🔒 Safety

🤖 AAAI2026 · 88 paper notes

📌 Same area in other venues: 🧠 NeurIPS2026 (35) · 🎞️ ECCV2026 (69) · 📷 CVPR2026 (162) · 🔬 ICLR2026 (329) · 💬 ACL2026 (120) · 🧪 ICML2026 (114)

🔥 Top topics: Adversarial Robustness ×26 · LLM ×20 · Watermarking ×9 · Federated Learning ×7 · Multimodal/VLM ×3

Can Editing LLMs Inject Harm?

This paper reframes knowledge editing as a novel LLM security threat termed Editing Attack, systematically investigating the feasibility of injecting misinformation and bias into LLMs via three editing methods—ROME, FT, and ICE—and demonstrating that such attacks are both highly effective and remarkably stealthy.

LLM Targeted Underperformance Disproportionately Impacts Vulnerable Users

Systematic experiments demonstrate that mainstream LLMs (GPT-4, Claude 3 Opus, Llama 3-8B) exhibit significant discriminatory degradation in information accuracy, truthfulness, and refusal rates toward users with lower English proficiency, lower educational attainment, and non-US backgrounds, making the most vulnerable users the least reliably served.

FedALT: Federated Fine-Tuning through Adaptive Local Training with Rest-of-World LoRA

FedALT is proposed to maintain a trainable Individual LoRA (updated locally) and a frozen Rest-of-World (RoW) LoRA (averaged from other clients) for each client, combined with an adaptive MoE mixer that dynamically balances local and global knowledge. This design fundamentally eliminates cross-client interference caused by FedAvg aggregation, achieving significant improvements over SOTA on heterogeneous-task federated LLM fine-tuning.

PRISM: Privacy-Aware Routing for Adaptive Cloud-Edge LLM Inference via Semantic Sketch Collaboration

This paper proposes PRISM, a framework that dynamically routes user prompts to one of three inference modes—cloud-only, edge-only, or collaborative—via a context-aware soft gating mechanism. In the collaborative mode, an adaptive two-layer local differential privacy (LDP) scheme and semantic sketch collaboration are employed to achieve a three-way balance among privacy, utility, and efficiency.

RadarLLM: Empowering Large Language Models to Understand Human Motion from Millimeter-Wave Point Cloud Sequence

This paper proposes RadarLLM, the first end-to-end framework leveraging large language models for semantic-level human motion understanding from millimeter-wave radar point cloud sequences. The framework comprises a motion-guided radar tokenizer based on Aggregate VQ-VAE and a radar-aware language model, along with a physics-aware simulation pipeline for generating large-scale paired radar-text data.

AgentSense: Virtual Sensor Data Generation Using LLM Agents in Simulated Home Environments

LLM-driven embodied agents are instantiated to "live" in simulated smart home environments, generating virtual ambient sensor data for pre-training HAR models, which yields significant gains in activity recognition under low-resource settings.

BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models

This paper proposes BadThink — the first training-time backdoor attack targeting CoT reasoning efficiency. By iteratively optimizing verbose reasoning templates via an LLM, it constructs poisoned data that causes the victim model, upon trigger activation, to generate reasoning chains inflated by over 17× (on MATH-500), while preserving final answer correctness and maintaining strong stealthiness.

From Single to Societal: Analyzing Persona-Induced Bias in Multi-Agent Interactions

This paper presents the first systematic study of persona-induced bias in LLM-based multi-agent interactions. Through controlled experiments on collaborative problem solving and persuasion tasks, three key findings are revealed: (1) different personas exhibit significant divergence in trustworthiness and insistence (dominant groups such as males and White individuals are perceived as less trustworthy); (2) agents display pronounced in-group favoritism; and (3) these biases persist and tend to amplify in multi-turn, multi-agent settings.

WaterMod: Modular Token-Rank Partitioning for Probability-Balanced LLM Watermarking

This paper proposes WaterMod, an LLM text watermarking method based on modular arithmetic (\(\text{rank} \bmod k\)) that partitions the vocabulary into modular residue classes after sorting tokens by probability. Under both zero-bit (\(k=2\)) and multi-bit (\(k>2\)) watermarking settings, WaterMod achieves high detection rates and low quality degradation within a unified framework, requiring no external thesaurus or hashing tricks.

Cross-Modal Unlearning via Influential Neuron Path Editing in Multimodal Large Language Models

This paper proposes MIP-Editor, which localizes influential neuron paths encoding forget-target knowledge in MLLMs via cross-layer gradient integration (text branch) and Fisher integration (visual branch), then edits these neurons using path-based Representation Misdirection Unlearning (RMisU), achieving up to 87.75% forget rate and 54.26% improvement in general knowledge retention on MLLMU-Bench.

