Is this you? Claim this profile to correct it, add a bio and choose the work people see first.
Claim this profileAcademic lineage
Possible advisorsa guess from early papers, not confirmed
- Kui RenSuggested from co-authorship
Is this you? Claim this profile to confirm or dismiss it.
Works148 from public data
- 685
- Adversarial Attacks and Defenses in Deep Learning676
The theoretical foundations, algorithms, and applications of adversarial attack techniques are introduced and a few research efforts on the defense techniques are described, which cover the broad frontier in the field.
- Feature Importance-aware Transferable Adversarial Attacks353
The Feature Importance-aware Attack (FIA) is proposed, which disrupts important object-aware features that dominate model decisions consistently and achieves stronger transferability.
- Heavy Hitter Estimation over Set-Valued Data with Local Differential Privacy350
The main idea is to first gather a candidate set of heavy hitters using a portion of the privacy budget, and focus the remaining budget on refining the candidate set in a second phase, which is much more efficient budget-wise than obtaining the heavy hitters directly from the whole dataset.
- Generating Synthetic Decentralized Social Graphs with Local Differential Privacy277
This paper proposes LDPGen, a novel multi-phase technique that incrementally clusters users based on their connections to different partitions of the whole population, and derives optimal parameters in this process to cluster structurally-similar users together.
- 225
- 214
- 199
- Real-time and Spatio-temporal Crowd-sourced Social Network Data Publishing with Differential Privacy197
- Cloud-Enabled Privacy-Preserving Truth Discovery in Crowd Sensing Systems169
This paper proposes a novel cloud-enabled privacy-preserving truth discovery (PPTD) framework for crowd sensing systems, which can achieve the protection of not only users' sensory data but also their reliability scores derived by the truth discovery approaches.
- Learning-based Practical Smartphone Eavesdropping with Built-in Accelerometer151
A novel deep learning based system that learns to recognize and reconstruct speech information from the spectrogram representation of acceleration signals and employs adaptive optimization on deep neural networks with skip connections using robust and generalizable losses to achieve robust recognition and reconstruction performance.
- 142
- 133
- 130
- 125
- Analyzing Subgraph Statistics from Extended Local Views with Decentralized Differential Privacy122
A novel decentralized differential privacy scheme is formulated, which requires that each participant consider not only her own privacy, but also that of her neighbors involved in her ELV, and designs a novel multi-phase framework under DDP that enables an analyst to accurately estimate subgraph counts, an important property of social graphs.
- Towards Efficient Privacy-preserving Image Feature Extraction in Cloud Computing121
This work studies the privacy requirements in outsourcing SIFT computation and proposes SecSIFT, a high performance privacy-preserving SIFT feature detection system that performs comparably to original SIFT on image benchmarks while capable of preserving the privacy in an efficient way.
- Threats to Training: A Survey of Poisoning Attacks and Defenses on Machine Learning Systems120
This survey summarize and categorize existing attack methods and corresponding defenses, as well as demonstrate compelling application scenarios, thus providing a unified framework to analyze poisoning attacks and lay the foundation for a more standardized approach to reproducible studies.
- 119
- 110
- e-PoS: Making Proof-of-Stake Decentralized and Fair102
This work proposes a modular version of PoS-based blockchain systems called e-PoS that resists the centralization of network resources by extending mining opportunities to a wider set of stakeholders and leverages the in-built system operations to promote fair mining practices by penalizing malicious entities.
- 89
- FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model85
FedTracker is presented, the first FL model protection framework that provides both ownership verification and traceability and is effective in ownership verification, traceability, and maintains good fidelity and robustness against various watermark removal attacks.
- 83
- ShapleyFL: Robust Federated Learning Based on Shapley Value80
This paper proposes a Shapley value-inspired adaptive weighting mechanism, which regards the FL training as sequential cooperative games and adjusts clients' weights according to their contributions, and develops a client sampling strategy based on importance sampling, which can reduce the communication cost by optimizing the variance of the global updates according to the weights of clients.
- PoisonPrompt: Backdoor Attack on Prompt-Based Large Language Models79
A novel backdoor attack capable of successfully compromising both hard and soft prompt-based LLMs is presented, highlighting the potential security threats posed by backdoor attacks on prompt-based LLMs and emphasize the need for further research in this area.
- Privacy-Preserving Truth Discovery in Crowd Sensing Systems74
This article proposes a novel privacy-preserving truth discovery (PPTD) framework, which can protect not only users’ sensory data but also their reliability scores derived by the truth discovery approaches, and proposes to parallelize PPTD with MapReduce framework.
