Abstract

The rapid adoption, usefulness, and resource-intensive training of Graph Neural Network~(GNN) models have made them an invaluable intellectual property in graph-based machine learning. However, their wide-spread adoption also makes them susceptible to stealing, necessitating robust Ownership Demonstration~(OD) techniques. Watermarking is a promising OD framework for deep neural networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data. Existing works on GNN watermarking primarily focus on node and graph classification, overlooking Link Prediction (LP).
In this paper, we propose genie~(watermarking textbf{G}raph ntextbf{E}ural textbf{N}etworks for ltextbf{I}nk prtextbf{E}diction), the first scheme to watermark GNNs for LP. genie creates a novel backdoor for both node-representation and subgraph-based LP methods, utilizing a unique trigger set and a secret watermark vector. Our OD scheme is equipped with Dynamic Watermark Thresholding~(DWT), ensuring high verification probability while addressing practical issues in existing OD schemes. We extensively evaluate genie across 4~diverse model architectures~(ie SEAL, GCN, GraphSAGE and NeoGNN), 7~real-world datasets and 21~watermark removal techniques and demonstrate its robustness to watermark removal and ownership piracy attacks. Finally, we discuss adaptive attacks against genie and a defense strategy to counter it.

Abstract

3D Gaussian Splatting (3DGS) has recently enabled highly photorealistic 3D reconstruction from casually captured multi-view images. However, this accessibility raises a privacy concern: publicly available images or videos can be exploited to reconstruct detailed 3D models of scenes or objects without the owner's consent. We present PatchPoison, a lightweight dataset-poisoning method that prevents unauthorized 3D reconstruction. Unlike global perturbations, PatchPoison injects a small high-frequency adversarial patch, a structured checkerboard, into the periphery of each image in a multi-view dataset. The patch is designed to corrupt the feature-matching stage of Structure-from-Motion (SfM) pipelines such as COLMAP by introducing spurious correspondences that systematically misalign estimated camera poses. Consequently, downstream 3DGS optimization diverges from the correct scene geometry. On the NeRF-Synthetic benchmark, inserting a 12 X 12 pixel patch increases reconstruction error by 6.8x in LPIPS, while the poisoned images remain unobtrusive to human viewers. PatchPoison requires no pipeline modifications, offering a practical, "drop-in" preprocessing step for content creators to protect their multi-view data.

Abstract

Image style transfer poses a fascinating dilemma in the very definitions of content and style, as even humans struggle to quantify how much an image has been "stylized", whether the content has been sufficiently preserved, and how adequately the two have been combined. Essentially, evaluating the quality of the output image is not a trivial task and is prone to subjectivity. We therefore propose two novel metrics for this purpose: Regional Style Influence (RSI) and Style-Content Attribution Ratio (SCAR). Such measures are designed to highlight the most relevant regions of the image and quantify the trade-off between content and style within them. They are computed through a patch- based analysis of the input and output images, assessing the impact of style embedding and the dominance of style over content within each patch. RSI and SCAR should yield a helpful representation of the reasoning behind the tested model, taking one step forward toward its explainability. This paper provides an insightful description of our proposed metrics and shows their outcomes when applied to state-of-the-art models from the literature. The results are presented as heatmaps for the tested images, highlighting the most interesting aspects in terms of content and style definitions, along with a study on the influence of patch size.

Our study is motivated by the lack of standard measures for this type of research and by the pursuit of explainability in the style transfer process, which is a crucial part of its evolution. Hopefully, our findings will provide visual support for reasoning about style and content characteristics, motivating future work in this promising area.

Abstract

Temporal Graph Neural Networks (TGNNs) are increasingly used in high-stakes domains, such as financial forecasting, recommendation systems, and fraud detection. However,
their susceptibility to poisoning attacks poses a critical security risk. We introduce LORETTA (Low Resource Twophase Temporal Attack), a novel adversarial framework on
Continuous-Time Dynamic Graphs, which degrades TGNN
performance by an average of 29.47% across 4 widely benchmark datasets and 4 State-of-the-Art (SotA) models.
LORETTA operates through a two-stage approach: (1) sparsify the graph by removing high-impact edges using any of the
16 tested temporal importance metrics, (2) strategically replace
removed edges with adversarial negatives via LORETTA's
novel degree-preserving negative sampling algorithm. Our
plug-and-play design eliminates the need for expensive surrogate models while adhering to realistic unnoticeability constraints. LORETTA degrades performance by upto 42.0% on
MOOC, 31.5% on Wikipedia, 28.8% on UCI, and 15.6%on Enron. LORETTA outperforms 11 attack baselines, remains undetectable to 4 leading anomaly detection systems,
and is robust to 4 SotA adversarial defense training methods,
establishing its effectiveness, unnoticeability, and robustness.

Abstract

CubeSats have become a popular platform for low-cost space missions, supporting application ranging from Earth observation to space exploration. Despite their growing adoption, CubeSats face significant challenges in supporting in-orbit software updates with strong authentication and integrity guarantees due to severe constraints on computation, power, and communication bandwidth. Existing approaches either impose unsustainable overhead (e.g., public key cryptography) or focus solely on ground station-to-CubeSat delivery. Prior work such as CSUM offers an efficient hash chain based protocol for broadcast authentication from ground stations. However, it does not address the dissemination of update within a CubeSat cluster, which limits scalability and increase transmission redundancy.

In this paper, we propose an enhancement to the CSUM protocol by replacing its custom hash concatenation mechanism with a standardized HMAC construction to achieve stronger resistance against cryptographic attacks, with minimal trade-off in efficiency. Building on this enhancement, we introduce CSUM-G, an extension of CSUM that enables authenticated software update propagation across a CubeSat cluster using inter-satellite links and shared secret cluster keys. In our implementation, CSUM-G achieves 100% update success with only 0.13-0.20 average retries per update, and propagates updates in as little as 0.04 seconds for 6 CubeSats and 3.68 seconds for 600 nodes.