Privacy-protected Retrieval-Augmented Generation for Knowledge Graph Question Answering

This work is the first to explore privacy-protected RAG for Knowledge Graph Question Answering (KGQA). It proposes ARoG (Abstraction Reasoning on Graph), a framework that employs two strategies—relation-centric abstraction and structure-oriented abstraction—to enable effective retrieval and utilization of knowledge graphs for question answering even when entities are anonymized (replaced with semantically meaningless MIDs).

Federated CLIP for Resource-Efficient Heterogeneous Medical Image Classification

This paper proposes FedMedCLIP, a federated CLIP framework for medical image classification. By freezing the CLIP encoder and combining a masked Feature Adaptation Module (FAM), a local masked MLP, and class-level KL distillation regularization, the framework achieves robust classification under data heterogeneity with minimal communication and computational overhead (surpassing the second-best method by 8% on ISIC2019 and running 120× faster than FedAVG).

StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreak

This paper proposes StyleBreak, the first audio jailbreak framework based on speech style, which systematically investigates the impact of linguistic, paralinguistic, and extralinguistic attributes on LAM alignment robustness through a two-stage style-aware transformation pipeline and a query-adaptive policy network. StyleBreak improves ASR by 7.1%–22.3% across multiple attack paradigms.

ALTER: Asymmetric LoRA for Token-Entropy-Guided Unlearning of LLMs

This paper proposes ALTER, a framework that combines an asymmetric LoRA architecture with token-level Tsallis entropy guidance to achieve precise unlearning of target knowledge in LLMs. A parameter isolation mechanism is employed to preserve the model's general capabilities, achieving state-of-the-art performance on three benchmarks: TOFU, WMDP, and MUSE.

Anti-adversarial Learning: Desensitizing Prompts for Large Language Models

This paper proposes PromptObfus, which adopts an "anti-adversarial learning" paradigm to replace sensitive tokens in user prompts with semantically distinct yet task-preserving alternatives. The approach eliminates explicit privacy leakage entirely and reduces implicit privacy inference attack success rates by 62.70%, without degrading the task performance of remote LLMs.

SafeNlidb: A Privacy-Preserving Safety Alignment Framework for LLM-based Natural Language Database Interfaces

This paper proposes SafeNlidb, a framework that jointly optimizes safety reasoning and SQL generation in LLM-driven Natural Language Interfaces to Databases (NLIDBs) through a safety-aware data synthesis pipeline and an alternating preference optimization strategy, effectively defending against privacy leakage under implicit inference attacks.

SproutBench: A Benchmark for Safe and Ethical Large Language Models for Youth

This paper introduces SproutBench, an evaluation benchmark comprising 1,283 developmentally-grounded adversarial prompts, designed to systematically assess the safety of 47 LLMs in contexts involving children and adolescents (ages 0–6, 7–12, and 13–18). Key findings reveal that safety and risk prevention are strongly correlated (\(\rho = 0.86\)), while a significant trade-off exists between interactivity and age-appropriateness (\(\rho = -0.48\)).

Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving

This paper proposes AdvRoad, a two-stage framework (Road-Style Adversary Generation + Scenario-Associated Adaptation) that generates diverse adversarial posters with road-surface texture styles. These posters induce "ghost objects" (false positives) in visual 3D detectors for autonomous driving while remaining inconspicuous to human drivers due to their natural appearance, significantly improving the stealthiness and defensive resistance of FP attacks.

iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verification

This paper proposes iSeal — the first active fingerprinting method capable of reliably verifying LLM ownership in a black-box setting where the model thief has full control over the inference process. Through a triple mechanism of an external encrypted encoder, RSC error correction, and similarity-based matching, iSeal maintains a 100% Fingerprint Success Rate (FSR) across 12 LLMs and 10+ attack types, while existing methods drop to 0%.

Uncovering Bias Paths with LLM-guided Causal Discovery: An Active Learning and Dynamic Scoring Approach

This paper proposes a hybrid causal discovery framework that integrates LLM semantic priors with statistical signals. Through an active learning strategy and a dynamic scoring mechanism, the framework prioritizes querying the most informative variable pairs, effectively recovering fairness-critical causal paths (e.g., sex→education→income) under noise and confounding conditions, substantially outperforming classical CD methods and naïve LLM-based approaches.

Uncovering Pretraining Code in LLMs: A Syntax-Aware Attribution Approach

This paper proposes SynPrune — the first syntax-aware membership inference attack (MIA) method for code. By identifying 47 Python syntactic conventions and pruning syntactically determined tokens (retaining only tokens that reflect authorial style) when computing MIA scores, SynPrune achieves an average AUROC improvement of 15.4%, enabling effective detection of pretraining data attribution in code LLMs.

