🛡️ AI Safety

🤖 AAAI2026 · 45 paper notes

📌 Same area in other venues: 📷 CVPR2026 (145) · 🔬 ICLR2026 (141) · 💬 ACL2026 (5) · 🧪 ICML2026 (114) · 🧠 NeurIPS2025 (73) · 📹 ICCV2025 (24)

🔥 Top topics: Adversarial Robustness ×17 · Watermarking ×5 · Federated Learning ×3 · Speech & Audio ×2 · Recommendation ×2

Alternative Fairness and Accuracy Optimization in Criminal Justice

This paper systematically reviews the three major dimensions of algorithmic fairness (group fairness, individual fairness, and procedural fairness), proposes an improved group fairness optimization formulation based on tolerance constraints, and constructs a "Three Pillars of Fairness" deployment framework tailored for public decision-making systems.

An Improved Privacy and Utility Analysis of Differentially Private SGD with Bounded Domain and Smooth Losses

Under the assumption that the loss function is only \(L\)-smooth (convexity is not required), this paper derives tighter closed-form RDP privacy bounds for DPSGD and, for the first time, provides a complete convergence/utility analysis in bounded domain scenarios, revealing that a smaller parameter domain diameter can simultaneously improve both privacy and utility.

An Information Theoretic Evaluation Metric for Strong Unlearning

This work reveals a fundamental flaw in existing black-box unlearning evaluation metrics (such as MIA and JSD)—modifying only the final layer can satisfy all black-box metrics while the intermediate layers completely retain information about the forgotten data. To address this, the authors propose IDI, a white-box metric that quantifies unlearning effectiveness by estimating the difference in mutual information between each layer and the forgotten labels via InfoNCE. They also propose the COLA method, which achieves IDI scores close to retraining (Retrain) on CIFAR-10/100 and ImageNet-1K.

Angular Gradient Sign Method: Uncovering Vulnerabilities in Hyperbolic Networks

Proposes the Angular Gradient Sign Method (AGSM), which decomposes gradients in hyperbolic space into radial (hierarchical depth) and angular (semantic) components. By applying perturbations strictly along the angular direction to generate adversarial examples, it reduces accuracy by an additional 5-13% compared to standard FGSM/PGD on image classification and cross-modal retrieval tasks.

Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs

Proposes Authority Backdoor, which embeds hardware fingerprints as backdoor triggers into DNNs to ensure the model functions correctly only on authorized devices. It achieves certifiable robustness against adaptive trigger reversal attacks through randomized smoothing.

Breaking the Adversarial Robustness-Performance Trade-off in Text Classification via Manifold Purification

The paper proposes the Manifold-Correcting Causal Flow (MC²F) framework. It learns the manifold density of clean data embeddings using a Stratified Riemannian Continuous Normalizing Flow (SR-CNF) for adversarial sample detection. It then utilizes a Geodesic Purification Solver to project embeddings detected as adversarial back to the clean manifold along the shortest path. This approach comprehensively outperforms state-of-the-art (SOTA) adversarial robustness on three datasets (SST-2, AGNews, and YELP) without any loss in (and even slightly improving) clean data accuracy.

Breaking the Dyadic Barrier: Rethinking Fairness in Link Prediction Beyond Demographic Parity

This paper reveals three fundamental flaws of dyadic fairness and Demographic Parity (\(\Delta\text{DP}\)) in link prediction—insufficient GNN expressiveness, obscured subgroup bias, and ranking insensitivity. It proposes a ranking-aware fairness metric based on NDKL and a post-processing algorithm, MORAL, achieving state-of-the-art fairness-utility trade-offs across six datasets.

CoRe-Fed: Bridging Collaborative and Representation Fairness via Federated Embedding Distillation

The CoRe-Fed framework is proposed to simultaneously address both representation fairness and collaborative fairness in federated learning through two synergistic modules: embedding-level contrastive alignment and contribution-aware aggregation, significantly improving the fairness and generalization of the global model under heterogeneous data distributions.

Credal Ensemble Distillation for Uncertainty Quantification

Propounds the Credal Ensemble Distillation (CED) framework, which distills a deep ensemble teacher into a single model, CREDIT. Instead of a single softmax distribution, this model predicts interval-valued class probabilities that define a credal set. It achieves superior or comparable uncertainty estimation on OOD detection tasks while substantially reducing inference overhead (reducing inference time from \(5\times\) to \(1\times\)).

DeepTracer: Tracing Stolen Model via Deep Coupled Watermarks

This work proposes DeepTracer, a robust watermarking framework. By leveraging adaptive source class selection (covering the feature space via K-Means clustering), same-class coupling loss (reducing the distance between watermark samples and the target class in the output space), and two-stage key sample filtering, the watermarking task is deeply coupled with the primary task. DeepTracer achieves an average watermark success rate of 77-100% under 6 types of model stealing attacks (including hard-label and data-free), significantly outperforming existing methods.

