data and site-to-site transmission delay data demonstrate the effectiveness of our proposed algorithm.

Barrier coverage is a critical issue in wireless sensor networks for security applications (e.g., border protection) where directional sensors (e.g., cameras) are becoming more popular and advantageous than omni-directional scalar sensors for the extra dimensional information they provide. However, barrier coverage can not be guaranteed after initial random deployment of sensors, especially for directional sensors with limited sensing angles. In this paper, we study how to efficiently achieve barrier coverage in hybrid directional sensor networks by moving mobile sensors to fill in gaps and form a barrier with stationary sensors. In specific, we introduce the notion of directional barrier graph to model the barrier coverage formation problem. We prove that the minimum number of mobile sensors required to form a barrier with stationary sensors is the length of the shortest path from the source node to the destination node on the directional barrier graph. We then formulate the problem of minimizing the cost of moving mobile sensors to fill in the gaps on the shortest path as a minimum cost bipartite assignment problem, and solve it in polynomial time using the Hungarian algorithm. Both analytical and experimental studies demonstrate the effectiveness of the proposed algorithm.

Duty-cycling technique has been widely adopted in MAC protocols for wireless sensor networks to conserve energy. However, low duty-cycle also leads to limited throughput in most of existing solutions. In this paper, we propose iQueue-MAC to provide immediate yet energy-efficient throughput enhancement for dealing with burst or heavy traffic. Combined with CSMA/CA, iQueue-MAC makes use of queue length of each sensor node and allocates suitable TDMA slots to them for packets transmission. During light traffic period, no extra slots will be allocated; iQueue-MAC acts like other low duty-cycle MACs to conserve power. While in burst or heavy traffic period, iQueue-MAC senses the build up of packet queues and dynamically schedules adequate number of slots for packet transmission. We have implemented iQueue-MAC on STM32W108 chips that offer IEEE 802.15.4 standard communication. We set up several real-world experimental scenarios, including a 46 nodes multi-hop test-bed for simulating a general application, and conducted numerous experiments to evaluate iQueue-MAC, in comparison with other traffic adaptive duty-cycle protocols, such as multi-channel version RI-MAC and CoSenS. Results clearly show that iQueue-MAC outperforms multi-channel version of RI-MAC and CoSenS in terms of packet delay and throughput.

Target tracking is a typical and important application of wireless sensor networks (WSNs). Existing target tracking protocols focus mainly on energy efficiency, and little effort has been put into network management and real-time data routing, which are also very important issues for target tracking. In this paper, we propose a scalable cluster-based target tracking framework, namely the hierarchical prediction strategy (HPS), for energy-efficient and real-time target tracking in large-scale WSNs. HPS organizes sensor nodes into clusters by using suitable clustering protocols which are beneficial for network management and data routing. As a target moves in the network, cluster heads predict the target trajectory using Kalman filter and selectively activate the next round of sensors in advance to keep on tracking the target. The estimated locations of the target are routed to the base station via the backbone composed of the cluster heads. A soft handoff algorithm is proposed in HPS to guarantee smooth tracking of the target when the target moves from one cluster to another. Under the framework of HPS, we design and implement an energy-efficient target tracking system, HierTrack, which consists of 36 sensor motes, a sink node, and a base station. Both simulation and experimental results show the efficiency of our system.

With the development of social networks, it has been increasingly easier to make friends on the Internet. However, it may not be as easy to automatically find a friend with "similar interests". In this paper, we develop a novel system that allows users with similar interests to be quickly introduced based on the similarity of pictures they took. A real online system, named Friendbook, is implemented on a smartphone network. Due to the limited resources on a smartphone as well as privacy issues, instead of directly comparing the original pictures for similarity measure, Friendbook uses "feature-based" picture comparison. By comparing features extracted from pictures taken by people who want to make friends, their similarity in interests can be automatically inferred based on the content of these pictures. We refer to friends made through Friendbook as "S-friend" for "Semantic-friend". The system also demonstrates the difference between S-friend matching with geographic-based G-friend matching.

Target tracking is a typical and important application of wireless sensor networks (WSNs). A lot of target tracking protocols have been proposed, whereas few of them are implemented into real systems. In this paper, we develop a real target tracking system, called HieTrack, for energy efficient and real-time target tracking in WSNs. The system relies on the cluster-based network architecture and contends for network cost minimization by selectively activating appropriate senor nodes according to the prediction of target trajectory. The estimated locations of the target can be routed to the base station via the backbone composed by the cluster heads. A graphical user interface (GUI) is also designed complementarily to facilitate users while monitoring the status of the sensor network. The efficiency of our system is validated by experiments.

Node localization becomes an important issue in the wireless sensor network as its broad applications in environment monitoring, emergency rescue and battlefield surveillance, etc. Basically, the DV-Hop localization mechanism can work well with the assistance of beacon nodes that have the capability of self-positioning. However, if the network is invaded by a wormhole attack, the attacker can tunnel the packets via the wormhole link to cause severe impacts on the DV-Hop localization process. The distance-vector propagation phase during the DV-Hop localization even aggravates the positioning result, compared to the localization schemes without wormhole attacks. In this paper, we analyze the impacts of wormhole attack on DV-Hop localization scheme. Based on the basic DV-Hop localization process, we propose a label-based secure localization scheme to defend against the wormhole attack. Simulation results demonstrate that our proposed secure localization scheme is capable of detecting the wormhole attack and resisting its adverse impacts with a high probability.