Vision–Language–Action (VLA) models underpin robotic and other embodied agents by mapping visual observations and language instructions into executable actions. Their wide adoption through open web model repositories, however, introduces new supply-chain risks: adversaries can launch adversarial attacks to manipulate the action outputs of VLAs, potentially leading to harmful real-world outcomes for embodied agents. To exploit this vulnerability, we propose MAVLA, a novel multimodal adversarial attack framework. MAVLA serves as a modular front-end that integrates seamlessly with a target VLA model, injecting perturbations into task-relevant and structure-sensitive image regions to disrupt cross-modal alignment and induce deviations in the generated action instructions. To balance attack effectiveness with stealth, we design four loss functions that jointly maximize multimodal misalignment while preserving visual stealthiness. Extensive evaluations in simulated and real-world scenarios show that at a 40% perturbation ratio, the task success rate of VLAs drops by about 70%. Compared to conventional attack baselines, MAVLA achieves superior attack effectiveness and stealthiness with low overhead. Our work reveals a practical and previously underexplored threat to embodied systems, and offers a red-team baseline to inform future defensive strategies and promote safer VLA deployment.

Abstract Backdoor attacks pose a serious threat to Internet-of-Things (IoT) federated learning. In IoT deployments, pronounced non-independent and identically distributed (non-IID) data heterogeneity causes benign client updates to exhibit substantial variability across devices. Meanwhile, the physical exposure of IoT devices increases the risk of large-scale compromise and elevated malicious participation. Such variability allows poisoned updates to blend into natural fluctuations, rendering many robust aggregation and detection-based defenses unreliable. We propose FedDSG , a server-side defense that combines a semantic bias filter and a geometric direction constraint to counter backdoor manipulation. FedDSG first extracts a novel scale-invariant semantic cue from the last-layer bias of client updates to identify abnormal target-class reinforcement, staying effective even when benign bias patterns differ substantially across clients. The remaining updates are then constrained using a reference derived from a small trusted anchor set, limiting adversarial drift. This sequential design links semantic cues with geometric structure, where the former removes clearly suspicious updates and the latter stabilizes the residual ones, preventing misdetection-induced drift amplification while avoiding distortion of benign updates. The method does not alter client behavior or communication and adds minimal server-side overhead. Extensive experiments on MNIST, Fashion-MNIST, CIFAR-10, and SVHN under non-IID distributions with high malicious participation demonstrate the robustness of FedDSG. It reduces the attack success rate to 0.003, 0.006, 0.007, and 0.091, respectively, with only marginal accuracy loss and consistently achieves the highest Overall Performance Score (OPS), reflecting a superior trade-off between robustness and accuracy. Code and data availability information is provided in the Availability of data and materials section.

Federated learning is an essential distributed model training technique. However, threats such as gradient inversion attacks and poisoning attacks pose significant risks to both privacy of training data and model correctness. We propose SMTFL, a novel approach for secure model training in federated learning. To safeguard gradients privacy against gradient inversion attacks, clients are dynamically grouped, allowing one client's gradient to be divided to obfuscate the gradients of other clients within the group. This method incorporates checks and balances to reduce the collusion for inferring specific client data. To detect poisoning attacks from malicious clients, we assess the impact of aggregated gradients on the global model's performance, enabling effective identification and exclusion of malicious clients. Each client's gradients are encrypted and stored, with decryption collectively managed by all clients. The detected poisoning gradients are invalidated from the global model through an unlearning method. Compared to related work, SMTFL does not rely on trusted participants, avoids the performance degradation caused with traditional noise-injection, and avoids complex homomorphic encryption during gradient aggregation. SMTFL is evaluated on five datasets, and these results demonstrate its effectiveness in defending against gradient inversion and poisoning attacks. The model accuracy is nearly restored to its pre-attack state when SMTFL is deployed. Furthermore, SMTFL achieves over 95% accuracy in identifying malicious clients while maintaining a false positive rate for honest clients within 5%, which is 6% lower than the latest methods.