AUVIC: Adversarial Unlearning of Visual Concepts for Multi-modal Large Language Models

This paper proposes AUVIC, a framework that combines an adversarial perturbation generator with a dynamic anchor preservation mechanism to precisely unlearn target visual concepts (e.g., specific faces) in MLLMs, while avoiding collateral forgetting of semantically similar concepts. The paper also introduces VCUBench, the first evaluation benchmark for visual concept unlearning in group-scene scenarios.

Designing Truthful Mechanisms for Asymptotic Fair Division

This paper proposes the PRD (Proportional Response with Dummy) mechanism, which for the first time simultaneously achieves expected truthfulness, polynomial-time computability, and high-probability envy-freeness in the asymptotic fair division setting, requiring only \(m = \Omega(n \log n)\) items. This resolves an open problem posed by Manurangsi & Suksompong.

Learning from the Undesirable: Robust Adaptation of Language Models without Forgetting

This paper proposes Learning-from-the-Undesirable (LfU), a regularization method for SFT that simulates "undesirable behavior" by applying gradient ascent to an auxiliary model, then enforces representation-level consistency between the original and auxiliary models via an MSE loss. This effectively mitigates overfitting, catastrophic forgetting, and adversarial fragility in limited-data fine-tuning.

Lost in Translation? A Comparative Study on the Cross-Lingual Transfer of Composite Harms

This paper introduces the CompositeHarm benchmark, which systematically investigates the vulnerability of LLM safety alignment in cross-lingual settings by translating adversarial syntactic attacks (AttaQ) and contextualized harms (MMSafetyBench) into five Indic languages. The study finds that adversarial syntactic attacks achieve dramatically higher attack success rates in Indic languages.

An LLM-Based Simulation Framework for Embodied Conversational Agents in Psychological Counseling

This paper proposes the ECAs framework, which grounds psychological counseling simulation in established theories such as Cognitive Behavioral Therapy (CBT). By leveraging LLMs to expand real counseling cases into embodied cognitive memory spaces, the framework simulates the complete cognitive processes of clients in counseling sessions and generates high-fidelity dialogue data. ECAs significantly outperforms baselines in both expert and automated evaluations.

FedP²EFT: Federated Learning to Personalize PEFT for Multilingual LLMs

This paper proposes FedP²EFT, which collaboratively trains a Personalization Strategy Generator (PSG) via federated learning to automatically generate personalized LoRA rank structures for each client, substantially outperforming manually designed PEFT configurations and existing FL personalization methods in multilingual LLM fine-tuning.

GraphTextack: A Realistic Black-Box Node Injection Attack on LLM-Enhanced GNNs

This paper proposes GraphTextack — the first black-box multimodal node injection poisoning attack targeting LLM-enhanced GNNs. It jointly optimizes the graph structural connections and semantic features of injected nodes via an evolutionary optimization framework, requiring neither internal model information nor surrogate models. GraphTextack significantly outperforms 12 baseline methods across 5 datasets and 2 types of LLM-GNN models.

PANDA: Patch and Distribution-Aware Augmentation for Long-Tailed Exemplar-Free Continual Learning

This paper proposes PANDA, a framework that achieves intra-task class balancing via CLIP-guided semantic patch grafting and alleviates inter-task distribution shift through a learnable distribution smoothening mechanism. PANDA operates as a plug-and-play module to improve pretrained model-based exemplar-free continual learning under long-tailed scenarios.

PSM: Prompt Sensitivity Minimization via LLM-Guided Black-Box Optimization

This paper proposes PSM, a framework that formalizes system prompt protection as a utility-constrained black-box optimization problem. By leveraging LLM-as-Optimizer, PSM automatically searches for an optimal "shield" suffix that reduces prompt extraction attack success rates to near zero without degrading model functionality.

TOFA: Training-Free One-Shot Federated Adaptation for Vision-Language Models

TOFA is a federated learning framework that adapts CLIP via hierarchical Bayesian inference of personalized visual prototype distributions, globally aligned LLM-based text augmentation, and adaptive modality fusion — achieving training-free, single-round communication adaptation that outperforms one-shot baselines and even some multi-round training methods across 9 datasets.

Attention Retention for Continual Learning with Vision Transformers

This paper proposes ARCL-ViT, a framework that prevents attention drift in Vision Transformers during continual learning via a two-step strategy of attention mask generation and gradient masking. It achieves state-of-the-art results on ImageNet-R and CIFAR-100, demonstrating that preserving attention patterns is key to mitigating catastrophic forgetting.

