The widespread deployment of large language models (LLMs) in downstream applications has increased the demand for high-quality system prompts, which have become valuable intellectual assets in the commercial prompt marketplace. Recent studies have demonstrated that system prompts are vulnerable to prompt stealing attacks, where adversaries can extract system prompts from LLM applications by crafting adversarial queries, thereby compromising developers' intellectual property and undermining existing business models. However, prior attack methods suffer from critical limitations including gradient dependency and poor scalability, severely restricting their practical applicability. To address these limitations, we present AGFPS, an automated gradient-free framework that leverages evolutionary optimization to systematically steal prompts. Our approach formulates prompt stealing as a discrete optimization problem, where adversarial queries are modeled as individuals in an evolving population. These individuals are optimized through elite retention, selection, adaptive crossover, and mutation operations. To mitigate local optima convergence, we introduce a progressive fitness evaluation strategy based on adaptive sequence fragmentation that exploits LLMs' autoregressive properties. Comprehensive evaluations across multiple benchmark datasets and mainstream LLMs demonstrates that AGFPS achieves a 95.2% exact system prompt stealing success rate, significantly outperforming manual baselines and surpassing gradient-based methods in 80.6% of scenarios. The generated adversarial queries exhibit remarkable transferability across heterogeneous models and diverse datasets, while maintaining robustness against various defense mechanisms. Our work exposes critical vulnerabilities in current LLM deployment practices and underscores the urgent need for enhanced security measures in LLM applications.

Non-transferable learning (NTL) has emerged as a promising method to protect the intellectual property of deep learning models by restricting cross-domain knowledge transfer. However, the robustness of its transferability constraints against potential attacks has not been explored, especially in practical deployment scenarios. In this paper, we propose a novel black-box attack framework - distribution drift learner (DDL), which effectively bypasses NTL protection mechanisms by only accessing input-output queries of protected models. The theoretical foundation of DDL is derived from the concept of data drift, which takes advantage of the variability of the statistical distribution between the source and target domains. The core innovation of DDL is the integration of distributed perception regularization into a lightweight autoencoder architecture, enabling efficient manipulation of data distribution by optimizing dual objectives (distributed perception loss and reconstruction loss). Training for DDL involves two key steps: First, DDL reconstructs a moderate amount of target domain samples and feeds the reconstructed images into the NTL model to obtain prediction labels. The DDL parameters are then updated by optimizing distributed perception loss and reconstruction loss. Through extensive experiments against standard NTL benchmarks (Digits, CIFAR10, and STL10), we demonstrate that DDL has successfully overcome the barriers of the transferable NTL model and improved the accuracy of the target domain by 81% from 10%. Our work reveals critical vulnerabilities in the NTL framework, particularly with respect to ownership verification and applicability authorization mechanisms, providing valuable insights for developing more robust model protection strategies in real-world applications.

In non-identically and independently distributed (non-IID) data scenarios, traditional federated learning struggles to meet diverse client needs due to the limitations of the global model aggregation. Personalized Federated Learning (PFL) tackles this challenge by improving model personalization for individual clients while preserving the benefits of collaboration. However, existing approaches are hindered by direct aggregation strategies, which lead to gradient conflicts and overly rely on parameter similarity for collaboration evaluation, resulting in unstable generalization. In this paper, we propose FedANC, a PFL framework that learns structured and stable collaborative relationships through three key components: (1) a trusted collaboration graph construction to identify reliable neighbors and filter low-quality paths; (2) a trainable cooperative weight matrix W to adaptively adjust aggregation intensity; and (3) an intermediate parameter mechanism that guides local model alignment using weighted neighbor models, alleviating gradient conflicts. Experiments on image classification tasks under various non-IID distributions show that FedANC achieves higher test accuracy, more stable convergence compared to existing PFL approaches, and demonstrating the effectiveness of learnable and structured cooperation mechanisms.

Recent studies reveal that backdoor attacks are a significant security threat to deep neural networks. Existing defense methods for removing backdoors from victim models often assume that defenders have access to limited clean training data, which is unrealistic in real-world scenarios. Inspired by the biological immune response process, we propose a novel backdoor defense framework comprises three key steps. First, a max-entropy staircase approximator (MSA) is implemented to capture the valid trigger distribution through trigger reconstruction. We then utilize these reconstructed trigger patterns to extract backdoor knowledge from the victim model using a knowledge distillation-based approach. Finally, to completely eliminate the backdoor knowledge, we design a machine unlearning method optimized by maximizing the KL-divergence between the backdoor knowledge representation and the victim model. Our framework relies solely on unlabeled out-of-distribution data, significantly enhancing its practicality. Extensive experiments on various backdoor attacks show that our approach can lower the attack success rates of five state-of-the-art backdoor attacks by an average of 99% and outperforms five state-of-the-art defense methods that rely on clean training data.