Code reuse in software development frequently facilitates the spread of vulnerabilities, making the scope of affected software in CVE reports imprecise. Traditional methods primarily focus on identifying reused vulnerability code within target software, yet they cannot verify if these vulnerabilities can be triggered in new software contexts. This limitation often results in false positives. In this paper, we introduce TransferFuzz, a novel vulnerability verification framework, to verify whether vulnerabilities propagated through code reuse can be triggered in new software. Innovatively, we collected runtime information during the execution or fuzzing of the basic binary (the vulnerable binary detailed in CVE reports). This process allowed us to extract historical traces, which proved instrumental in guiding the fuzzing process for the target binary (the new binary that reused the vulnerable function). TransferFuzz introduces a unique Key Bytes Guided Mutation strategy and a Nested Simulated Annealing algorithm, which transfers these historical traces to implement trace-guided fuzzing on the target binary, facilitating the accurate and efficient verification of the propagated vulnerability. Our evaluation, conducted on widely recognized datasets, shows that TransferFuzz can quickly validate vulnerabilities previously unverifiable with existing techniques. Its verification speed is 2.5 to 26.2 times faster than existing methods. Moreover, TransferFuzz has proven its effectiveness by expanding the impacted software scope for 15 vulnerabilities listed in CVE reports, increasing the number of affected binaries from 15 to 53. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/TransferFuzz.

Function name inference in stripped binaries is a crucial task that supports various security applications, including vulnerability detection and malware analysis. Existing methods suffer from limited model capacity and insufficient exploitation of function semantics, which constrains their ability to comprehend binary code and leads to poor generalization on unseen binaries. To address these problems, we propose BinLLM, a novel framework that leverages large language models (LLMs) to exploit the semantic potential of binary code, thereby enhancing function name inference. Specially, BinLLM integrates three key innovations: (1) source code semantics-guided function name refinement, which mitigates the negative effects of low-quality semantic identifiers during training; (2) A context-aware data collection algorithm that seeks richer semantic dependencies to improve model training and inference performance; (3) parameter-efficient fine-tuning on a domain-specific dataset enriched with semantic knowledge to enhance the model's understanding of binary semantics. These components collectively enhance the model's performance in function name inference on unseen binaries. We evaluate BinLLM on a large-scale dataset comprising$2,864,719$functions across four architectures (x86-64, x86-32, ARM, MIPS) and four optimization levels ($\mathrm{O} 0-\mathrm{O} 3$). Experimental results show that BinLLM achieves substantial improvements over state-of-the-art (SOTA) methods, with relative gains of$320.1 \%, 274.8 \%$, and 297.6 % in precision, recall, and F1-score. Ablation studies further validate the effectiveness of each component in enhancing overall performance.

Binary Code Similarity Detection (BCSD), essential for binary-code related tasks like vulnerability detection, has attracted increasing attention in recent years. However, existing methods frequently fall short of achieving both high precision and recall at scale, and their results often lack interpretability due to the neglect of function context and reliance on purely similarity-driven outputs. Our key insights are twofold: 1) Binary functions are not self-contained; they depend on other code and data beyond their content to fulfill their functionalities. 2) Large language models (LLMs) excel not only at analyzing code but also at generating reasonable explanations. Motivated by these insights, we propose a general BCSD framework, Co2F uLL. We first systematically select stable and representative code and data features, along with their corresponding dependencies on the functions, to construct the function context. Then, by fusing function context with content similarities computed by the existing BCSD approach, we substantially narrow down the search space. Ultimately, we employ LLMs with a carefully designed prompt to verify the remaining candidates and produce clear, human-readable explanations. We conduct comprehensive experiments on a large function pool under varying compilation settings and after binary stripping. The results show that Co2F uLL based on HermesSim and DeepSeek-V3 achieves 80.5% precision and 94.4% recall, improving the baseline HermesSim by 142.5% and 42.2%, respectively, providing an accurate and interpretable solution for BCSD.