- 72
- 70
- A Survey on Medical Large Language Models: Technology, Application, Trustworthiness, and Future Directions68
This survey traces the recent advances of Medical Large Language Models (Med-LLMs), including the background, key findings, and mainstream techniques, especially for the evolution from general-purpose models to medical-specialized applications.
- 68
- 68
- L-SRR65
This work designs a novel randomization mechanism ''Staircase Randomized Response'' (SRR) and extends the empirical estimation to significantly boost the utility for SRR in different LBS applications (e.g., traffic density estimation, and k-nearest neighbors).
- Privacy-Preserving Image Processing in the Cloud62
The design targets and technical challenges lie in constructing cloud-based privacy-preserving image processing system, and the state-of-the-art techniques, including secure multiparty computation, and homomorphic encryption are investigated.
- 60
- 59
- An Efficient Two-Layer Mechanism for Privacy-Preserving Truth Discovery58
This work proposes perturbation-based mechanisms that provide users with privacy guarantees and maintain the accuracy of aggregated answers and proposes a two-layer mechanism where users are allowed to sample their own probabilities from a hyper distribution to improve the utility.
- 55
- Towards Label-Only Membership Inference Attack against Pre-trained Large Language Models54
A label-only membership inference attack based on token-level semantic similarity to approximate output probabilities and subsequently calculate the perplexity, which performs better than the extensions of existing label-only attacks against personalized LLMs and even on par with other advanced logit-based attacks across all metrics on five prevalent open-source LLMs.
- PromptCARE: Prompt Copyright Protection by Watermark Injection and Verification51
This paper proposes PromptCARE, the first framework for prompt copyright protection through watermark injection and verification and demonstrates the effectiveness, harmlessness, robustness, and stealthiness of PromptCARE.
- PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention network51
Experiments on diverse scenarios, including small-scale data, class imbalance, and adversarial attacks, demonstrate PMANet's superiority over state-of-the-art models, achieving a 0.9941 AUC and correctly detecting all 20 malicious URLs in a case study.
- SurrogatePrompt: Bypassing the Safety Filter of Text-to-Image Models via Substitution50
This work successfully devise and exhibit the first prompt attacks on Midjourney, producing abundant photorealistic NSFW images and reveals the fundamental principles of such prompt attacks and strategically substitute high-risk sections within a suspect prompt to evade closed-source safety measures.
- AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations46
This work proposes a new paradigm, action-level causal attribution, which secures agents by asking why a particular tool call is produced, to distinguish tool calls supported by the user's intent from those causally driven by untrusted observations.
- 45
- OpBoost45
This paper introduces a framework called OpBoost, which introduces three order-preserving desensitization algorithms satisfying a variant of LDP called distance-based LDP (dLDP), and provides a trade-off between the privacy of pairs with large distance and the utility of desensitized values.
- 45
- Membership Inference Attacks Against Vision-Language Models43
This paper conducts the first analysis of misuse and leakage detection in VLMs through the lens of membership inference attack (MIA), and proposes four membership inference methods, each tailored to different levels of background knowledge, ultimately arriving at the most challenging scenario.
- 43
- 42
- Towards Differentially Private Truth Discovery for Crowd Sensing Systems42
The proposed mechanism can satisfy local differential privacy while preserving high aggregation accuracy and formally quantify utility and privacy trade-off and further verify the claim by experiments on both synthetic data and a real-world crowd sensing system.
- 41
- 40
- LLM-Guided Multi-View Hypergraph Learning for Human-Centric Explainable Recommendation39
This work proposes a novel explainable recommendation framework, i.e., LLMHG, synergizing the reasoning capabilities of large language models (LLMs) and the structural advantages of hypergraph neural networks to enable more human-centric modeling of user preferences.
- Certified Minimax Unlearning with Generalization Rates and Deletion Capacity39
A new $(\epsilon,\delta)-certified machine unlearning algorithm for minimax models is developed that proposes a minimax unlearning step consisting of a total-Hessian-based complete Newton update and the Gaussian mechanism borrowed from differential privacy.
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming38
REFINE is proposed, an inversion-free backdoor defense method based on model reprogramming that enhances the defense capabilities while maintaining model utility and its resistance to potential adaptive attacks.
- 37
- Artificial intelligence security and privacy: a survey36
This survey systematically categorizing and analyzing the threats and countermeasures in AI systems, which span both the training and inference stages, encompass centralized and distributed settings, and address both conventional and foundation AI models.
- PointNCBW: Toward Dataset Ownership Verification for Point Clouds via Negative Clean-Label Backdoor Watermark35
This work designs a scalable clean-label backdoor-based dataset watermark for point clouds that ensures both effectiveness and stealthiness, and designs a hypothesis-test-guided dataset ownership verification based on the proposed watermark.
- ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware Approach34
ERASER strategically choose appropriate unlearning execution timing to address the inference service obsolescence issue, and a novel inference consistency certification mechanism is proposed to avoid the violation of RTBF principle caused by postponed unlearning executions, thereby mitigating the undesirable exposure vulnerability.
- 34
- Pitfalls in Language Models for Code Intelligence: A Taxonomy and Survey32
A comprehensive classification scheme is developed that dissects pitfalls across four crucial aspects: data collection and labeling, system design and learning, performance evaluation, and deployment and maintenance of LM4Code systems.
- Rethinking Data Protection in the (Generative) Artificial Intelligence Era32
This work proposes a four-level taxonomy, including non-usability, privacy preservation, traceability, and deletability, that captures the diverse protection needs arising in modern (generative) AI models and systems, and offers a structured understanding of the trade-offs between data utility and control.
- 30
- Equitable Data Valuation Meets the Right to Be Forgotten in Model Markets29
S-Shapley value is proposed, a sharded structure-based Shapley value, which satisfies four desirable properties for data valuation, and two sampling-based methods are developed to approximate S-ShAPley value.
- 29
- Truth Inference on Sparse Crowdsourcing Data with Local Differential Privacy29
This paper designs a new matrix factorization (MF) algorithm under LDP that addresses the trade-off between privacy and utility and proves that the MF algorithm can provide both LDP guarantee and small error of truth inference, regardless of the sparsity of worker answers.
- Towards Private and Scalable Cross-Media Retrieval27
This work proposes the first practical system for privacy-preserving cross-media retrieval by utilizing trusted processors, and enables secure aggregation of the data from distinct parties, and secure canonical correlation analysis (CCA) over collaborated data to obtain semantic models.
- SecSIFT27
This work analyzes and model the privacy requirements in outsourcing SIFT computation and proposes Secure Scalar Invariant Feature Transform (SecSIFT), a high-performance privacy-preserving SIFT feature detection system that enables implementation with practical computation and communication complexity.
- On Benchmarking Code LLMs for Android Malware Analysis26
Cama is presented, a benchmarking framework designed to systematically evaluate the effectiveness of Code LLMs in Android malware analysis, and it integrates three domain-specific evaluation metrics—consistency, fidelity, and semantic relevance—enabling rigorous stability and effectiveness assessment and cross-model comparison.
- Quantifying and Defending against Privacy Threats on Federated Knowledge Graph Embedding25
This paper conducts the first holistic study of the privacy threat on FKGE from both attack and defense perspectives and proposes DP-Flames, a novel differentially private FK GE with private selection that offers a better privacy-utility tradeoff and comes with a tight privacy accountant by incorporating the state-of-the-art private selection technique.
- A Causal Explainable Guardrails for Large Language Models24
This work proposes LLMGuardrail, a novel framework that incorporates causal analysis and adversarial learning to obtain unbiased steering representations in LLMs, and demonstrates its effectiveness in steering LLMs toward desired attributes while mitigating biases.
- FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis24
FINER is proposed, the first framework for risk detection classifiers to generate high-fidelity and high-intelligibility explanations and it is demonstrated that FINER outperforms a state-of-the-art tool in facilitating malware analysis.
- Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models23
Cross-modality Information DEtectoR (CIDER), a plug-and-play jailbreaking detector designed to identify maliciously perturbed image inputs, utilizing the cross-modal similarity between harmful queries and adversarial images is proposed.
- 23
- Local Differentially Private Heavy Hitter Detection in Data Streams with Bounded Memory22
This paper presents a novel framework HG-LDP to achieve accurate Top-k item detection at bounded memory expense, while providing rigorous local differential privacy (LDP) protection, and instantiates three advanced schemes under the framework by designing novel LDP randomization methods that address the hurdles caused by the large size of the item domain and by the limited space of the memory.
- 19
- Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classification18
This work proposes DREAM a novel system that establishes an explanatory drift detection and adaptation process that effectively improves the drift detection accuracy and reduces the expert analysis effort in adaptation across different malware datasets and classifiers.
- 16
- DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspective15
A comprehensive study evaluating dataset auditing from an adversarial perspective, including a new benchmark, DATABench, comprising 17 evasion attacks, 5 forgery attacks, and 9 representative auditing methods that reveal that none of the evaluated auditing methods are sufficiently robust or distinctive under adversarial settings.