Detect All-Type Deepfake Audio: Wavelet Prompt Tuning for Enhanced Auditory Perception

This work establishes the first all-type (speech/sound/singing/music) audio deepfake detection benchmark and proposes Wavelet Prompt Tuning (WPT) to enhance the full-frequency perception of SSL features using Discrete Wavelet Transform. Without adding training parameters, WPT outperforms full fine-tuning, achieving an average EER of only 3.58% after co-training.

Diversifying Counterattacks: Orthogonal Exploration for Robust CLIP Inference

This paper proposes the Directional Orthogonal Counterattack (DOC) method. By introducing orthogonal gradient components and momentum updates during the counterattack optimization, it expands the search space. Combined with a cosine similarity-based Directional Sensitivity Score to adaptively modulate the counterattack intensity, the method significantly improves the test-time adversarial robustness of CLIP across 16 datasets.

Easy to Learn, Yet Hard to Forget: Towards Robust Unlearning Under Bias

Proposes the CUPID framework, which partitions the forget set into causal/bias subsets through loss landscape sharpness analysis, and identifies and disentangles the causal/bias pathways in the model. This achieves precise class unlearning on biased models, effectively resolving the "shortcut unlearning" issue.

EFX and PO Allocation Exists for Two Types of Goods

It is proved that when there are only two types of goods and all valuations are positive, an allocation satisfying both EFX (Envy-Freeness up to any good) and Pareto optimality always exists, and a quasi-linear time algorithm is provided.

Enhancing DPSGD via Per-Sample Momentum and Low-Pass Filtering

Proposed DP-PMLF, which reduces clipping bias via per-sample momentum while simultaneously suppressing high-frequency DP noise using a low-pass filter, mitigating the accuracy degradation of DPSGD from both directions for the first time.

Fair Model-Based Clustering

This paper proposes FMC, a fair clustering algorithm based on finite mixture models. By exerting fairness constraints on model parameters (instead of sample-level assignments), it achieves scalable fair clustering where the number of parameters is independent of the sample size. FMC supports mini-batch learning and categorical data, significantly outperforming existing methods on large-scale datasets.

FairGSE: Fairness-Aware Graph Neural Network without High False Positive Rates

This work is the first to reveal the "FPR shortcut" issue in fairness-aware GNNs, where existing methods achieve fairness metrics by misclassifying a large number of negative samples as positive. It proposes the FairGSE framework, which reweights graph edges by maximizing 2D structural entropy to simultaneously improve fairness and reduce false positive rates, achieving a 39% reduction in FPR.

Fine-Grained DINO Tuning with Dual Supervision for Face Forgery Detection

Proposed DFF-Adapter (DeepFake Fine-Grained Adapter), a lightweight fine-tuning scheme for DINOv2 tailored for deepfake detection. By injecting a three-branch adapter (authenticity detection head, forgery type classification head, and shared head) into each Transformer block combined with a Forgery-Aware Multi-Head Router to enable subspace-level dynamic routing of LoRA experts, it leverages the auxiliary forgery type classification task to enhance the artifact sensitivity of the primary task, achieving SOTA performance in multiple cross-dataset evaluations with only 3.5M trainable parameters.

Generalizing Fair Clustering to Multiple Groups: Algorithms and Applications

Generalizes the Closest Fair Clustering problem from only two groups to arbitrarily many groups, proves that the equal-proportion case with three or more groups is already NP-hard, proposes near-linear time approximation algorithms (\(O(|\chi|^{1.6}\log^{2.81}|\chi|)\) for equal proportions, and \(O(|\chi|^{3.81})\) for arbitrary proportions), and extends the results to fair correlation clustering and fair consensus clustering problems.

Graph Out-of-Distribution Detection via Test-Time Calibration with Dual Dynamic Dictionaries

Proposes the BaCa framework, which generates boundary-aware synthetic graph topologies during the test phase via graphon estimation and a mixup strategy. This is combined with dual priority-queue dynamic dictionaries and an attention mechanism to adaptively calibrate OOD scores. It requires no fine-tuning of the pre-trained model or introduction of auxiliary OOD data, outperforming GOODAT across all 10 datasets with an average AUC improvement of 8.37%.

Hashed Watermark as a Filter: A Unified Defense Against Forging and Overwriting Attacks in Neural Network Watermarking

Proposes NeuralMark—a weight watermarking method based on a hashed watermark filter. It utilizes a hash function to generate an irreversible binary watermark from a secret key, serving as a private filter to select embedding parameters. It leverages the avalanche effect to block gradient backpropagation in forgery attacks, and employs multi-round filtering to reduce parameter overlap, thereby resisting overwriting attacks. Its effectiveness and robustness are validated across 13 CNN/Transformer architectures, 5 image classification tasks, and 1 text generation task.