With the rapid ubiquity of Internet of Things (IoT) technology, a growing number of devices are being connected to the Internet, thereby increasing the potential for cyberattacks. For instance, due to firmware compatibility issues and release delays, N-day vulnerabilities pose significant threats to IoT devices that run outdated firmware versions. Consequently, accurately and efficiently identifying firmware versions of devices is crucial for detecting device vulnerabilities and enhancing the security of IoT ecosystems. In this work, we present DeepFW, which utilizes a Fusion Feature Attention Network (FFAN) to extract subtle differences in embedded web interfaces within the firmware, facilitating the identification of firmware versions in online IoT devices. To address the challenge of high similarity between versions caused by firmware homogeneity in the supply chain, we propose a novel metric loss, namely the Hard Mining Cosine Triplet-Center Loss (HCTCL), to improve intraclass compactness and inter-class separability. To validate the effectiveness of our method, we collected 4,442 firmware images and obtained $\mathbf{1 3 0, 4 4 5}$ valid embedded web pages. Experimental results show that DeepFW outperforms the state-of-the-art approaches by over $25 \%$ on average in both precision and recall. Furthermore, DeepFW revealed that only $2.28 \%$ of devices in our dataset were running the latest firmware version. Our evaluation also indicates that $\mathbf{6, 6 8 4}$ devices (approximately $\mathbf{6 1. 2 6 \%}$) with outdated firmware versions remain vulnerable to known exploits.

Home and workplace networks typically safeguard against external threats but allow internal devices to communicate freely with each other. As a result, malicious code on an internal device can collect sensitive data about other devices or directly attack them. In this paper, we study mobile apps as potential sources of local network attacks, analyse their behaviour, design new defences, and evaluate and bypass existing mitigations. We first focus on Android, where apps with only the Internet permission can access all devices in the Local Area Network (LAN), meaning malicious apps can extract private LAN data, manipulate discovery protocols to obtain a Machine-in-the-Middle (MitM) position, and directly attack devices. To defend against such mobile-based attacks, we define an access model to securely differentiate between LAN and global Internet access. We implement this model on Android by creating LANShield: an app that refines Android's permission model, and can monitor and block LAN access of apps using a virtual network interface. We use LANShield to manually perform tests of 399 Android apps and find, among other observations, that 89 apps unexpectedly access the LAN, and 93 apps scan the network. In contrast to Android, iOS already separates the local and global Internet, but does so based on a proprietary LAN access model. We compare this access model to ours, and present multiple bypasses for an app to circumvent Apple's local network permission. Finally, we reported all our findings to affected vendors, and hope our work will motivate the adoption of stronger permission models on mobile devices.

The intrusion detection system (IDS) ensures the safe and stable operation of the industrial control system (ICS). However, due to the lack of data in ICS and the influences of numerous communication protocols, the detection performance of the IDS constructed with the unbalanced dataset of ICS is limited. In this article, a causal inference-based adversarial adaptive approach is proposed to improve the detection performance. First, the data feature space mapping between cross-domain datasets is realized through causal inference. Second, the graph structure relationship and time series features contained in the data features are mined and two-dimensional. Finally, IDS is constructed through common domain-adversarial transfer learning based on high-impact features and fine-tuning based on remaining features. This method can not only construct a cross-application or cross-protocol IDS with a high F1-score for imbalanced data, but also detect some new attacks in the target domain. As for the problem of cross-domain data imbalance, the F1-scores of the trained ICS model in the two cross-domain tasks respectively reached 97.27% and 97.78%. In the detection of new attacks in the target domain, the trained ICS model achieved an average F1-score of 97% for known attacks and the best F1-scores of the two cross-domain tasks reached 90% and 56%.

Asynchronous pipeline model parallelism with a “1F1B” (one forward, one backward) schedule generates little bubble overhead and always provides quite a high throughput. However, the “1F1B” schedule inevitably leads to weight inconsistency and weight staleness issues due to the cross-training of different mini-batches across GPUs. To simultaneously address these two problems, in this paper, we propose an optimizer-dependent weight prediction strategy (a.k.a PipeOptim) for asynchronous pipeline training. The key insight of our proposal is that we employ a weight prediction strategy in the forward pass to approximately ensure that each mini-batch uses consistent and staleness-free weights to compute the forward pass of the “1F1B” schedule. To be concrete, we first construct the weight prediction scheme based on the update rule of the used optimizer when training the deep neural network models. Then throughout the “1F1B” pipeline training, each mini-batch is mandated to execute weight prediction, subsequently employing the predicted weights to perform the forward pass. As a result, PipeOptim 1) inherits the advantage of the “1F1B” schedule and generates high throughput, and 2) can ensure effective parameter learning regardless of the type of the used optimizer. We conducted extensive experimental evaluations using nine different deep-learning models to verify the effectiveness of our proposal. The experiment results demonstrate that PipeOptim outperforms the other five popular pipeline approaches including GPipe, PipeDream, PipeDream-2BW, SpecTrain, and XPipe.