Beyond Superficial Forgetting: Thorough Unlearning through Knowledge Density Estimation and Block Re-insertion

This paper proposes the KUnBR framework, which employs gradient-guided knowledge density estimation to localize layers enriched with harmful knowledge, and adopts a block re-insertion strategy to bypass the gradient-masking effect of cover layers, achieving deep unlearning of harmful knowledge in LLMs rather than mere surface-level suppression.

Democratizing LLM Efficiency: From Hyperscale Optimizations to Universal Deployability

This position paper argues that current LLM efficiency research is dominated by hyperscale assumptions. It identifies five open research challenges targeting small- and medium-scale deployers, and advocates for redefining efficiency metrics through an Overhead-Aware Efficiency (OAE) framework.

Gender Bias in Emotion Recognition by Large Language Models

This paper systematically evaluates gender bias in emotion recognition across multiple LLMs (GPT-4/5, Mistral, LLaMA, etc.), finding that most models exhibit statistically significant gender bias on at least one emotion label. Experiments demonstrate that inference-time prompt strategies (prompt engineering, in-context learning, CoT) fail to effectively debias, whereas training-based fine-tuning can substantially mitigate the bias.

LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models

This paper proposes LAMP, a black-box Universal Adversarial Perturbation (UAP) learning method targeting multi-image MLLMs. By incorporating attention constraints and a contagious loss, LAMP enables cross-model and cross-task transferable attacks by perturbing only a small subset of input images.

Perturb Your Data: Paraphrase-Guided Training Data Watermarking

This paper proposes SPECTRA — a paraphrase-sampling-based training data watermarking method. It generates paraphrases via an LLM and uses Min-K%++ scoring to select paraphrases with scores close to the original text as watermarks. Even when watermarked data constitutes as little as 0.001% of the training corpus, the p-value gap between members and non-members consistently exceeds 9 orders of magnitude.

Principles2Plan: LLM-Guided System for Operationalising Ethical Principles into Plans

This paper presents Principles2Plan, an interactive prototype system that enables collaborative human–LLM operationalisation of high-level ethical principles (e.g., beneficence, privacy) into context-sensitive ethical rules, which are then embedded into a PDDL planner to generate ethically compliant action plans.

The Confidence Trap: Gender Bias and Predictive Certainty in LLMs

This paper proposes Gender-ECE, a metric for systematically evaluating the confidence calibration and alignment with human bias judgments of six open-source LLMs on gendered pronoun prediction tasks. The authors find that Gemma-2 exhibits the worst calibration and an extreme disparity between male and female pronoun calibration, whereas GPT-J-6B — trained on less filtered data — achieves the best calibration overall.

Alternative Fairness and Accuracy Optimization in Criminal Justice

This paper systematically reviews the three major dimensions of algorithmic fairness (group fairness, individual fairness, and procedural fairness), proposes an improved group fairness optimization formulation based on tolerance constraints, and constructs a "Three Pillars of Fairness" deployment framework tailored for public decision-making systems.

An Improved Privacy and Utility Analysis of Differentially Private SGD with Bounded Domain and Smooth Losses

Under the assumption that the loss function is only \(L\)-smooth (convexity is not required), this paper derives tighter closed-form RDP privacy bounds for DPSGD and, for the first time, provides a complete convergence/utility analysis in bounded domain scenarios, revealing that a smaller parameter domain diameter can simultaneously improve both privacy and utility.

An Information Theoretic Evaluation Metric for Strong Unlearning

This work reveals a fundamental flaw in existing black-box unlearning evaluation metrics (such as MIA and JSD)—modifying only the final layer can satisfy all black-box metrics while the intermediate layers completely retain information about the forgotten data. To address this, the authors propose IDI, a white-box metric that quantifies unlearning effectiveness by estimating the difference in mutual information between each layer and the forgotten labels via InfoNCE. They also propose the COLA method, which achieves IDI scores close to retraining (Retrain) on CIFAR-10/100 and ImageNet-1K.

Angular Gradient Sign Method: Uncovering Vulnerabilities in Hyperbolic Networks

Proposes the Angular Gradient Sign Method (AGSM), which decomposes gradients in hyperbolic space into radial (hierarchical depth) and angular (semantic) components. By applying perturbations strictly along the angular direction to generate adversarial examples, it reduces accuracy by an additional 5-13% compared to standard FGSM/PGD on image classification and cross-modal retrieval tasks.

Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs

Proposes Authority Backdoor, which embeds hardware fingerprints as backdoor triggers into DNNs to ensure the model functions correctly only on authorized devices. It achieves certifiable robustness against adaptive trigger reversal attacks through randomized smoothing.