Membership inference attacks (MIAs) compromise the privacy of training data through interrogating a victim machine learning model and inferring whether or not a query sample is in the training data. Existing defenses against MIAs include preprocessing the training data of the model, modifying loss functions, and perturbing the inference output. However, all these mechanisms have to change either the training or inference process, which might be out of reach of the defenders, especially when the models are deployed in a third-party cloud service. In this article, we propose preprocessing the query samples before feeding them into the models for inference. Specifically, we design aMembership Cleansermodule to remove the member information in the query sample by moving it closer to non-member area in the feature space. The membership cleanser does not modify the training or inference process of the machine learning model, so it can be applied to any machine learning system. Through extensive evaluation on four datasets against different models, our approach consistently outperforms the state-of-the-art defense mechanisms in resilience and practicality against various MIAs while retaining good inference accuracy.

Numerical vector aggregation plays a crucial role in privacy-sensitive applications, such as distributed gradient estimation in federated learning and statistical analysis of key-value data. In the context of local differential privacy, this study provides a tight minimax error bound of$O(\frac{ds}{n\epsilon ^{2}})$, where$d$represents the dimension of the numerical vector and$s$denotes the number of non-zero entries. By converting the conditional/unconditional numerical mean estimation problem into a frequency estimation problem, we develop an optimal and efficient mechanism called Collision. In contrast, existing methods exhibit sub-optimal error rates of$O(\frac{d^{2}}{n\epsilon ^{2}})$or$O(\frac{ds^{2}}{n\epsilon ^{2}})$. Specifically, for unconditional mean estimation, we leverage the negative correlation between two frequencies in each dimension and propose the CoCo mechanism, which further reduces estimation errors for mean values compared to Collision. Moreover, to surpass the error barrier in local privacy, we examine privacy amplification in the shuffle model for the proposed mechanisms and derive precisely tight amplification bounds. Our experiments validate and compare our mechanisms with existing approaches, demonstrating significant error reductions for frequency estimation and mean estimation on numerical vectors.

In recent years, the exponential advances in cloud computing have upheld cloud data sharing as a prominent service of interest to practitioners. Data leakage risks and lack of fine-grained access control remain significant challenges limiting the wide adoption of cloud data sharing. Ciphertext policy attribute-based encryption (CP-ABE) stands as a promising solution for these issues. Current research in CP-ABE suffers from the key-escrow problem on the trusted key generation center, overlooks user identity sovereignty, and fails to guarantee user attributes’ privacy. This paper proposes a novel key escrow-free CP-ABE scheme that builds upon self-sovereign identity to enable secure and privacy-preserving cloud data sharing. We leverage multi-party computation to develop a novel user key generation protocol. We design a seamless and secure integration between CP-ABE and self-sovereign identity. The experimental and security analyses show that our scheme solves existing issues in CP-ABE while preserving security and flexibility. This research provides new insights to secure data sharing solutions in the cloud.

Privacy-preserving data aggregation (PPDA) enables data availability and privacy preservation simultaneously in smart grid. However, existing methods, such as masking and homomorphic encryption, cannot simultaneously offer strong privacy preservation, fault tolerance for both smart meters and aggregators, verifiable aggregation, and lightweight encryption. To tackle these challenges, we design HTV-PRE, a homomorphic threshold proxy re-encryption scheme with re-encryption verifiability. HTV-PRE involves only linear operations and resists quantum attacks after being instanced by ideal lattices. By leveraging HTV-PRE, we propose a robust and lightweight data aggregation scheme with strong privacy preservation for smart grid. Robustness ensures fault tolerance and error detection. Even if some smart meters or aggregators are faulty, data aggregation can still work without imposing expensive computation on other smart meters or requiring additional trust assumptions. Additionally, to detect aggregators' errors, a proof for the aggregated result is presented so that anyone can verify whether the result has been correctly computed or not. The verifiable aggregation adds no computation/communication overhead on the user side. The performance evaluations demonstrate that our PPDA scheme significantly offloads computation overhead from smart meters and control center to the edge, and its user encryption is up to 4x faster than existing approaches.

