In recent years, text-to-image (T2I) diffusion models have gained significant attention for their ability to generate high quality images reflecting text prompts. However, their growing popularity has also led to the emergence of backdoor threats, posing substantial risks. Currently, effective defense strategies against such threats are lacking due to the diversity of backdoor targets in T2I synthesis. In this paper, we propose NaviT2I, an efficient input-level backdoor defense framework against diverse T2I backdoors. Our approach is based on the new observation that trigger tokens tend to induce significant neuron activation variation in the early stage of the diffusion generation process, a phenomenon we term Early-step Activation Variation. Leveraging this insight, NaviT2I navigates T2I models to prevent malicious inputs by analyzing Neuron activation variations caused by input tokens. Extensive experiments show that NaviT2I significantly outperforms the baselines in both effectiveness and efficiency across diverse datasets, various T2I backdoors, and different model architectures including UNet and DiT. Furthermore, we show that our method remains effective under potential adaptive attacks.

To enhance the safety of VLMs, this paper introduces a novel reasoning-based VLM guard model dubbed GuardReasoner-VL. The core idea is to incentivize the guard model to deliberatively reason before making moderation decisions via online RL. First, we construct GuardReasoner-VLTrain, a reasoning corpus with 123K samples and 631K reasoning steps, spanning text, image, and text-image inputs. Then, based on it, we cold-start our model's reasoning ability via SFT. In addition, we further enhance reasoning regarding moderation through online RL. Concretely, to enhance diversity and difficulty of samples, we conduct rejection sampling followed by data augmentation via the proposed safety-aware data concatenation. Besides, we use a dynamic clipping parameter to encourage exploration in early stages and exploitation in later stages. To balance performance and token efficiency, we design a length-aware safety reward that integrates accuracy, format, and token cost. Extensive experiments demonstrate the superiority of our model. Remarkably, it surpasses the runner-up by 19.27% F1 score on average, as shown in Figure 1. We release data, code, and models (3B/7B) of GuardReasoner-VL: https://github.com/yueliu1999/GuardReasoner-VL.

Audio is an important medium in people’s daily life, secret information can be embedded into audio for covert communication. However, traditional audio information hiding techniques cannot achieve large hiding capacity and good imperceptibility at the same time, and rely on complex encryption, which limits their applicability in resource-constrained Internet of Things (IoT) environments. In this article, we propose a new audio information hiding method, named AdvAudio, which can achieve large high capacity, as well as good imperceptibility, without reliance on cryptographic encryption. Specifically, AdvAudio leverages adversarial example technique to train a well-designed perturbation for cover audio and the secret information can only be extracted by the private automatic speech recognition (ASR) model. To achieve this, we implement two adversarial example algorithms tailored for both online transmission and physical-world transmission scenarios. In particular, our embedding algorithm dynamically adjusts the addition of simulated environmental noise depending on whether the audio is intended to propagate in the physical world. The iterative optimization process is guided by targeted adversarial attack objectives, ensuring that the private ASR model decodes the embedded secret information accurately. Taking DeepSpeech as the private model, we implement a prototype of AdvAudio, which achieves a high embedding capacity of 383.8 bps with excellent imperceptibility, yielding a Perceptual Evaluation of Speech Quality (PESQ) score of 2.351. Furthermore, it offers robust security, achieving a 100% defense success rate against both internal and external attacks. In the physical world, AdvAudio still maintains effectiveness across six different types of noise and retaining 82% accuracy even under sudden loud noises. Additionally, the secret information can only be extracted in the target environment, with a success rate of 26%, and 0% in non-target environments. In the future, we aim at enhancing the steganalysis resistance of AdvAudio and explore its potential applications in various environments or with alternative ASR models.

The rise of new industries, such as the Internet of Things and Smart Healthcare, has brought many cross-cloud business opportunities for cloud computing and posed new challenges to the cloud security. Traditionally, security can be assessed by compliance checking when selecting cloud services. However, when facing cross-cloud security requirements, even if passing the compliance checking, it cannot prove that different clouds have the same security level since they pass different standards. Therefore, security equivalence assessment of different security standards is a fundamental issue. In order to solve the issue automatically, we first transform it into the problem of mapping between control items with respect to different standards. Then, we define three tasks to work out the mapping problem: a task for mapping searching and two for new mapping establishing. Next, we collect, organize, and expand a dataset of mappings between control items containing 21 standards and more than 100,000 pieces of mapping data. Subsequently, we experiment with four well-known models for each task to test their performance on the dataset of mappings: TF-IDF, Word2vec, BERT, and GPT-Neo. Experimental results indicate that the current models can perform very well on the first two tasks but need to be better on the last task.