Breaking the Adversarial Robustness-Performance Trade-off in Text Classification via Manifold Purification

The paper proposes the Manifold-Correcting Causal Flow (MC²F) framework. It learns the manifold density of clean data embeddings using a Stratified Riemannian Continuous Normalizing Flow (SR-CNF) for adversarial sample detection. It then utilizes a Geodesic Purification Solver to project embeddings detected as adversarial back to the clean manifold along the shortest path. This approach comprehensively outperforms state-of-the-art (SOTA) adversarial robustness on three datasets (SST-2, AGNews, and YELP) without any loss in (and even slightly improving) clean data accuracy.

Breaking the Dyadic Barrier: Rethinking Fairness in Link Prediction Beyond Demographic Parity

This paper reveals three fundamental flaws of dyadic fairness and Demographic Parity (\(\Delta\text{DP}\)) in link prediction—insufficient GNN expressiveness, obscured subgroup bias, and ranking insensitivity. It proposes a ranking-aware fairness metric based on NDKL and a post-processing algorithm, MORAL, achieving state-of-the-art fairness-utility trade-offs across six datasets.

CoRe-Fed: Bridging Collaborative and Representation Fairness via Federated Embedding Distillation

The CoRe-Fed framework is proposed to simultaneously address both representation fairness and collaborative fairness in federated learning through two synergistic modules: embedding-level contrastive alignment and contribution-aware aggregation, significantly improving the fairness and generalization of the global model under heterogeneous data distributions.

Credal Ensemble Distillation for Uncertainty Quantification

Propounds the Credal Ensemble Distillation (CED) framework, which distills a deep ensemble teacher into a single model, CREDIT. Instead of a single softmax distribution, this model predicts interval-valued class probabilities that define a credal set. It achieves superior or comparable uncertainty estimation on OOD detection tasks while substantially reducing inference overhead (reducing inference time from \(5\times\) to \(1\times\)).

DeepTracer: Tracing Stolen Model via Deep Coupled Watermarks

This work proposes DeepTracer, a robust watermarking framework. By leveraging adaptive source class selection (covering the feature space via K-Means clustering), same-class coupling loss (reducing the distance between watermark samples and the target class in the output space), and two-stage key sample filtering, the watermarking task is deeply coupled with the primary task. DeepTracer achieves an average watermark success rate of 77-100% under 6 types of model stealing attacks (including hard-label and data-free), significantly outperforming existing methods.

Detect All-Type Deepfake Audio: Wavelet Prompt Tuning for Enhanced Auditory Perception

This work establishes the first all-type (speech/sound/singing/music) audio deepfake detection benchmark and proposes Wavelet Prompt Tuning (WPT) to enhance the full-frequency perception of SSL features using Discrete Wavelet Transform. Without adding training parameters, WPT outperforms full fine-tuning, achieving an average EER of only 3.58% after co-training.

Diversifying Counterattacks: Orthogonal Exploration for Robust CLIP Inference

This paper proposes the Directional Orthogonal Counterattack (DOC) method. By introducing orthogonal gradient components and momentum updates during the counterattack optimization, it expands the search space. Combined with a cosine similarity-based Directional Sensitivity Score to adaptively modulate the counterattack intensity, the method significantly improves the test-time adversarial robustness of CLIP across 16 datasets.

Easy to Learn, Yet Hard to Forget: Towards Robust Unlearning Under Bias

Proposes the CUPID framework, which partitions the forget set into causal/bias subsets through loss landscape sharpness analysis, and identifies and disentangles the causal/bias pathways in the model. This achieves precise class unlearning on biased models, effectively resolving the "shortcut unlearning" issue.

EFX and PO Allocation Exists for Two Types of Goods

It is proved that when there are only two types of goods and all valuations are positive, an allocation satisfying both EFX (Envy-Freeness up to any good) and Pareto optimality always exists, and a quasi-linear time algorithm is provided.

Enhancing DPSGD via Per-Sample Momentum and Low-Pass Filtering

Proposed DP-PMLF, which reduces clipping bias via per-sample momentum while simultaneously suppressing high-frequency DP noise using a low-pass filter, mitigating the accuracy degradation of DPSGD from both directions for the first time.

Fair Model-Based Clustering

This paper proposes FMC, a fair clustering algorithm based on finite mixture models. By exerting fairness constraints on model parameters (instead of sample-level assignments), it achieves scalable fair clustering where the number of parameters is independent of the sample size. FMC supports mini-batch learning and categorical data, significantly outperforming existing methods on large-scale datasets.

