arXiv subjects

Zhetao Li

Publications and source records attributed to Zhetao Li.

13 recordsLinked to original sources

arXiv2026

TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models

Recent commercial image-generation models can generate high-quality images with readable text (e.g., posters, infographics, and manuals), attracting considerable attention. Yet we first show that this same capability also introduces a previously unreported safety vulnerability: these systems may refuse to generate harmful text directly, yet permit the same content when rendered as text within generated images, i.e., safety alignment does not reliably transfer from textual outputs to text embedded in images. In this paper, unlike existing visual jailbreaks against image-generation models, which primarily induce models to generate harmful visual objects or scenes, we introduce the concept of instruction-dense visual jailbreaks, in which image-generation models produce detailed, readable, and actionable harmful instructions within images. Such outputs can amplify harm because the rendered instructions can be readily read and widely spread. To instantiate this threat, we propose TYPO, a black-box framework that exploits this safety gap by automatically generating adversarial TYPOgraphy prompts, which covertly steer image-generation models to express harmful intent as highly legible, typographically structured text. Specifically, TYPO decomposes prompt generation into two channels: a textual channel for reframing the target intent, and a visual channel for specifying its presentation form. We formulate these two channels as a dual-channel textual-visual strategy space and optimize candidate strategy combinations through an adaptive combinatorial search. Extensive experiments across four commercial models (i.e., GPT-Image-2, Nano Banana Pro, Qwen-Image-2, and Seedream 5.0 Lite) show that TYPO substantially outperforms nine representative jailbreak attacks by 50.2% in ASR on average, while incurring an average query cost of only $0.04.

cs.CR↗

arXiv2026

GhostPrompt: Cross-Image Adversarial Prompt for Vision-Language Models

Vision-Language Models (VLMs) are known to be vulnerable to adversarial attacks, where subtle perturbations to images or texts induce erroneous outputs. However, most text-based attacks are adapted from language-model-centric methods, in which the visual input is fixed during optimization, resulting in adversarial prompts that are tied to specific images and thus limiting their attack effectiveness. To this end, we first introduce a new research perspective: cross-image transferability for adversarial prompts. We then propose GhostPrompt, an adversarial prompt that is optimized once and reused to steer VLM outputs toward attacker-specified responses across diverse images. GhostPrompt employs a joint optimization that distills image-invariant adversarial features into the prompt by "worst-case" generation. Specifically, it alternates between constructing hard visual conditions for the current prompt and updating the prompt to remain effective under these conditions. Extensive experiments on prevalent VLMs verify that \ourmethod achieves an improvement of over 30% in attack success rates compared to state-of-the-art (SoTA) baselines, while reducing computation time by ~70%. Our code is avalable at https://github.com/Ye-ze-yu/GhostPrompt.

cs.CR↗

arXiv2026

LHGstore: An In-Memory Learned Graph Storage for Fast Updates and Analytics

Various real-world applications rely on in-memory dynamic graphs that must efficiently handle frequent updates while supporting low-latency analytics on evolving structures. Achieving both objectives remains challenging due to the trade-off between update efficiency and traversal locality, particularly under highly skewed degree distributions. This motivates the design of graph indexing schemes optimized for in-memory graph management on modern multi-core CPUs. We present LHGstore, a degree-aware Learned Hierarchical Graph storage that, for the first time, integrates learned indexing into graph management. LHGstore designs a two-level hierarchy that decouples vertex and edge access and further organizes each vertex's edges using data structures adaptive to its degree. Lightweight arrays are used for low-degree vertices to maximize traversal locality, while learned indexes are applied to high-degree vertices to improve update throughput. Extensive experiments show that LHGstore achieves 5.9-28.2$\times$ higher throughput and significantly faster analytics than SOTA in-memory graph storage systems.

cs.DB↗

arXiv2026

HoGS: Homophily-Oriented Graph Synthesis for Local Differentially Private GNN Training