Multi-task learning (MTL) supports simultaneous training over multiple related tasks and learns the shared representation. While improving the generalization ability of training on a single task, MTL has higher privacy risk than traditional single-task learning because more sensitive information is extracted and learned in a correlated manner. Unfortunately, very few works have attempted to address the privacy risks posed by MTL. In this article, we first investigate such risk by designing model extraction attack (MEA) and membership inference attack (MIA) in MTL. Then we evaluate the privacy risks on six MTL model architectures and two popular MTL datasets, whose results show that both the number of tasks and the complexity of training data play an important role in the attack performance. Our investigation shows that MTL is more vulnerable than traditional single-task learning under both attacks.

Taking the steganalytic discriminators as the adversaries, the existing Generative Adversarial Networks (GAN)-based steganographic approaches learn the implicit cost functions to measure the embedding distortion for steganography. However, the steganalytic discriminators in these approaches are trained by the stego-samples with insufficient diversity, and their network structures offer very limited representational capacity. As a result, these steganalytic discriminators will not exhibit robustness to various steganographic patterns, which causes learning suboptimal cost functions, thus compromising the anti-steganalysis capability. To address this issue, we propose a novel GAN-based steganographic approach, in which the Diversified Inverse-Adversarial Training (DIAT) strategy and the Steganalytic Feature Attention (SteFA) structure are designed to train a robust steganalytic discriminator. Specifically, the DIAT strategy provides the steganalytic discriminator with an expanded feature space by generating diversified adversarial stego-samples; the SteFA structure enables the steganalytic discriminator to capture more various steganalytic features by employing the channel-attention mechanism on higher-order statistics. Consequently, the steganalytic discriminator can build a more precise decision boundary to make it more robust, which facilitates learning a superior steganographic cost function. Extensive experiments demonstrate that the proposed steganographic approach achieves promising anti-steganalysis capability over the state-of-the-arts under the same embedding payloads.

Deep Learning(DL) techniques have gained significant importance in the recent past due to their vast applications. However, DL is still prone to several attacks, such as the Membership Inference Attack (MIA), based on the memorability of training data. MIA aims at determining the presence of specific data in the training dataset of the model with substitute model of similar structure to the objective model. As MIA relies on the substitute model, they can be mitigated if the substitute model is not clear about the network structure of the objective model. To solve the challenge of shadow-model construction, this work presents L-Leaks, a member inference attack based on Logits. L-Leaks allow an adversary to use the substitute model's information to predict the presence of membership if the shadow and objective model are similar enough. Here, the substitute model is built by learning the logits of the objective model, hence making it similar enough. This results in the substitute model having sufficient confidence in the member samples of the objective model. The evaluation of the attack's success shows that the proposed technique can execute the attack more accurately than existing techniques. It also shows that the proposed MIA is significantly robust under different network models and datasets.

Model extraction attacks (MEAs) allow adversaries to replicate a surrogate model analogous to the target model's decision pattern. While several attacks and defenses have been studied in-depth, the underlying reasons behind our susceptibility to them often remain unclear. Analyzing these implication influence factors helps to promote secure deep learning (DL) systems, it requires studying extraction attacks in various scenarios to determine the success of different attacks and the hallmarks of DLs. However, understanding, implementing, and evaluating even a single attack requires extremely high technical effort, making it impractical to study the vast number of unique extraction attack scenarios. To this end, we present a first-of-its-kind holistic evaluation of implication factors for MEAs which relies on the attack process abstracted from state-of-the-art MEAs. Specifically, we concentrate on four perspectives. we consider the impact of the task accuracy, model architecture, and robustness of the target model on MEAs, as well as the impact of the model architecture of the surrogate model on MEAs. Our empirical evaluation includes an ablation study over sixteen model architectures and four image datasets. Surprisingly, our study shows that improving the robustness of the target model via adversarial training is more vulnerable to model extraction attacks.

As a promising technique of resisting steganalysis detection, generative steganography usually generates a new image driven by secret information as the stego-image. However, it generally encodes secret information as entangled features in a non-distribution-preserving manner for the stego-image generation, which leads to two common issues: 1) limited accuracy of information extraction, and 2) low security in feature-domain. To address the above issues, we propose a generative steganographic framework via auto-generation of semantic object contours, in which a given secret message is encoded as the disentangled features,i.e., object-contours, in a distribution-preserving manner for the stego-image generation. In this framework, we propose a contour generative adversarial nets (CtrGAN) consisting of a contour-generator and a contour-discriminator, which are adversarially trained with reinforcement learning. To realize the generative steganography, by using the contour-generator of the trained CtrGAN, a contour point selection (CPS)-based encoding strategy is designed to encode the secret message as the contours. Then, the BicycleGAN is employed to transform the generated contours to the corresponding stego-image. Extensive experiments demonstrate the proposed steganographic approach achieves superior performance in the aspects of information extraction accuracy, especially under common image attacks, and feature-domain security, compared to the state-of-the-arts.

