Backdoor attacks pose a persistent security risk to deep neural networks (DNNs) due to their stealth and durability. While recent research has explored leveraging model unlearning mechanisms to enhance backdoor concealment, existing attack strategies still leave persistent traces that may be detected through static analysis. In this work, we introduce the first paradigm of revocable backdoor attacks, where the backdoor can be proactively and thoroughly removed after the attack objective is achieved. We formulate the trigger optimization in revocable backdoor attacks as a bilevel optimization problem: by simulating both backdoor injection and unlearning processes, the trigger generator is optimized to achieve a high attack success rate (ASR) while ensuring that the backdoor can be easily erased through unlearning. To mitigate the optimization conflict between injection and removal objectives, we employ a deterministic partition of poisoning and unlearning samples to reduce sampling-induced variance, and further apply the Projected Conflicting Gradient (PCGrad) technique to resolve the remaining gradient conflicts. Experiments on CIFAR-10 and ImageNet demonstrate that our method maintains ASR comparable to state-of-the-art backdoor attacks, while enabling effective removal of backdoor behavior after unlearning. This work opens a new direction for backdoor attack research and presents new challenges for the security of machine learning systems.

In recent years, machine learning and deep learning have made remarkable progress and are now widely applied in various fields, including image classification, autonomous driving, natural language processing, and medical diagnosis. However, training these models requires large datasets, which often contain substantial amounts of sensitive personal information, such as medical records and financial details. Without effective privacy protection measures during model training, the risk of sensitive data leakage increases, potentially resulting in severe privacy violations and a loss of trust. As an innovative data representation technique, the Negative Database has proven to be an effective solution in privacy-sensitive domains. Negative databases can be derived from SAT (Boolean Satisfiability Problem) instances, and the hardness of these instances is directly correlated with the level of data protection provided by the Negative Databases. Developing efficient SAT instance generation algorithms to create harder SAT instances can significantly enhance the privacy protection capabilities of the Negative Database. This paper analyzes the hardness conditions of SAT solvers using the Conflict-Driven Clause Learning strategy and proposes a two-stage SAT instance generation algorithm to generate harder SAT instances. These hard instances not only aid in constructing more secure negative databases for enhanced privacy protection but also provide valuable test cases for evaluating and improving SAT solvers.

Given the immutability of biometric data, it is imperative to develop a biometric template protection method that guarantees the complete non-disclosure of any original biometric information while ensuring high recognition performance. Two mainstream approaches in biometric template protection—cancelable biometrics and biometric cryptosystems—have been widely adopted; however, the protected templates produced by these methods still contain some of the original biometric data, which can lead to privacy leakage. To address these challenges, we propose a novel framework named BioDeepHash that integrates deep hashing with cryptographic hash functions. In our approach, a deep hashing model generates consistent templates for similar biometric data from the same user, thereby eliminating intra-class variations. An application-specific XOR string is then used to achieve revocability, and finally these consistent templates are processed by cryptographic hash functions to produce protected templates that meet strict security standards. Our experimental results show that, compared with existing methods, BioDeepHash increases the average Genuine Acceptance Rate by 10.12% on the iris dataset and by 3.12% on the facial dataset, while achieving an extremely low False Acceptance Rate—0% for the iris dataset and only 0.0002% for the facial dataset.