Graph neural networks (GNNs) have demonstrated remarkable performance in various graph-based machine learning tasks by effectively modeling high-order interactions between nodes. However, training GNNs without protection may leak sensitive personal information in graph data, including links and node features. Local differential privacy (LDP) is an advanced technique for protecting data privacy in decentralized networks. Unfortunately, existing local differentially private GNNs either only preserve link privacy or suffer significant utility loss in the process of preserving link and node feature privacy. In this paper, we propose an effective LDP framework, called HoGS, which trains GNNs with link and feature protection by generating a synthetic graph. Concretely, HoGS first collects the link and feature information of the graph under LDP, and then utilizes the phenomenon of homophily in graph data to reconstruct the graph structure and node features separately, thereby effectively mitigating the negative impact of LDP on the downstream GNN training. We theoretically analyze the privacy guarantee of HoGS and conduct experiments using the generated synthetic graph as input to various state-of-the-art GNN architectures. Experimental results on three real-world datasets show that HoGS significantly outperforms baseline methods in the accuracy of training GNNs.

cs.LG↗

arXiv2025

RoMA: Robust Malware Attribution via Byte-level Adversarial Training with Global Perturbations and Adversarial Consistency Regularization

Attributing APT (Advanced Persistent Threat) malware to their respective groups is crucial for threat intelligence and cybersecurity. However, APT adversaries often conceal their identities, rendering attribution inherently adversarial. Existing machine learning-based attribution models, while effective, remain highly vulnerable to adversarial attacks. For example, the state-of-the-art byte-level model MalConv sees its accuracy drop from over 90% to below 2% under PGD (projected gradient descent) attacks. Existing gradient-based adversarial training techniques for malware detection or image processing were applied to malware attribution in this study, revealing that both robustness and training efficiency require significant improvement. To address this, we propose RoMA, a novel single-step adversarial training approach that integrates global perturbations to generate enhanced adversarial samples and employs adversarial consistency regularization to improve representation quality and resilience. A novel APT malware dataset named AMG18, with diverse samples and realistic class imbalances, is introduced for evaluation. Extensive experiments show that RoMA significantly outperforms seven competing methods in both adversarial robustness (e.g., achieving over 80% robust accuracy-more than twice that of the next-best method under PGD attacks) and training efficiency (e.g., more than twice as fast as the second-best method in terms of accuracy), while maintaining superior standard accuracy in non-adversarial scenarios.

cs.CR↗

arXiv2025

Quark: Implementing Convolutional Neural Networks Entirely on Programmable Data Plane

The rapid development of programmable network devices and the widespread use of machine learning (ML) in networking have facilitated efficient research into intelligent data plane (IDP). Offloading ML to programmable data plane (PDP) enables quick analysis and responses to network traffic dynamics, and efficient management of network links. However, PDP hardware pipeline has significant resource limitations. For instance, Intel Tofino ASIC has only 10Mb SRAM in each stage, and lacks support for multiplication, division and floating-point operations. These constraints significantly hinder the development of IDP. This paper presents \quark, a framework that fully offloads convolutional neural network (CNN) inference onto PDP. \quark employs model pruning to simplify the CNN model, and uses quantization to support floating-point operations. Additionally, \quark divides the CNN into smaller units to improve resource utilization on the PDP. We have implemented a testbed prototype of \quark on both P4 hardware switch (Intel Tofino ASIC) and software switch (i.e., BMv2). Extensive evaluation results demonstrate that \quark achieves 97.3\% accuracy in anomaly detection task while using only 22.7\% of the SRAM resources on the Intel Tofino ASIC switch, completing inference tasks at line rate with an average latency of 42.66$\mu s$.

cs.NI↗

arXiv2024

AnomalyLLM: Few-shot Anomaly Edge Detection for Dynamic Graphs using Large Language Models