An increasing number of researchers are turning their attention to signcryption, particularly in the context of multi-receiver communication scenarios, due to its ability to simultaneously provide authentication, integrity, and confidentiality of messages. However, existing signcryption schemes have not been able to fully implement sender unlinkability. Specifically, when a sender signcrypts a secret message and obtains the corresponding ciphertext, the intended recipient must use the sender’s identity or public key to complete the unsigncryption process and retrieve the plaintext. Consequently, the recipient can link the sender via the same identity or public key. To address this issue, we present an Unlinkable Signcryption Scheme for Multi-Receiver (USS-MR). With Chinese Remainder Theorem (CRT), our USS-MR enables a vehicle to send the same secret message to a group of RoadSide Units (RSUs). Additionally, when a new message requires signcryption, the vehicle generates a new key pair, making it impossible for any RSU to link the vehicle through its public key. In our USS-MR, we have adopted a pseudonym mechanism to provide conditional privacy, which hides the real identity of the vehicle through the use of pseudonyms and avoids linking it to the identity. Moreover, if a vehicle is found to engage in malicious behavior, it will not only be tracked but also subjected to revocation. Comprehensive security analyses demonstrate that our USS-MR satisfies various security, privacy, and functionality requirements and effectively resists common attacks in Vehicular Ad-hoc Networks (VANETs). Finally, our USS-MR demonstrates certain advantages in terms of computation and communication when compared to relevant studies. In particular, our USS-MR maintains a consistent communication burden of 388 bytes.

Summary Most of the existing global positioning system (GPS) spoofing detection schemes are vulnerable to the generative GPS spoofing attack, or require additional auxiliary equipment and extensive signal processing capabilities, leading to defects such as low real‐time performance and large communication overhead which are not available for the unmanned aerial vehicle (UAV, also known as drone) system. Therefore, we propose a novel solution which employs information fusion based on the GPS receiver and inertial measurement unit. We use a real‐time model of tracking and calculating to derive the current position of the drones which are then contrasted with the position information received by the receiver to verify whether the presence or absence of spoofing attack. Subsequent experimental work shows that, the proposed method can accurately detect the spoof within 8 seconds, with a detection rate (DR) of 98.6%. Compared with the existing schemes, the performance of real‐time detecting is improved while the DR is ensured. Even in our worst‐case, we detect the spoof within 28 seconds after the UAV system starts its mission.

With recent advances in cloud computing, mobile devices are increasingly being used to record patient physiological parameters, and transfer them to a cloud-based hospital information system, for access control mediation over a variety of stakeholders. In such a cloud-based architecture, the patient must specify an access policy for a group of authorized parties towards its outsourced data. Multiauthority ciphertext-policy attribute-based encryption (CP-ABE) was provided as an innovative cloud-based access control cryptographic primitive to tackle the key escrow issue in a centralized architecture, and boost flexibility through cross-domain attributes management. Existing works, however, still have glaring drawbacks. First, they still rely on a trusted authority to generate and distribute user secret keys. Second, they do not simultaneously provide encryption, decryption, or revocation outsourcing, resulting in high processing and communication cost for both the data sender and the data receiver. Third, they do not support both user and attribute revocation, and the integrity of ciphertext downloaded from the cloud is not always verified at the user end. As a result, this paper exploits the dummy attribute technique and introduces a novel, efficient, and secure multiauthority ciphertext-policy ABE method for mediating access control over medical data, in the mobile cloud. The ciphertext access policy enforcement, partial ciphertext decryption, and both the user and attribute indirect revocation updates are safely outsourced to the cloud server in this study. Theoretical analysis demonstrates that our scheme is efficient and verifiable, and we prove that our construction is secure under the decisional bilinear Diffie-Hellman assumption.

Differentially Private Stochastic Gradient Descent (DP-SGD) is a prime method for training machine learning models with rigorous privacy guarantees. Since its birth, DP-SGD has gained popularity and has been widely adopted in both academic and industrial research. One well-known challenge when using DP-SGD is how to improve utility while maintaining privacy. To this end, recently we have seen several proposals that clip the gradients with adaptive thresholds rather than a fixed one. Although each proposal comes with some theoretical justification, the theories often rely on strong assumptions and are not compatible with each other. It is hard to know whether they are good in practice and how good they are. In this paper, we investigate adaptive clipping in DP-SGD from an empirical perspective. With extensive experiments, we were able to gain some fresh insights and proposed two new adaptive clipping strategies based on them. We cross-compared the existing methods and our new strategies experimentally. Results showed that our strategies did provide a substantial improvement in model accuracy, and outperformed the state-of-the-art adaptive clipping methods consistently.