Representation learning frameworks in unlabeled time series have been proposed for medical signal processing. Despite the numerous excellent progresses have been made in previous works, we observe the representation extracted for the time series still does not generalize well. In this paper, we present a Time series (medical signal) Representation Learning framework via Spectrogram (TRLS) to get more informative representations. We transform the input time-domain medical signals into spectrograms and design a time-frequency encoder named Time Frequency RNN (TFRNN) to capture more robust multi-scale representations from the augmented spectrograms. Our TRLS takes spectrogram as input with two types of different data augmentations and maximizes the similarity between positive ones, which effectively circumvents the problem of designing negative samples. Our evaluation of four real-world medical signal datasets focusing on medical signal classification shows that TRLS is superior to the existing frameworks. We will open-source our code when the paper is accepted.

Text-to-image diffusion models have achieved tremendous success in the field of controllable image generation, while also coming along with issues of privacy leakage and data copyrights. Membership inference arises in these contexts as a potential auditing method for detecting unauthorized data usage. While some efforts have been made on diffusion models, they are not applicable to text-to-image diffusion models due to the high computation overhead and enhanced generalization capabilities. In this paper, we first identify a conditional overfitting phenomenon in text-to-image diffusion models, indicating that these models tend to overfit the conditional distribution of images given the corresponding text rather than the marginal distribution of images only. Based on this observation, we derive an analytical indicator, namely Conditional Likelihood Discrepancy (CLiD), to perform membership inference, which reduces the stochasticity in estimating memorization of individual samples. Experimental results demonstrate that our method significantly outperforms previous methods across various data distributions and dataset scales. Additionally, our method shows superior resistance to overfitting mitigation strategies, such as early stopping and data augmentation.

At present, backdoor attacks attract attention as they do great harm to deep learning models. By poisoning the training data, the adversary makes the model trained based on this dataset being injected with a backdoor. In the field of text, however, existing works do not provide sufficient defense against backdoor attacks. In this paper, we propose a Noise-augmented Contrastive Learning (NCL) framework to defend against textual backdoor attacks when training models with untrustworthy data. With the aim of mitigating the mapping between triggers and the target label, we add appropriate noise perturbing possible backdoor triggers, augment the training dataset, and then pull homology samples in the feature space utilizing contrastive learning objective. Experiments demonstrate the effectiveness of our method in defending three types of textual backdoor attacks, outperforming the prior works.

With the help of conditioning mechanisms, the state-of-the-art diffusion models have achieved tremendous success in guided image generation, particularly in text-to-image synthesis. To gain a better understanding of the training process and potential risks of text-to-image synthesis, we perform a systematic investigation of backdoor attack on text-to-image diffusion models and propose BadT2I, a general multimodal backdoor attack framework that tampers with image synthesis in diverse semantic levels. Specifically, we perform backdoor attacks on three levels of the vision semantics: Pixel-Backdoor, Object-Backdoor and Style-Backdoor. By utilizing a regularization loss, our methods efficiently inject backdoors into a large-scale text-to-image diffusion model while preserving its utility with benign inputs. We conduct empirical experiments on Stable Diffusion, the widely-used text-to-image diffusion model, demonstrating that the large-scale diffusion model can be easily backdoored within a few fine-tuning steps. We conduct additional experiments to explore the impact of different types of textual triggers, as well as the backdoor persistence during further training, providing insights for the development of backdoor defense methods. Besides, our investigation may contribute to the copyright protection of text-to-image models in the future. Our Code: https://github.com/sf-zhai/BadT2I.

The healthcare system is a distributed collaborative system and the sensitivity of the medical data is one of the most important requirements. Preventing unauthorized access to healthcare information and data sharing security in the healthcare environment are critical processes that affect the credibility of the system. To achieve this goal and to meet the requirements of the healthcare system, access control is an important measure to realize the safe sharing of resources. The attribute-based access control (ABAC) model meets the complex security requirements of large and complex systems and provides a dynamic, flexible and scalable solution. The main obstacle to deploying ABAC is the precise development of ABAC policies. Manually developing access control policies is tedious, time-consuming and error prone. Most systems have high-level requirement specifications, which are written in natural language. These natural language (NL) documents have the intended access control policies for the systems. In this paper, we propose a new approach towards extracting policies from natural language documents. By fully taking advantage of Bidirectional Encoder Representations from Transformers (BERT) and Semantic role labeling (SRL), we are able to correctly identify access control policy (ACP) sentences with an average F1 score of 85% and correctly extract rules with an average F1 score of 72%, which outperforms the state-of-the-art and leads to a performance improvement of 7% and 2% respectively over the previously reported results.