HealSplit: Towards Self-Healing through Adversarial Distillation in Split Federated Learning

Proposes HealSplit, the first unified defense framework for Split Federated Learning (SFL). It integrates Topology-Aware Detection (TAS) to identify poisoned samples, GANs to generate semantically consistent substitute representations, and adversarial multi-teacher distillation to train a consistency-validating student model. This achieves end-to-end detection and recovery, outperforming ten SOTA defense methods under five types of poisoning attacks.

Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks

Addressing the query efficiency bottleneck in hard-label black-box adversarial attacks, this paper proposes a momentum algorithm, ARS-OPT, based on Nesterov accelerated gradient, and introduces a surrogate model prior to obtain an enhanced version, PARS-OPT. It theoretically proves a faster convergence rate and outperforms 13 state-of-the-art (SOTA) methods on ImageNet and CIFAR-10.

InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inference

This paper proposes InfoDecom, which reduces redundant information in smashed data via two-stage information decomposition (frequency-domain visual information removal + mutual information suppression). It then injects closed-form computed Gaussian noise to provide theoretical privacy guarantees, achieving a utility-privacy trade-off (UPT) far superior to existing methods under shallow client-side models.

Learning to Collaborate: An Orchestrated-Decentralized Framework for Peer-to-Peer Collaborative Learning

This paper proposes the KNEXA-FL framework, which models P2P collaboration as a contextual bandit problem via a model-agnostic Central Pairwise Matcher (CPM). By using LinUCB to learn the optimal pairing strategy, it achieves an approximately 50% increase in Pass@1 compared to random P2P in heterogeneous LLM federated learning, while avoiding the catastrophic collapse associated with centralized distillation.

Matrix-Free Two-to-Infinity and One-to-Two Norms Estimation

The authors propose TwINEst and TwINEst++, two randomized algorithms based on the Hutchinson diagonal estimator, to efficiently estimate \(\|A\|_{2\to\infty}\) and \(\|A\|_{1\to 2}\) norms in a matrix-free setting. They provide theoretical oracle complexity guarantees and demonstrate significant advantages in Jacobian regularization of DNNs (for adversarial robustness in image classification) and defense against adversarial attacks in recommender systems.

Minimizing Inequity in Facility Location Games

Investigates the problem of minimizing the maximum weighted group effect (Maximum Group Effect) in facility location games on the real line. The paper proposes two strategyproof mechanisms, BALANCED and MAJOR-PHANTOM, achieving tight approximation ratios in single-facility settings, unifying classical objectives like utilitarian (social cost) and egalitarian (maximum cost) with group fairness objectives, and extending the endpoint mechanism to two-facility settings.

MPD-SGR: Robust Spiking Neural Networks with Membrane Potential Distribution-Driven Surrogate Gradient Regularization

A theoretical connection is established between SNN robustness error and surrogate gradient (SG) magnitude. This reveals that reducing the overlap ratio between the membrane potential distribution (MPD) and the effective gradient interval of the SG can effectively decrease sensitivity to adversarial perturbations. Based on this, the MPD-SGR regularization method is proposed, which significantly outperforms existing SNN defense methods under both vanilla and adversarial training settings.

OAD-Promoter: Enhancing Zero-shot VQA using Large Language Models with Object Attribute Description

This paper proposes OAD-Promoter, which cooperatively utilizes three modules—Object-concentrated Example Generation (OEG), Memory Knowledge Assistance (MKA), and OAD Prompt—to mitigate language bias inherited by LLMs and enhance domain adaptation capabilities under the zero-shot setting, achieving SOTA performance on multiple benchmarks such as VQAv2.

Plug-and-Play Parameter-Efficient Tuning of Embeddings for Federated Recommendation

This paper proposes a plug-and-play federated recommendation framework. By introducing the concept of PEFT (Parameter-Efficient Fine-Tuning) to item embeddings, it freezes the pre-trained full embeddings and transmits only the lightweight compressed embeddings (LoRA / Hash / RQ-VAE), substantially reducing communication overhead while improving recommendation accuracy.

Privacy Auditing of Multi-Domain Graph Pre-Trained Model under Membership Inference Attack

This paper proposes the MGP-MIA framework, conducting the first membership inference attack (MIA) against multi-domain graph pre-trained models. By amplifying membership signals via machine unlearning, constructing shadow models through incremental learning, and employing a similarity-based inference mechanism, MGP-MIA effectively reveals the privacy leakage risks of multi-domain graph pre-training.

Privacy on the Fly: A Predictive Adversarial Transformation Network for Mobile Sensor Data

This paper proposes PATN (Predictive Adversarial Transformation Network), the first framework to introduce adversarial perturbations to sensor data privacy protection. By utilizing historical sensor data to generate future-oriented adversarial perturbations, it achieves zero-latency real-time privacy protection while maintaining the semantic fidelity of the sensor data.