Detecting anomaly edges for dynamic graphs aims to identify edges significantly deviating from the normal pattern and can be applied in various domains, such as cybersecurity, financial transactions and AIOps. With the evolving of time, the types of anomaly edges are emerging and the labeled anomaly samples are few for each type. Current methods are either designed to detect randomly inserted edges or require sufficient labeled data for model training, which harms their applicability for real-world applications. In this paper, we study this problem by cooperating with the rich knowledge encoded in large language models(LLMs) and propose a method, namely AnomalyLLM. To align the dynamic graph with LLMs, AnomalyLLM pre-trains a dynamic-aware encoder to generate the representations of edges and reprograms the edges using the prototypes of word embeddings. Along with the encoder, we design an in-context learning framework that integrates the information of a few labeled samples to achieve few-shot anomaly detection. Experiments on four datasets reveal that AnomalyLLM can not only significantly improve the performance of few-shot anomaly detection, but also achieve superior results on new anomalies without any update of model parameters.

cs.LG↗

arXiv2023

Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning

Federated learning (FL) is vulnerable to poisoning attacks, where adversaries corrupt the global aggregation results and cause denial-of-service (DoS). Unlike recent model poisoning attacks that optimize the amplitude of malicious perturbations along certain prescribed directions to cause DoS, we propose a Flexible Model Poisoning Attack (FMPA) that can achieve versatile attack goals. We consider a practical threat scenario where no extra knowledge about the FL system (e.g., aggregation rules or updates on benign devices) is available to adversaries. FMPA exploits the global historical information to construct an estimator that predicts the next round of the global model as a benign reference. It then fine-tunes the reference model to obtain the desired poisoned model with low accuracy and small perturbations. Besides the goal of causing DoS, FMPA can be naturally extended to launch a fine-grained controllable attack, making it possible to precisely reduce the global accuracy. Armed with precise control, malicious FL service providers can gain advantages over their competitors without getting noticed, hence opening a new attack surface in FL other than DoS. Even for the purpose of DoS, experiments show that FMPA significantly decreases the global accuracy, outperforming six state-of-the-art attacks.

cs.LG↗

arXiv2023

Joint Space-Time Sparsity Based Jamming Detection for Mission-Critical mMTC Networks

For mission-critical massive machine-type communications (mMTC) applications, the messages are required to be delivered in real-time. However, due to the weak security protection capabilities of the low-cost and low-complexity machine-type devices, active jamming attack in the uplink access is a serious threat. Uplink access jamming (UAJ) can increase the number of dropped/retransmitted packets and restrict or prevent the normal device access. To tackle this vital and challenging problem, we propose a novel UAJ detection method based on the joint space-time sparsity (JSTS). Our key insight is that the JSTS-based feature will be significantly impacted if UAJ happens, since only a small fraction of the devices are active and the traffic pattern for each device is sporadic in the normal state. Unlike the existing detection methods under batch mode (i.e., all sample observations are collected before making a decision), the JSTS-based detection is performed in a sequential manner by processing the received signals one by one, which can detect UAJ as quickly as possible. Moreover, the proposed JSTS-based method does not rely on the prior knowledge of the attackers, since it only cares the abrupt change in the JSTS-based feature on each frame. Numerical results evaluate and confirm the effectiveness of our method.