FairGSE: Fairness-Aware Graph Neural Network without High False Positive Rates

This work is the first to reveal the "FPR shortcut" issue in fairness-aware GNNs, where existing methods achieve fairness metrics by misclassifying a large number of negative samples as positive. It proposes the FairGSE framework, which reweights graph edges by maximizing 2D structural entropy to simultaneously improve fairness and reduce false positive rates, achieving a 39% reduction in FPR.

Fine-Grained DINO Tuning with Dual Supervision for Face Forgery Detection

Proposed DFF-Adapter (DeepFake Fine-Grained Adapter), a lightweight fine-tuning scheme for DINOv2 tailored for deepfake detection. By injecting a three-branch adapter (authenticity detection head, forgery type classification head, and shared head) into each Transformer block combined with a Forgery-Aware Multi-Head Router to enable subspace-level dynamic routing of LoRA experts, it leverages the auxiliary forgery type classification task to enhance the artifact sensitivity of the primary task, achieving SOTA performance in multiple cross-dataset evaluations with only 3.5M trainable parameters.

Generalizing Fair Clustering to Multiple Groups: Algorithms and Applications

Generalizes the Closest Fair Clustering problem from only two groups to arbitrarily many groups, proves that the equal-proportion case with three or more groups is already NP-hard, proposes near-linear time approximation algorithms (\(O(|\chi|^{1.6}\log^{2.81}|\chi|)\) for equal proportions, and \(O(|\chi|^{3.81})\) for arbitrary proportions), and extends the results to fair correlation clustering and fair consensus clustering problems.

Ghost in the Transformer: Detecting Model Reuse with Invariant Spectral Signatures

This paper proposes GhostSpec, a data-free, white-box method that does not modify model behavior. It extracts spectral fingerprints by applying SVD to invariant matrix products of attention weight matrices, enabling robust verification of LLM lineage under fine-tuning, pruning, merging, expansion, and even adversarial transformations.

Graph Out-of-Distribution Detection via Test-Time Calibration with Dual Dynamic Dictionaries

Proposes the BaCa framework, which generates boundary-aware synthetic graph topologies during the test phase via graphon estimation and a mixup strategy. This is combined with dual priority-queue dynamic dictionaries and an attention mechanism to adaptively calibrate OOD scores. It requires no fine-tuning of the pre-trained model or introduction of auxiliary OOD data, outperforming GOODAT across all 10 datasets with an average AUC improvement of 8.37%.

Hashed Watermark as a Filter: A Unified Defense Against Forging and Overwriting Attacks in Neural Network Watermarking

Proposes NeuralMark—a weight watermarking method based on a hashed watermark filter. It utilizes a hash function to generate an irreversible binary watermark from a secret key, serving as a private filter to select embedding parameters. It leverages the avalanche effect to block gradient backpropagation in forgery attacks, and employs multi-round filtering to reduce parameter overlap, thereby resisting overwriting attacks. Its effectiveness and robustness are validated across 13 CNN/Transformer architectures, 5 image classification tasks, and 1 text generation task.

HealSplit: Towards Self-Healing through Adversarial Distillation in Split Federated Learning

Proposes HealSplit, the first unified defense framework for Split Federated Learning (SFL). It integrates Topology-Aware Detection (TAS) to identify poisoned samples, GANs to generate semantically consistent substitute representations, and adversarial multi-teacher distillation to train a consistency-validating student model. This achieves end-to-end detection and recovery, outperforming ten SOTA defense methods under five types of poisoning attacks.

Improving the Convergence Rate of Ray Search Optimization for Query-Efficient Hard-Label Attacks

Addressing the query efficiency bottleneck in hard-label black-box adversarial attacks, this paper proposes a momentum algorithm, ARS-OPT, based on Nesterov accelerated gradient, and introduces a surrogate model prior to obtain an enhanced version, PARS-OPT. It theoretically proves a faster convergence rate and outperforms 13 state-of-the-art (SOTA) methods on ImageNet and CIFAR-10.

InfoDecom: Decomposing Information for Defending Against Privacy Leakage in Split Inference

This paper proposes InfoDecom, which reduces redundant information in smashed data via two-stage information decomposition (frequency-domain visual information removal + mutual information suppression). It then injects closed-form computed Gaussian noise to provide theoretical privacy guarantees, achieving a utility-privacy trade-off (UPT) far superior to existing methods under shallow client-side models.

Learning to Collaborate: An Orchestrated-Decentralized Framework for Peer-to-Peer Collaborative Learning

This paper proposes the KNEXA-FL framework, which models P2P collaboration as a contextual bandit problem via a model-agnostic Central Pairwise Matcher (CPM). By using LinUCB to learn the optimal pairing strategy, it achieves an approximately 50% increase in Pass@1 compared to random P2P in heterogeneous LLM federated learning, while avoiding the catastrophic collapse associated with centralized distillation.