In edge computing, offloading complex computation tasks from terminals to nearby edge nodes (ENs) is a critical solution. When an EN cannot complete the tasks independently, it offloads partial tasks to other ENs. These ENs return the results to the original EN, which integrates them before sending the final output to the terminal. This process, called cooperative task offloading, introduces significant security challenges, especially since ENs are typically provided by third parties. Some ENs, driven by self-interest or vulnerability to attack, may provide incorrect results to other ENs (i.e., acting as malicious ENs), ultimately causing the terminal to receive incorrect results. While existing schemes can help terminals detect incorrect results, they fail to locate the malicious ENs, leaving the system in an unreliable state and causing invalid computations based on erroneous intermediate results. We propose a reputation-driven gradual verification scheme (RDGV) to identify and locate malicious ENs. In RDGV, each EN is held accountable for the correctness of its results and faces penalties if the results are found to be incorrect. Successor ENs must verify the intermediate results before utilizing them. That is, gradual verification. An economic incentive rule counters potential attacks from malicious ENs, while reputation, representing EN’s trustworthiness, guides a personalized verification strategy to reduce overall verification overhead. The effectiveness and advantages of RDGV are shown by simulation results and comparison with related work. The findings indicate that honest and continuous service is the optimal strategy for ENs to maintain the credibility of the edge system.

Federated Learning (FL) exhibits privacy vulnerabilities under gradient inversion attacks (GIAs), which can extract private information from individual gradients. To enhance privacy, FL incorporates Secure Aggregation (SA) to prevent the server from obtaining individual gradients, thus effectively resisting GIAs. In this paper, we propose a stealthy label inference attack to bypass SA and recover individual clients’ private labels. Specifically, we conduct a theoretical analysis of label inference from the aggregated gradients that are exclusively obtained after implementing SA. The analysis results reveal that the inputs (embeddings) and outputs (logits) of the final fully connected layer (FCL) contribute to gradient disaggregation and label restoration. To preset the embeddings and logits of FCL, we craft a fishing model by solely modifying the parameters of a single batch normalization (BN) layer in the original model. Distributing client-specific fishing models, the server can derive the individual gradients regarding the bias of FCL by resolving a linear system with expected embeddings and the aggregated gradients as coefficients. Then the labels of each client can be precisely computed based on preset logits and gradients of FCL’s bias. Extensive experiments show that our attack achieves large-scale label recovery with 100% accuracy on various datasets and model architectures.

It is well known that machine learning models (e.g., image recognition) can unintentionally leak information about the training set. Conventional membership inference relies on posterior vectors, and this task becomes extremely difficult when the posterior is masked. However, current label-only membership inference attacks require a large number of queries during the generation of adversarial samples, and thus incorrect inference generates a large number of invalid queries. Therefore, we introduce a label-only membership inference attack based on model explanations. It can transform a label-only attack into a traditional membership inference attack by observing neighborhood consistency and perform fine-grained membership inference for vulnerable samples. We use feature attribution to simplify the high-dimensional neighborhood sampling process, quickly identify decision boundaries and recover a posteriori vectors. It also compares different privacy risks faced by different samples through finding vulnerable samples. The method is validated on CIFAR-10, CIFAR-100 and MNIST datasets. The results show that membership attributes can be identified even using a simple sampling method. Furthermore, vulnerable samples expose the model to greater privacy risks.