cs.CR↗

arXiv2022

Cell-Free Massive MIMO-OFDM for High-Speed Train Communications

Cell-free (CF) massive multiple-input multiple-output (MIMO) systems show great potentials in low-mobility scenarios, due to cell boundary disappearance and strong macro diversity. However, the great Doppler frequency offset (DFO) leads to serious inter-carrier interference in orthogonal frequency division multiplexing (OFDM) technology, which makes it difficult to provide high-quality transmissions for both high-speed train (HST) operation control systems and passengers. In this paper, we focus on the performance of CF massive MIMO-OFDM systems with both fully centralized and local minimum mean square error (MMSE) combining in HST communications. Considering the local maximum ratio (MR) combining, the large-scale fading decoding (LSFD) cooperation and the practical effect of DFO on system performance, exact closed-form expressions for uplink spectral efficiency (SE) expressions are derived. We observe that cooperative MMSE combining achieves better SE performance than uncooperative MR combining. In addition, HST communications with small cell and cellular massive MIMO-OFDM systems are compared in terms of SE. Numerical results reveal that the CF massive MIMO-OFDM system achieves a larger and more uniform SE than the other systems. Finally, the train antenna centric (TA-centric) CF massive MIMO-OFDM system is designed for practical implementation in HST communications, and three power control schemes are adopted to optimize the propagation of TAs for reducing the impact of the DFO.

cs.IT↗

arXiv2021

Decentralized Multi-AGV Task Allocation based on Multi-Agent Reinforcement Learning with Information Potential Field Rewards

Automated Guided Vehicles (AGVs) have been widely used for material handling in flexible shop floors. Each product requires various raw materials to complete the assembly in production process. AGVs are used to realize the automatic handling of raw materials in different locations. Efficient AGVs task allocation strategy can reduce transportation costs and improve distribution efficiency. However, the traditional centralized approaches make high demands on the control center's computing power and real-time capability. In this paper, we present decentralized solutions to achieve flexible and self-organized AGVs task allocation. In particular, we propose two improved multi-agent reinforcement learning algorithms, MADDPG-IPF (Information Potential Field) and BiCNet-IPF, to realize the coordination among AGVs adapting to different scenarios. To address the reward-sparsity issue, we propose a reward shaping strategy based on information potential field, which provides stepwise rewards and implicitly guides the AGVs to different material targets. We conduct experiments under different settings (3 AGVs and 6 AGVs), and the experiment results indicate that, compared with baseline methods, our work obtains up to 47\% task response improvement and 22\% training iterations reduction.

cs.RO↗

arXiv2019

Secrecy and Covert Communications against UAV Surveillance via Multi-Hop Networks

The deployment of unmanned aerial vehicle (UAV) for surveillance and monitoring gives rise to the confidential information leakage challenge in both civilian and military environments. The security and covert communication problems for a pair of terrestrial nodes against UAV surveillance are considered in this paper. To overcome the information leakage and increase the transmission reliability, a multi-hop relaying strategy is deployed. We aim to optimize the throughput by carefully designing the parameters of the multi-hop network, including the coding rates, transmit power, and required number of hops. In the secure transmission scenario, the expressions of the connection probability and secrecy outage probability of an end-to-end path are derived and the closed-form expressions of the optimal transmit power, transmission and secrecy rates under a fixed number of hops are obtained. In the covert communication problem, under the constraints of the detection error rate and aggregate power, the sub-problem of transmit power allocation is a convex problem and can be solved numerically. Simulation shows the impact of network settings on the transmission performance. The trade-off between secrecy/covertness and efficiency of the multi-hop transmission is discussed which leads to the existence of the optimal number of hops.

cs.IT↗

arXiv2017

Greedy Sparse Signal Reconstruction Using Matching Pursuit Based on Hope-tree

The reconstruction of sparse signals requires the solution of an $\ell_0$-norm minimization problem in Compressed Sensing. Previous research has focused on the investigation of a single candidate to identify the support (index of nonzero elements) of a sparse signal. To ensure that the optimal candidate can be obtained in each iteration, we propose here an iterative greedy reconstruction algorithm (GSRA). First, the intersection of the support sets estimated by the Orthogonal Matching Pursuit (OMP) and Subspace Pursuit (SP) is set as the initial support set. Then, a hope-tree is built to expand the set. Finally, a developed decreasing subspace pursuit method is used to rectify the candidate set. Detailed simulation results demonstrate that GSRA is more accurate than other typical methods in recovering Gaussian signals, 0--1 sparse signals, and synthetic signals.

cs.IT↗