- Towards Sample-Specific Backdoor Attack With Clean Labels via Attribute Trigger15
It is argued that the intensity constraint of existing SSBAs is mostly because their trigger patterns are ‘content-irrelevant’ and therefore act as ‘noises’ for both humans and DNNs and proposed to exploit content-relevant features, <inline-formula><tex-math notation="LaTeX"> (human-relied) attributes, as the trigger patterns to design clean-label SSBAs.
- DeUEDroid: Detecting Underground Economy Apps Based on UTG Similarity14
A novel approach to effectively and efficiently detect UEware by considering their UI transition graphs (UTGs) by designing and implementing a system, named DeUEDroid, and making the prototype system and dataset available online.
- 13
- Eguard: Defending LLM Embeddings Against Inversion Attacks via Text Mutual Information Optimization12
The proposed Eguard framework effectively disrupts chains of relationships between the original semantic space and defended functional space, effectively decoupling sensitive content from the semantic space accessible to adversaries and achieving a superior privacy-utility trade-off than traditional defenses.
- FIT-Print: Toward False-Claim-Resistant Model Ownership Verification via Targeted Fingerprint12
This work introduces FIT-Print, a targeted fingerprinting paradigm that actively counters false claim attacks and proposes two black-box fingerprinting methods, the bit-wise FIT-ModelDiff and the list-wise FIT-LIME, which utilize output distances and feature attributions as robust model signatures, respectively.
- 12
- 12
- 12
- 12
- 11
- 10
- 10
- 10
- DREAM: Scalable Red Teaming for Text-to-Image Generative Systems via Distribution Modeling9
DREAM is proposed, a scalable red teaming framework to automatically uncover diverse problematic prompts from a given T2I system, and GC-SPSA, an efficient optimization algorithm that provides stable gradient estimates through the long and potentially non-differentiable T2I pipeline.
- SWAT: A System-Wide Approach to Tunable Leakage Mitigation in Encrypted Data Stores9
This paper proposes and instantiates Swat, an efficient construction that progressively enables key-value, range-query, and dynamic workloads, while provably mitigating system-wide leakage via a suite of algorithms with tunable privacy-efficiency trade-offs.
- SecWeb: Privacy-Preserving Web Browsing Monitoring with w-Event Differential Privacy9
This paper investigates the problem of real-time privacy-preserving web browsing monitoring, and proposes SecWeb, an online aggregated web browsing behavior monitoring scheme over infinite time with theoretical privacy guarantee, and proves that SecWeb satisfies w-event differential privacy and the experimental results show thatSecWeb outperforms the state-of-the-art approaches.
- SPAS: Continuous Release of Data Streams under w-Event Differential Privacy8
SPAS continuously predicts an optimal publishing strategy within each sliding window that minimizes the error of the released results based on the characteristics of the data stream and develops a weighted sparse vector technique to control data sampling and manage privacy budget consumption following that optimal publishing strategy.
- 8
- Releasing Malevolence from Benevolence: The Menace of Benign Data on Machine Unlearning7
The Unlearning Usability Attack, a model-agnostic, unlearning-agnostic, and budget-friendly attack that distills data distribution information into a small set of benign data, which is identified as benign by automatic poisoning detection tools and poses challenges for recent unlearning techniques.
- 7
- 6
- Delay-allowed Differentially Private Data Stream Release6
This work delve into the advantages of introducing a delay time in stream releases, and devised two optimization strategies, group-based and order-based optimizations, to aid in reducing the added noise and post-processing of noisy data.
- 6
- 6
- 6
- 5
- Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework5
This work proposes SecureCollaRAG, a Byzantine-tolerant collaborative RAG framework leveraging Multi-source Knowledge Validation Mechanism that enables agent system to securely verify document provenance through dynamic GNN-based credibility scoring, effectively preventing stealthy knowledge corruption attacks while preserving essential domain knowledge integrity.
- FDINet: Protecting Against DNN Model Extraction Using Feature Distortion Index5
FDINet, a novel defense mechanism that leverages the feature distribution of deep neural network (DNN) models, proves to be highly effective in detecting model extraction and exhibits the capability to identify colluding adversaries with an accuracy exceeding 91%.
- 5
- 5
- RemovalNet: DNN Fingerprint Removal Attacks5
This article proposes a min-max bilevel optimization-based DNN fingerprint removal attack named RemovalNet, designed to evade model ownership verification, and demonstrates that the empirical results demonstrate that the RemovalNet is effective.
- Accelerometer-based smartphone eavesdropping5
It is shown that audio signals emitted by a smartphone speaker can be captured by the accelerometer on the same smartphone, and accelerometers on recently released smartphones can cover most of the fundamental frequency band of adult speech.