ProbLog4Fairness: A Neurosymbolic Approach to Modeling and Mitigating Bias

The ProbLog4Fairness framework is proposed, which leverages the probabilistic logic programming language ProbLog to formalize bias mechanisms in data as interpretable logic programs, and integrates bias assumptions into neural network training through distant supervision via DeepProbLog, achieving flexible and principled bias mitigation.

Reference Recommendation based Membership Inference Attack against Hybrid-based Recommender Systems

A reference recommendation-based Membership Inference Attack (MIA) is proposed, introducing a relative membership metric \(\rho(u) = d(v_t, v_h) / d(v_t, v_r)\). By leveraging the personalized features of hybrid-based recommender systems to obtain reference recommendations, this work achieves the first effective attack against hybrid-based recommender systems, achieving an attack success rate of up to 93.4% with a computation cost of only 10 seconds.

RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service

This paper proposes RegionMarker, a watermarking framework triggered by semantic regions. By defining trigger regions in a low-dimensional space and injecting semantic watermarks, it represents the first EaaS copyright protection method capable of simultaneously defending against CSE attacks, paraphrasing attacks, and dimensional perturbation attacks.

Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approach

This study proposes the TGAF framework, which leverages diffusion models to encode target labels into 2D semantic tensors to guide adversarial noise generation, and designs a random masking strategy to preserve complete semantic information, significantly improving the transferability of targeted adversarial attacks.

Revisiting (Un)Fairness in Recourse by Minimizing Worst-Case Social Burden

This paper systematically analyzes three major limitations of fairness metrics in algorithmic recourse (neglecting classifier decision behavior, ignoring ground-truth labels, and disparity metrics concealing unfairness). It proposes a social burden-based fairness framework, MISOB, which reduces the social burden of all groups through a minimax-weighted training strategy, simultaneously improving fairness during both the prediction and recourse stages without requiring access to sensitive attributes.

Robust Watermarking on Gradient Boosting Decision Trees

Proposes the first robust watermarking framework for GBDT models. By embedding watermarks through in-place fine-tuning and designing four embedding strategies (Wrong Prediction Flip, Outlier Flip, Cluster Center Flip, Confidence Flip), it achieves high embedding success rates, low accuracy loss, and strong robustness against fine-tuning.

SecMoE: Communication-Efficient Secure MoE Inference via Select-Then-Compute

This paper proposes the SecMoE framework, which efficiently implements sparse MoE inference in secure two-party computation (2-PC) via the Select-Then-Compute paradigm. It avoids redundant expert computation, reducing communication overhead by up to 29.8× and achieving up to 16.1× end-to-end acceleration.

TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models

Ours proposes TopoReformer, a model-agnostic adversarial purification pipeline based on topological autoencoders. By leveraging persistent homology to enforce topological consistency within the latent space, the framework filters adversarial perturbations without requiring adversarial training, effectively safeguarding OCR systems against classic, adaptive, and OCR-specific watermark attacks.

Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models

Proposes GFM-BA, the first systematic backdoor attack method targeting the pre-training phase of Graph Foundation Models (GFMs). By employing three modules—label-free trigger association, node-adaptive trigger generation, and persistent backdoor anchoring—it simultaneously addresses the three major challenges of effectiveness, stealthiness, and persistence.

Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation

Proposes STAB (Sharpness-aware Transferable Adversarial Backdoor), which trains a surrogate model using SAM to converge to flat regions of the loss landscape and optimizes context-aware adversarial triggers using Gumbel-Softmax. This is the first work to simultaneously achieve cross-dataset transferability and stealthiness in backdoor attacks against code models.

Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges

This paper proposes TH-Attack, a transferable node injection attack framework for hypergraph neural networks (HGNNs). By identifying pivotal hyperedges along information aggregation paths and injecting semantic-reversed malicious nodes, TH-Attack achieves effective black-box attacks across various HGNN architectures, reducing classification accuracy from 80%+ to below 30%.

Truth, Justice, and Secrecy: Cake Cutting Under Privacy Constraints

Proposes the first privacy-preserving cake-cutting protocol, PP_CC_puv, which adapts the strategyproof algorithm of Chen et al. using secret sharing and secure multi-party computation (MPC) technologies, preventing any party from learning others' preference information while maintaining envy-freeness, Pareto-optimality, and strategyproofness.

Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking

This work presents the first systematic study on overwriting attacks against neural audio watermarking, proposing a three-tier attack framework (white-box, gray-box, and black-box). It achieves near 100% attack success rates across three SOTA methods (AudioSeal, Timbre, and WavMark), exposing severe security vulnerabilities in existing audio watermarking systems.