Abstract

Federated Learning (FL) enables multiple users to collaboratively train a global model in a distributed manner without revealing their personal data. However, FL remains vulnerable to model poisoning attacks, where malicious actors inject crafted updates to compromise the global model's accuracy. We propose a novel defense mechanism, Kernel-based Trust Segmentation (KeTS), to counter model poisoning attacks. Unlike existing approaches, KeTS analyzes the evolution of each client's updates and effectively segments malicious clients using Kernel Density Estimation (KDE), even in the presence of benign outliers. We thoroughly evaluate KeTS's performance against the six most effective model poisoning attacks (i.e., Trim-Attack, Krum-Attack, Min-Max attack, Min-Sum attack, and their variants) on four different datasets (i.e., MNIST, Fashion-MNIST, CIFAR-10, and KDD-CUP-1999) and compare its performance with three classical robust schemes (i.e., Krum, TrimMean, and Median) and a state-of-the-art defense (i.e., FLTrust). Our results show that KeTS outperforms the existing defenses in every attack setting; beating the best-performing defense by an overall average of >24% (on MNIST), >14% (on Fashion-MNIST), >9% (on CIFAR-10), > 11% (on KDD-CUP-1999). A series of further experiments (varying poisoning approaches, attacker population, etc.) reveal the consistent and superior performance of KeTS under diverse conditions. KeTS is a practical solution as it satisfies all three defense objectives (i.e., fidelity, robustness, and efficiency) without imposing additional overhead on the clients. Finally, we also discuss a simple, yet effective extension to KeTS to handle consistent-untargeted (e.g., sign-flipping) attacks as well as targeted attacks (e.g., label-flipping.

Abstract

Deep neural networks have become invaluable intellectual property in machine learning. To deter model theft, Watermarking has emerged as a prominent defense by embedding hidden "trigger sets" that aid in ownership verification. However, current watermarking
solutions primarily address scenarios where adversaries steal the entire model. In this paper, we reveal a critical gap: partial model extraction, where only a subset of classes is stolen, substantially
degrading the watermark's reliability. We introduce two attacks, Partial Model Extraction and Partial Knowledge Distillation, which reduce watermark accuracy by up to 80% while retaining strong performance on the stolen classes. Through extensive experiments on CIFAR10 and CIFAR100 against two state-of-the-art watermarking schemes, we demonstrate the need for more robust watermarking strategies that resist partial-class theft.

Abstract

Model Merging (MM) has emerged as a promising approach to combine multiple fine-tuned models into a single model that maintains performance across tasks. However, its impact on (transferable) adversarial examples remains unexplored. Specifically, we investigate the affect of MM on the transferability of adversarial examples---a black-box, adversarial attack where adversarial examples generated for surrogate model successfully mislead target model. Through experiments on image classification models, we discover that, similar to recent findings of MM on backdoor attacks, where MM tends to sanitize the backdoor present in individual fine-tuned models, MM does not boost adversarial transferability. Our analysis reveals MM has no affect, and under certain conditions, decreased vulnerability to transferable adversarial examples. Consequently, our finding also support the notion of MM giving a "free lunch'' of adversarial robustness and provides important insights for designing more secure systems that employ MM.

Abstract

Tornado Cash is a decentralized application (dApp) that runs on Ethereum Virtual Machine (EVM) compatible networks to enhance users' privacy in terms of user transaction history over the blockchain. This dApp achieves its goal by enabling users to deposit currencies into designated pools and subsequently withdraw them, severing
the link between depositor and withdrawer addresses. At deposit time, Tornado Cash communicates to users the level of privacy they will benefit from (anonymity set) by depositing currencies into one of its pools. Existing analyses have indicated discrepancies between the claimed anonymity set and the actual level of privacy provided, primarily attributed to users' incorrect utilization of the dApp.
This paper explores the road towards a new way to challenge the dApp's proposed anonymity set by examining wallet fingerprints, a factor not directly related to user behavior within the application. The findings of this research shed light on the potential for creating links between clusters of users in TC according to the new proposed approach and raise a privacy concern within the Ethereum network, resulting in 13203 transactions, over 66948, linkable to the wallet used to initialize them.

Abstract

A Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) is one
of the primary barriers between notorious bots and legitimate human users. However, advancements in
Artificial Intelligence (AI) have enabled malicious bots to circumvent CAPTCHA challenges effectively.
As a result, several types of CAPTCHA have been rendered ineffective.
In this work, we introduce Swiss Cheese CAPTCHA, a novel sensor-based solution designed to be
easily solvable by humans while presenting multiple obstructions for bots (similar to the Swiss Cheese
Model) even when the sensor outputs can be predicted and interfered with. We leverage a range of
human cognitive abilities and Generic Sensor API in modern devices to provide robust protection against
automated attacks by making it more computationally expensive for bots to produce a valid answer within
a stipulated time.
We conducted two user studies to assess our proposal's effectiveness: one involving 116 participants
to assess the likability and improvise the design, and the other, with 107 participants, to investigate the
impact of improvised design changes on cognitive abilities. Our results from these studies show an
average completion time of 4.76 seconds and 6.12 seconds, with a success rate of 90.3% and 83.25%,
respectively. By analyzing the 2141 resultant trajectories from both user studies, we assess the learnability,
error recovery rate, efficiency, and satisfaction of users using the scheme. Finally, we devise an automated
attack against our proposal to analyze its security in the real world; we find the probability of attack
success is low. We also make our dataset available for further research.