Constrained by the high acquisition and labeling cost, traffic data in industrial control systems (ICSs) are usually extremely imbalanced. Deep-learning-based (DL) industrial control intrusion detection systems (IDSs) are not applicable to dynamic networks and show a limited detection performance. In this article, we enhanced the information transmission link in adversarial domain adaptation (DA) and proposed an information-enhanced adversarial DA (IADA) method. Our method could train a cross-domain industrial intrusion detection deep model with imbalanced data and maintained high detection accuracy. The experimental results based on SCADA network layer data showed that the detection accuracy of the gated recurrent unit model trained in IADA reached 93.7% and 91.3% in the two transfer tasks with a significant cross-domain discrepancy.

Although time-series data collected from users can be utilized to provide services for various applications, they could reveal sensitive information about users. Recently, local differential privacy (LDP) has emerged as the state-of-art approach to protect data privacy by perturbing data locally before outsourcing. However, existing works based on LDP perturb each data point separately without considering the correlations between consecutive data points in time-series. Thus, the important patterns of each time-series might be distorted by existing LDP-based approaches, leading to severe degradation of data utility. In this paper, we focus on real-time data collection under a honest-but-curious server, and propose a novel pattern-aware privacy-preserving approach, called PatternLDP, to protect data privacy while the pattern of time-series can still be preserved. To this end, instead of providing the same level of privacy protection at each data point, each user only samples remarkable points in time-series and adaptively perturbs them according to their impacts on local patterns. In particular, we propose a pattern-aware sampling method based on Piecewise Linear Approximation (PLA) to determine whether to sample and perturb current data point. To reduce the utility loss caused by pattern change after perturbation, we propose an importance-aware randomization mechanism to adaptively perturb sampled data locally while achieving better trade-off between privacy and utility. A novel metric-based w-event privacy is introduced to measure the privacy protection degree for pattern-rich time-series. We prove that PatternLDP can provide the above privacy guarantee, and extensive experiments on real-world datasets demonstrate that PatternLDP outperforms existing mechanisms and can effectively preserve the important patterns.

IPFS [1] is a peer-to-peer version controlled filesystem that synthesizes learnings from many previous successful systems. IPFS combines a distributed Hash table, an incentivized block exchange, and a self-certifying namespace [1]. IPFS is a peer-to-peer hypermedia protocol to make the web faster, safer, and more open. According to the characteristics of IPFS, we propose an improved P2P file system scheme based on IPFS and Blockchain. We address the high-throughput problem for individual users in IPFS by introducing the role of content service providers. Consider data reliability and availability, storage overhead and other issues for service providers, we provide a novel zigzag-based storage model to improve the block storage model that IPFS provides. Moreover, we introduce blockchain to combine IPFS with this storage model. According to analysis, this proposed scheme can effectively solve the above problems.

IP geolocation determines geographic location by the IP address of Internet hosts. The physical location of Internet hosts is critical for many location-aware applications. Most geolocation methods are based on linear assumption of correlation between network latency and geographic distance on a large scale. In this paper, a lightweight geolocation approach is proposed to accurately determine the location of Internet hosts. This approach takes advantage of relative delay measurement and common routers. We studied localized delay- distance correlation in small region. We proposed an approach of discovering the accurate positions of common routers and converted common routers as secondary landmarks on a small scale and evaluated the efficiency of our method in the city level. The evaluation results show that the proposed algorithm improves the accuracy of IP geolocation by about 9.5% compared to Street-level Geolocation (SLG), one of the latest methods.

A typical application of wireless sensor networks is navigation for emergency evacuation whose goal is to guide people escaping from hazardous areas safely and quickly. In practical scenarios, the evacuating time depends not only on the length of the path but also on the congestion degree. However, as far as we know, the state of art fails to quantify congestion degree accurately in evacuation process. In this paper, we propose a novel congestion-aware navigation algorithm which has several key advantages: First, we use the concept of moving speed to evaluate the congestion degree to accurately estimate the evacuating time. Second, we avoid the frequent in-situ interactions between users and the navigation system by using the sensors at intersections for displaying the escape directions. Third, our algorithm can reduce the direction oscillations due to the network communication delay and adapt to the variation of hazardous regions. We evaluate our algorithm by simulations under various realistic settings. Simulation results show that our algorithm has the shorter evacuating time and fewer oscillations than state-of-the-art work.