Matrix-Free Two-to-Infinity and One-to-Two Norms Estimation

The authors propose TwINEst and TwINEst++, two randomized algorithms based on the Hutchinson diagonal estimator, to efficiently estimate \(\|A\|_{2\to\infty}\) and \(\|A\|_{1\to 2}\) norms in a matrix-free setting. They provide theoretical oracle complexity guarantees and demonstrate significant advantages in Jacobian regularization of DNNs (for adversarial robustness in image classification) and defense against adversarial attacks in recommender systems.

Minimizing Inequity in Facility Location Games

Investigates the problem of minimizing the maximum weighted group effect (Maximum Group Effect) in facility location games on the real line. The paper proposes two strategyproof mechanisms, BALANCED and MAJOR-PHANTOM, achieving tight approximation ratios in single-facility settings, unifying classical objectives like utilitarian (social cost) and egalitarian (maximum cost) with group fairness objectives, and extending the endpoint mechanism to two-facility settings.

MPD-SGR: Robust Spiking Neural Networks with Membrane Potential Distribution-Driven Surrogate Gradient Regularization

A theoretical connection is established between SNN robustness error and surrogate gradient (SG) magnitude. This reveals that reducing the overlap ratio between the membrane potential distribution (MPD) and the effective gradient interval of the SG can effectively decrease sensitivity to adversarial perturbations. Based on this, the MPD-SGR regularization method is proposed, which significantly outperforms existing SNN defense methods under both vanilla and adversarial training settings.

Multi-Faceted Attack: Exposing Cross-Model Vulnerabilities in Defense-Equipped Vision-Language Models

This paper proposes MFA, a Multi-Faceted Attack framework that systematically exposes security vulnerabilities in VLMs equipped with multi-layered defenses (including commercial models such as GPT-4o and Gemini) through three complementary dimensions: Attention Transfer Attack (ATA) to bypass alignment, adversarial signatures to evade content moderation, and visual encoder attack to overwrite system prompts. The overall attack success rate reaches 58.5%.

OAD-Promoter: Enhancing Zero-shot VQA using Large Language Models with Object Attribute Description

This paper proposes OAD-Promoter, which cooperatively utilizes three modules—Object-concentrated Example Generation (OEG), Memory Knowledge Assistance (MKA), and OAD Prompt—to mitigate language bias inherited by LLMs and enhance domain adaptation capabilities under the zero-shot setting, achieving SOTA performance on multiple benchmarks such as VQAv2.

Plug-and-Play Parameter-Efficient Tuning of Embeddings for Federated Recommendation

This paper proposes a plug-and-play federated recommendation framework. By introducing the concept of PEFT (Parameter-Efficient Fine-Tuning) to item embeddings, it freezes the pre-trained full embeddings and transmits only the lightweight compressed embeddings (LoRA / Hash / RQ-VAE), substantially reducing communication overhead while improving recommendation accuracy.

Privacy Auditing of Multi-Domain Graph Pre-Trained Model under Membership Inference Attack

This paper proposes the MGP-MIA framework, conducting the first membership inference attack (MIA) against multi-domain graph pre-trained models. By amplifying membership signals via machine unlearning, constructing shadow models through incremental learning, and employing a similarity-based inference mechanism, MGP-MIA effectively reveals the privacy leakage risks of multi-domain graph pre-training.

Privacy on the Fly: A Predictive Adversarial Transformation Network for Mobile Sensor Data

This paper proposes PATN (Predictive Adversarial Transformation Network), the first framework to introduce adversarial perturbations to sensor data privacy protection. By utilizing historical sensor data to generate future-oriented adversarial perturbations, it achieves zero-latency real-time privacy protection while maintaining the semantic fidelity of the sensor data.

ProbLog4Fairness: A Neurosymbolic Approach to Modeling and Mitigating Bias

The ProbLog4Fairness framework is proposed, which leverages the probabilistic logic programming language ProbLog to formalize bias mechanisms in data as interpretable logic programs, and integrates bias assumptions into neural network training through distant supervision via DeepProbLog, achieving flexible and principled bias mitigation.

Reference Recommendation based Membership Inference Attack against Hybrid-based Recommender Systems

A reference recommendation-based Membership Inference Attack (MIA) is proposed, introducing a relative membership metric \(\rho(u) = d(v_t, v_h) / d(v_t, v_r)\). By leveraging the personalized features of hybrid-based recommender systems to obtain reference recommendations, this work achieves the first effective attack against hybrid-based recommender systems, achieving an attack success rate of up to 93.4% with a computation cost of only 10 seconds.

RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service

This paper proposes RegionMarker, a watermarking framework triggered by semantic regions. By defining trigger regions in a low-dimensional space and injecting semantic watermarks, it represents the first EaaS copyright protection method capable of simultaneously defending against CSE attacks, paraphrasing attacks, and dimensional perturbation attacks.

Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approach

This study proposes the TGAF framework, which leverages diffusion models to encode target labels into 2D semantic tensors to guide adversarial noise generation, and designs a random masking strategy to preserve complete semantic information, significantly improving the transferability of targeted adversarial attacks.

Revisiting (Un)Fairness in Recourse by Minimizing Worst-Case Social Burden

This paper systematically analyzes three major limitations of fairness metrics in algorithmic recourse (neglecting classifier decision behavior, ignoring ground-truth labels, and disparity metrics concealing unfairness). It proposes a social burden-based fairness framework, MISOB, which reduces the social burden of all groups through a minimax-weighted training strategy, simultaneously improving fairness during both the prediction and recourse stages without requiring access to sensitive attributes.

Robust Watermarking on Gradient Boosting Decision Trees

Proposes the first robust watermarking framework for GBDT models. By embedding watermarks through in-place fine-tuning and designing four embedding strategies (Wrong Prediction Flip, Outlier Flip, Cluster Center Flip, Confidence Flip), it achieves high embedding success rates, low accuracy loss, and strong robustness against fine-tuning.

SecMoE: Communication-Efficient Secure MoE Inference via Select-Then-Compute

This paper proposes the SecMoE framework, which efficiently implements sparse MoE inference in secure two-party computation (2-PC) via the Select-Then-Compute paradigm. It avoids redundant expert computation, reducing communication overhead by up to 29.8× and achieving up to 16.1× end-to-end acceleration.

TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models

Ours proposes TopoReformer, a model-agnostic adversarial purification pipeline based on topological autoencoders. By leveraging persistent homology to enforce topological consistency within the latent space, the framework filters adversarial perturbations without requiring adversarial training, effectively safeguarding OCR systems against classic, adaptive, and OCR-specific watermark attacks.

Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models

Proposes GFM-BA, the first systematic backdoor attack method targeting the pre-training phase of Graph Foundation Models (GFMs). By employing three modules—label-free trigger association, node-adaptive trigger generation, and persistent backdoor anchoring—it simultaneously addresses the three major challenges of effectiveness, stealthiness, and persistence.

Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation

Proposes STAB (Sharpness-aware Transferable Adversarial Backdoor), which trains a surrogate model using SAM to converge to flat regions of the loss landscape and optimizes context-aware adversarial triggers using Gumbel-Softmax. This is the first work to simultaneously achieve cross-dataset transferability and stealthiness in backdoor attacks against code models.

Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges

This paper proposes TH-Attack, a transferable node injection attack framework for hypergraph neural networks (HGNNs). By identifying pivotal hyperedges along information aggregation paths and injecting semantic-reversed malicious nodes, TH-Attack achieves effective black-box attacks across various HGNN architectures, reducing classification accuracy from 80%+ to below 30%.

Truth, Justice, and Secrecy: Cake Cutting Under Privacy Constraints

Proposes the first privacy-preserving cake-cutting protocol, PP_CC_puv, which adapts the strategyproof algorithm of Chen et al. using secret sharing and secure multi-party computation (MPC) technologies, preventing any party from learning others' preference information while maintaining envy-freeness, Pareto-optimality, and strategyproofness.

Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking

This work presents the first systematic study on overwriting attacks against neural audio watermarking, proposing a three-tier attack framework (white-box, gray-box, and black-box). It achieves near 100% attack success rates across three SOTA methods (AudioSeal, Timbre, and WavMark), exposing severe security vulnerabilities in existing audio watermarking systems.

Can Protective Watermarking Safeguard the Copyright of 3D Gaussian Splatting?

This work systematically reveals the vulnerability of 3DGS watermarking frameworks for the first time, proposing the GSPure framework. GSPure accurately separates and removes watermark-related Gaussian primitives through view-aware weight accumulation and geometric feature clustering, reducing watermark PSNR by up to 16.34dB while keeping the original scene loss below 1dB.

Splats in Splats: Robust and Effective 3D Steganography towards Gaussian Splatting

Introduces Splats in Splats, the first steganography framework that embeds 3D content into 3DGS assets without modifying any vanilla 3DGS attributes. Through importance-graded spherical harmonics (SH) coefficient encryption and autoencoder-assisted opacity mapping, it achieves 5.31% higher scene fidelity and 3x faster rendering speeds.