Changchun Yin

Compiler toolchains such as TVM are now a standard substrate for deploying deep neural networks, but the optimized executables also expose structures that attackers can leverage. Existing mitigations are commonly applied as a global composite defense, which is effective yet costly because it disrupts performance-critical regularity everywhere. We present VulnSketch, the first LLM-driven vulnerability analysis system for compiled DNNs, and introduce an evidence-bounded formulation of vulnerability analysis that is both auditable and actionable. VulnSketch extracts a Minimal Evidence Interface (MEI) from TVM TIR, scores each operator location along three attacker-aligned vulnerability faces (Segmentation, Regularity, and Lifting), and routes only ambiguous gray locations to bounded LLM triage that must cite MEI fields and propose a pre-approved, semantics-preserving schedule knob. Every proposal is executed under compiler-side legality guards and accepted only if a single micro-validation confirms the expected one-step movement on the prioritized face. Across five representative attacks, VulnSketch attains strong operator-level overlap at small budgets (top 5% recall 0.71–0.80; top 10% recall 0.84–0.91) and high global ranking quality (AUROC 0.85–0.89; AUPRC 0.51–0.62). Applying micro-validated knobs causally reduces attack success by 33–38% and recovered footprint by 38–40%. Operationally, VulnSketch yields 5.9 seconds amortized per verified note under default gray exposure.

Deep Neural Networks (DNNs) are gradually becoming indispensable in various technological domains. To cater to more deployment backends and increasingly complex model architectures, deep learning compiler-driven efficient compilation modes are becoming essential components of productivity. However, this deployment method exacerbates security risks. Recent studies have shown that attackers can reverse-engineer executable files to regenerate trainable deep learning models, leading to adversarial attacks and other security breaches. Previous research indicates that such attacks pose significant threats, yet progress in implementing cost-effective mitigation strategies remains limited. Existing defense mechanisms primarily focus on Trusted Execution Environments or partial encryption to protect critical model parameters, often at the expense of compiled execution efficiency. To address this gap, we propose a schedule search based operator obfuscation method (SOOM) to defend against model extraction attacks for models compiled and executed on standard CPU and GPU backends, where low latency on device inference is required. SOOM is built on TVM, a deep learning compiler, and constructs a comprehensive obfuscation space for deep learning operators. It leverages a security aware learned cost model based on XGBoost gradient boosted trees to balance security objectives and performance requirements, and ultimately generates obfuscated executable code for various deep learning operators. Extensive experiments covered over 105 operator configurations and more than 30,000 tensor computation test cases. Our method was tested against state-of-the-art model extraction attacks, raising the operator inference failure rate to as high as 89%. We also observe up to approximately 25.4% performance gains in selected cases, while the balanced setting keeps model-level latency overhead within a modest budget.

Deep learning compilers such as TVM lower neural networks through intermediate representations (IRs) into optimized, hardware-specific binaries. While enabling high-performance deployment via optimizations like operator fusion and loop tiling, they leave stable execution signatures exploitable by reverse engineering. Prior attacks often rely on a single modality, symbolic lifting, instruction classification, or side channels, each struggles under at least one realistic condition, such as deep fusion, schedule diversity, or OS noise. We present SOFAN, a side-channel oriented fingerprinting and neutralization framework for TVM-compiled DNNs. On the attack side, TCScaptures timing and cache traces to recover operator boundaries via smoothing, non-maximum suppression (NMS), and dynamic time warping (DTW). A multimodal fusion network (MFN) then integrates these side-channel signals with instruction embeddings to classify deeply fused operators. On the defense side, LASR (Leakage-Aware Schedule Rewriting) selectively perturbs critical leakage via schedule diversification, access equalization, and memory remapping, under a fixed runtime budget. Evaluated across CNNs and fusion schedules, SOFANimproves segmentation and recognition over prior baselines. LASR reduces Top-1 attack accuracy by up to 24 points (16 on average) under 10-20% runtime overhead and minimal memory cost. By aligning both attack and defense with compiler boundaries, SOFANenables practical, budget-aware protection for real-world deployments.

The Transductive Support Vector Machine (TSVM) is an effective semi-supervised learning algorithm vulnerable to adversarial sample attacks. This paper proposes a new adversarial attack method called the Multi-Stage Dual-Perturbation Attack (MSDPA), specifically targeted at TSVMs. The MSDPA has two phases: initial adversarial samples are generated by an arbitrary range attack, and finer attacks are performed on critical features to induce the TSVM to generate false predictions. To improve the TSVM’s defense against MSDPAs, we incorporate adversarial training into the TSVM’s loss function to minimize the loss of both standard and adversarial samples during the training process. The improved TSVM loss function considers the adversarial samples’ effect and enhances the model’s adversarial robustness. Experimental results on several standard datasets show that our proposed adversarial defense-enhanced TSVM (adv-TSVM) performs better in classification accuracy and adversarial robustness than the native TSVM and other semi-supervised baseline algorithms, such as S³VM. This study provides a new solution to improve the defense capability of kernel methods in an adversarial setting.

Within the realm of computer vision, self-supervised learning (SSL) pertains to training pre-trained image encoders utilizing a substantial quantity of unlabeled images. Pre-trained image encoders can serve as feature extractors, facilitating the construction of downstream classifiers for various tasks. However, the use of SSL has led to an increase in security research related to various backdoor attacks. Currently, the trigger patterns used in backdoor attacks on SSL are mostly visible or static (sample-agnostic), making backdoors less covert and significantly affecting the attack performance. In this work, we propose GhostEncoder, the first dynamic invisible backdoor attack on SSL. Unlike existing backdoor attacks on SSL, which use visible or static trigger patterns, GhostEncoder utilizes image steganography techniques to encode hidden information into benign images and generate backdoor samples. We then fine-tune the pre-trained image encoder on a manipulation dataset to inject the backdoor, enabling downstream classifiers built upon the backdoored encoder to inherit the backdoor behavior for target downstream tasks. We evaluate GhostEncoder on three downstream tasks and results demonstrate that GhostEncoder provides practical stealthiness on images and deceives the victim model with a high attack success rate without compromising its utility. Furthermore, GhostEncoder withstands state-of-the-art defenses, including STRIP, STRIP-Cl, and SSL-Cleanse.

The number of money laundering crimes for Ethereum and the amount involved have grown exponentially in recent years. However, previous studies related to anomaly detection for Ethereum usually consider multiple types of financial crimes as a whole, ignoring the apparent differences between money laundering and other malicious activities and lacking a more granular detection targeting money laundering. In this paper, for the first time, we propose an improved graph embedding algorithm specifically for money laundering detection called GTN2vec. By mining Ethereum transaction records, the algorithm comprehensively considers the behavioral patterns of money launderers and structural information of transaction networks and can automatically extract features of money laundering addresses. Specifically, we fuse the gas price and timestamp from the transaction records into a new weight and set appropriate return and exploration parameters to modulate the sampling tendency of random walk to characterize the money laundering nodes. We construct the dataset using real Ethereum data and evaluate the effectiveness of GTN2vec on the dataset by various classifiers such as random forest. The experimental results show that GTN2vec can accurately and effectively extract money laundering account features and significantly outperform other advanced graph embedding methods.