- SecSAKE: Towards Secure and Efficient Outsourcing of Clinical MRI Reconstruction5
This work investigates the privacy requirements of MRI data and reconstruction process and proposes the first secure and efficient clinical MRI reconstruction outsourcing scheme, SecSAKE, which enables a clinic to outsource the most computationally-intensive tasks in SAKE to the resource-abundant cloud servers.
- 5
- 4
- DUMP: A Dummy-Point-Based Framework for Histogram Estimation in Shuffle Model.4
DUMP (DUM), a framework for privacy-preserving histogram estimation in shuffle model, and two protocols: pureDUMP and mixDUMP under DUMP framework, which achieve better trade-offs between privacy, accuracy, and communication than existing protocols.
- 3
- JANUS: A Lightweight Framework for Jailbreaking Text-to-Image Models via Distribution Optimization3
JANUS is a lightweight framework that formulates jailbreak as optimizing a structured prompt distribution under a black-box, end-to-end reward from the T2I system and its safety filters, and outperforms state-of-the-art jailbreak methods on modern T2I models.
- Quantifying Conversation Drift in MCP via Latent Polytope3
SecMCP is proposed, a secure framework that detects and quantifies conversation drift, deviations in latent space trajectories induced by adversarial external knowledge, and identifies anomalous shifts in conversational dynamics, enabling proactive detection of hijacking, misleading, and data exfiltration.
- WMCopier: Forging Invisible Image Watermarks on Arbitrary Images3
DiffForge is proposed, the first watermark forgery framework capable of forging imperceptible watermarks under a no-box setting and reveals fundamental security limitations in current watermarking paradigms.
- 3
- Securing acoustics-based short-range communication systems: an overview3
For each dependable and secure acoustics-based short range communication system, the major technical hurdles to be overcome, the state-of-the-art, and also a vision of the future research issues on this promising technology are presented.
- DualMind: Towards Understanding Cognitive-Affective Cascades in Public Opinion Dissemination via Multi-Agent Simulation2
DualMind, an LLM-driven multi-agent platform designed to model this dual-component interplay, is proposed and empirical results demonstrate that DualMind faithfully reconstructs opinion trajectories, significantly outperforming state-of-the-art baselines.
- External Data Extraction Attacks Against Retrieval-Augmented Large Language Models2
The first comprehensive study to formalize EDEAs against retrieval-augmented LLMs (RA-LLMs) and develop Secret, a Scalable and EffeCtive exteRnal data Extraction aTtack, which significantly outperforms previous attacks, and is highly effective against all 16 tested RAG instances.
- DMind Benchmark: Toward a Holistic Assessment of LLM Capabilities across the Web3 Domain2
This work introduces DMind Benchmark, a comprehensive evaluation suite designed to rigorously assess LLM proficiency across the Web3 stack and provides a Pareto analysis to guide cost-effective deployment and demonstrates through adversarial experiments that high performance on DMind Benchmark necessitates genuine reasoning rather than superficial memorization.
- EVA: Editing for Versatile Alignment Against Jailbreaks2
EVA (Editing for Versatile Alignment against Jailbreaks), a novel framework that pioneers the application of direct model editing for safety alignment, is proposed, offering a precise and efficient solution for post-deployment safety alignment.
- 2
- 2
- 2
- Prompt-Consistency Image Generation (PCIG): A Unified Framework Integrating LLMs, Knowledge Graphs, and Controllable Diffusion Models2
A novel diffusion-based framework is introduced to significantly enhance the alignment of generated images with their corresponding descriptions, addressing the inconsistency between visual output and textual input.
- 2
- 1
- 1
- 1
- 1
- MAJIC: Markovian Adaptive Jailbreaking via Iterative Composition of Diverse Innovative Strategies–
A Markovian adaptive jailbreaking framework that attacks black-box LLMs by iteratively combining diverse innovative disguise strategies by enabling MAJIC to learn and discover effective attack pathways tailored to the target model.
- SJBP: A Platform to Launch a Novel Jailbreak Attack on Large Language Models Based on Content's Spatial Distribution–
A post-defense mechanism is developed, SpatialD, which analyzes spatial characteristics in model outputs to identify harmful content and bypasses existing safety defenses in a novel spatial jailbreak targeting LLMs embedded in web applications.
- Research on Automatic Network Attack Detection and Defense Mechanisms Based on Large Language Models–
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
Publication data from OpenAlex, with missing venues and authors filled in from Crossref; citation counts are the higher of OpenAlex and Semantic Scholar, last synced 2026-10-12. One-sentence summaries under some papers are written by Semantic Scholar’s model. Citation counts may be lower than on Google Scholar, which indexes more sources.
Report an error
Wrong papers, two people merged into one, or a profile that should not be here? Tell us and we will fix or hide it.