🔒 Safety¶

🎞️ ECCV2024 · 19 paper notes

📌 Same area in other venues: 🧠 NeurIPS2026 (35) · 🎞️ ECCV2026 (69) · 📷 CVPR2026 (162) · 🔬 ICLR2026 (329) · 💬 ACL2026 (120) · 🧪 ICML2026 (114)

🔥 Top topics: Adversarial Robustness ×9 · Federated Learning ×3 · Point Cloud ×2

CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks: This paper proposes CGNC, which leverages the CLIP text encoder to inject target-category semantic information into a conditional generative network. Combining cross-attention modules with masked fine-tuning, this method significantly improves the black-box transfer success rate of both multi-target and single-target directed adversarial attacks.
One-stage Prompt-based Continual Learning: This paper proposes the OS-Prompt framework. By directly utilizing the token embeddings of ViT intermediate layers as prompt queries (rather than relying on an extra query ViT forward pass), it reduces the computational-cost of prompt-based continual learning by approximately 50%. It further compensates for the loss in representation capacity with a Query-Pool Regularization (QR) loss, outperforming CodaPrompt by about 1.4% on CIFAR-100, ImageNet-R, and DomainNet.
Towards Multi-modal Transformers in Federated Learning: The FedCola framework is proposed, which utilizes complementary local training and collaborative aggregation to realize cross-modal knowledge transfer for multi-modal Transformers in federated learning, effectively bridging the gap between uni-modal and multi-modal clients without requiring public data.
MAGR: Manifold-Aligned Graph Regularization for Continual Action Quality Assessment: Proposes the MAGR method, which utilizes a manifold alignment projector and an Intra-Inter-Joint graph regularizer to address the misalignment between old and current feature manifolds caused by feature replay in Continual Action Quality Assessment (CAQA), significantly outperforming existing baselines across four datasets.
Noise-Assisted Prompt Learning for Image Forgery Detection and Localization: This paper proposes CLIP-IFDL, a CLIP-based image forgery detection and localization model. By employing instance-aware dual-stream prompt learning and a forgery-enhanced noise adapter, it addresses CLIP's lack of domain-specific prompts and forgery sensitivity in forgery detection, successfully transferring CLIP's open-world generalization capability to the forgery detection task.
Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspective: Analyzes the causes of catastrophic overfitting in fast adversarial training from a bi-level optimization perspective, and proposes the FGSM-PCO method. By adaptively fusing historical and current adversarial examples along with custom regularization loss, it effectively prevents and corrects the collapse of inner optimization.
Bi-TTA: Bidirectional Test-Time Adapter for Remote Physiological Measurement: This paper proposes the Bi-TTA framework, which introduces Test-Time Adaptation to remote photoplethysmography (rPPG) tasks for the first time. By leveraging a spatiotemporal consistency self-supervised prior and a prospective-retrospective bidirectional adaptation strategy, the proposed method achieves model domain adaptation at test-time using only unlabeled single-instance data during inference.
Fisher Calibration for Backdoor-Robust Heterogeneous Federated Learning: This paper proposes Self-Driven Fisher Calibration (SDFC), which utilizes Fisher information to measure differences in parameter importance across different distributions. SDFC effectively distinguishes malicious backdoor clients and performs parameter calibration in heterogeneous federated learning scenarios, overcoming the limitations of existing defense methods that rely on data homogeneity and minority malicious node assumptions.
Any Target Can Be Offense: Adversarial Example Generation via Generalized Latent Infection: GAKer is proposed as the first targeted adversarial attack generator that generalizes to unseen target classes. By injecting target features (latent infection) into the intermediate layers of a UNet and employing a class-agnostic cosine distance loss instead of cross-entropy, it outperforms HGN on unseen classes by 14.13% in attack success rate.
SkyMask: Attack-Agnostic Robust Federated Learning with Fine-Grained Learnable Masks: This paper proposes SkyMask, which utilizes parameter-level learnable binary masks at the server side to detect malicious client model updates, achieving attack-agnostic robust federated learning that remains resilient even when up to 80% of clients are malicious.
Event Trojan: Asynchronous Event-based Backdoor Attacks: This paper proposes the Event Trojan framework, which, for the first time, designs backdoor attack methods specifically for asynchronous event data streams. It includes two modes, namely immutable triggers and mutable triggers, directly injecting malicious events at the event stream level to achieve stealthy and efficient backdoor attacks.
Resilience of Entropy Model in Distributed Neural Networks: This paper presents the first systematic study on the robustness of entropy coding models in distributed DNNs under both intentional interference (adversarial attacks) and unintentional interference (weather changes, motion blur, etc.). It reveals that the compression features learned by the entropy model are distinct from classification features, and proposes an object-aware total variation denoising defense method. This approach reduces post-attack transmission overhead to below clean data levels, with an accuracy drop of only around 2%.
Unveiling Privacy Risks in Stochastic Neural Networks Training: Effective Image Reconstruction from Gradients: This paper unveils that Stochastic Neural Networks (SNNs) in federated learning remain vulnerable to gradient inversion attacks. It proposes the ISG method, which reconstructs training data by formulating the stochastic training process of SNNs as an equivalent variant of traditional NN training, and introduces a feature constraint strategy to improve reconstruction fidelity.
Operational Open-Set Recognition and PostMax Refinement: This paper proposes OOSA (Operational Open-Set Accuracy), an evaluation metric for practical deployment scenarios, and PostMax, a post-processing algorithm. By normalizing the maximum class logit with deep feature magnitude and mapping it through a Generalized Pareto Distribution (GPD), logits are converted into reasonable probability estimates, achieving statistically significant SOTA performance in large-scale evaluations.
FLAT: Flux-Aware Imperceptible Adversarial Attacks on 3D Point Clouds: This paper proposes the FLAT framework to address the imperceptibility issue in 3D point cloud adversarial attacks from a flux perspective. By calculating the flux of local perturbation vector fields to evaluate uniformity changes and adjusting perturbation directions when high flux (disrupted uniformity) is detected, FLAT generates adversarial point clouds that are far harder to perceive than those of existing methods.
GeometrySticker: Enabling Ownership Claim of Recolorized Neural Radiance Fields: Proposes GeometrySticker, which "sticks" binary copyright information onto the geometric components (instead of the color components) of NeRF. This allows original creators to extract watermarks from rendered images to claim ownership, even if the NeRF is recolorized.
Hiding Imperceptible Noise in Curvature-Aware Patches for 3D Point Cloud Attack: Proposes the Wavelet Patches Attack (WPA) method, which employs wavelet transform to analyze local curvature structures of point clouds and hides adversarial perturbations within curvature-consistent patches—perturbing along tangent planes in flat regions and along normal vectors in sharp regions—achieving a more imperceptible 3D point cloud attack compared to existing methods.
Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model: NeRFProtector is proposed, which utilizes a pre-trained watermarking base model (message extractor) to embed binary watermarks in a plug-and-play manner during the NeRF creation process. By employing Progressive Global Rendering (PGR), watermarking knowledge is distilled into the NeRF representation, achieving high bit-accuracy copyright protection without modifying the NeRF architecture.
Transferable 3D Adversarial Shape Completion using Diffusion Models: This work proposes 3DAdvDiff, which leverages 3D diffusion models to generate high-quality, transferable 3D adversarial point clouds via adversarial shape completion. By combining model uncertainty, ensemble adversarial guidance, and saliency scoring strategies, it achieves state-of-the-art (SOTA) attack success rates against modern 3D models under black-box settings.