One key factor able to boost the applications of artificial intelligence (AI) in security-sensitive domains is to leverage them responsibly, which is engaged in providing explanations for AI. To date, a plethora of explainable artificial intelligence (XAI) has been proposed to help users interpret model decisions. However, given its data-driven nature, the explanation itself is potentially susceptible to a high risk of exposing privacy. In this paper, we first show that the existing XAI is vulnerable to model extraction attacks and then present an XAI-aware dual-task model extraction attack (DTMEA). DTMEA can attack a target model with explanation services, that is, it can extract both the classification and explanation tasks of the target model. More specifically, the substitution model extracted by DTMEA is a multitask learning architecture, consisting of a sharing layer and two task-specific layers for classification and explanation. To reveal which explanation technologies are more vulnerable to expose privacy information, we conduct an empirical evaluation of four major explanation types in the benchmark data set. Experimental results show that the attack accuracy of DTMEA outperforms the predicted-only method with up to 1.25%, 1.53%, 9.25%, and 7.45% in MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100, respectively. By exposing the potential threats on explanation technologies, our research offers the insights to develop effective tools that are able to trade off security-sensitive relationships.

Over the past few years, a variety of membership inference attacks against deep learning models have emerged, raising significant privacy concerns. These attacks can easily infer whether a sample exists in the training set of the target model with little adversary knowledge, and the inference accuracy is often much higher than random guessing, which causes serious privacy leakage. To this end, defenses against membership inference attacks have attracted great interest. However, the current available defense methods such as regularization, differential privacy, and knowledge distillation are unable to balance the trade-off between privacy and utility well. In this paper, we combine knowledge distillation and generative adversarial networks to propose a novel training framework that can effectively defend against membership inference attacks, called KD-GAN. Extensive experiments show that our method implements an attack success rate of nearly 0.5 (random guesses) which can successfully defend against membership inference attacks without causing significant damage to model utility, and consistently outperforming other defense methods in the balance of privacy and utility.

At present, clients can outsource lots of complex and abundant computation, e.g., Internet of things (IoT), tasks to clouds by the “pay as you go” model. Outsourcing computation can save costs for clients and fully utilize the existing cloud infrastructures. However, it is hard for clients to trust the clouds even if blockchain is used as the trusted platform. In this article, we utilize the verification method as SETI@home by only two rational clouds, who hope to maximize their utilities. Utilities are defined as the incomes of clouds when they provide computation results to clients. More specifically, one client outsources two jobs to two clouds and each job contains n tasks, which include k identical sentinels. Two clouds can either honestly compute each task or collude on the identical sentinel tasks by agreeing on random values. If the results of identical sentinels are identical, then client regards the jobs as correctly computed without verification. Obviously, rational clouds have incentives to deviate by collusion and provide identical random results for a higher income. We discuss how to prevent collusion by using deposits, e.g., bit-coins. Furthermore, utilities for each cloud can be automatically assigned by a smart contract. We prove that, given proper parameters, two rational clouds will honestly send correct results to the client without collusion.

Summary Securely performing nearest neighbor query over encrypted data in cloud is an important topic in the area of cloud computing, for which Wang et al recently put forward a scheme (ie, CloudBI‐II) to address the challenging security problem: resisting the collusion of cloud server and query users. In this paper, we propose an efficient attack method that indicates CloudBI‐II will reveal the difference vectors under the collusion attack. Furthermore, we show that the difference vector disclosure will result in serious privacy breach and, thus, attain an efficient attack method to break CloudBI‐II. Namely, CloudBI‐II cannot achieve their declared security. Through theoretical analysis and experiment evaluation, we confirm that our proposed attack approach can fast recover the original data from the encrypted data set in CloudBI‐II. Finally, we provide an enhanced scheme that can efficiently resist the collusion attack.

As a method for increasing throughput and improving reliability of routing, network coding has been widely used in decentralized IoT systems. When files are shared in the system, network coding signature techniques can help authenticate whether a modified packet in files is injected or not. However, in an IoT system, there are often multiple source devices each of which has its own authentication key, where existing single-source network coding signature schemes cannot work. In this paper, we study the problem of designing secure network coding signatures in the network with multiple sources and propose the multisource homomorphic network coding signature. We also give construction and prove its security.