Selected work

Representative Papers

TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning

Sep 01, 2024IEEE Transactions on Dependable and Secure Computing

Malicious aggregators in multi-party federated learning pose severe gradient leakage and privacy risks. Method: This paper introduces Threshold Fully Homomorphic Encryption (TFHE) into secure aggregation for the first time, proposing a decentralized privacy-preserving training framework tolerant to a bounded number of malicious aggregators. It eliminates reliance on trusted third parties by integrating secure multi-party computation with formal verification, effectively countering novel disaggregation attacks. Contribution/Results: We provide rigorous theoretical proofs establishing strict differential privacy and collusion resistance. Empirical evaluation demonstrates that the framework maintains state-of-the-art model accuracy while reducing communication overhead by 29–45%, and delivers end-to-end privacy guarantees under diverse strong adversarial models, including active and adaptive adversaries.

3 citationsRead paper

Dynamic Worlds, Dynamic Humans: Generating Virtual Human-Scene Interaction Motion in Dynamic Scenes

Jan 27, 2026

This work addresses the limitation of existing virtual human–scene interaction methods, which typically assume static environments and thus struggle in real-world dynamic settings. We propose Dyn-HSI, the first cognitive architecture for human–scene interaction generation tailored to dynamic scenes, integrating visual perception, memory mechanisms, and action control to enable continuous environmental awareness, experience reuse, and high-quality motion synthesis. Key innovations include dynamic scene-aware navigation, a hierarchical experience memory module, and a multimodal conditional diffusion model. We also introduce Dyn-Scenes, the first benchmark dataset for dynamic human–scene interactions. Experiments demonstrate that our approach significantly outperforms current methods in both static and dynamic scenarios, generating motions that exhibit high fidelity and strong contextual awareness, thereby validating its generalization capability and motion quality.

1 citationsRead paper

When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent

Jan 12, 2026

This work addresses a novel class of social engineering attacks targeting web automation agents, which exploit induced contextual cues to manipulate agent behavior—threats that existing defenses struggle to mitigate. We introduce AgentBait, the first attack framework specifically designed for web-based intelligent agents, and propose SUPERVISOR, a lightweight, plug-and-play runtime protection module that blocks such attacks by verifying the consistency between the web environment and the agent’s intended task. Experimental evaluation demonstrates that AgentBait achieves an average success rate of 67.5% against mainstream agent frameworks, whereas integrating SUPERVISOR reduces this success rate by 78.1% with only a 7.7% runtime overhead, effectively balancing security and usability.

1 citationsRead paper

Offline RL with Smooth OOD Generalization in Convex Hull and its Neighborhood

Jun 10, 2025International Conference on Learning Representations

Offline reinforcement learning suffers from overestimation of Q-values for out-of-distribution (OOD) actions due to distributional shift, while existing constraint-based methods are overly conservative, impairing generalization and policy optimization. To address this, we propose the Convex-Hull Neighborhood (CHN) safe generalization framework. First, we formally define the CHN region to strike a principled balance between OOD exploration and in-distribution reliability. Second, we design the Smooth Bellman Operator (SBO), which—uniquely—establishes theoretical approximability guarantees for Q-values of OOD actions within the CHN. Third, we introduce neighborhood-weighted Q-function smoothing coupled with offline policy co-optimization. Evaluated on the D4RL benchmark, our method significantly outperforms state-of-the-art approaches: it yields more accurate Q-value estimation, superior policy performance, and improved computational efficiency.

1 citationsRead paper

ReflectFact: Self-Reflective Agents for Improving Comprehension and Reasoning in Multi-Hop Fact Verification

Aug 13, 2026

Existing multi-hop fact verification methods often suffer from reasoning deviations or erroneous conclusions due to a lack of global objective awareness and conflicts between parametric knowledge and retrieved evidence. To address these issues, this work proposes ReflectFact, a self-reflective agent framework that introduces a three-stage mechanism—explicit reasoning path planning, evidence drift verification, and reflective reasoning validation—to automatically detect and correct positional and substitution biases within reasoning chains for the first time. By integrating multi-hop question decomposition, evidence-grounded re-answering, step-wise consistency checking, and verification chain aggregation, ReflectFact effectively mitigates the misalignment between subtasks and the overarching verification goal. The method achieves state-of-the-art performance, surpassing the strongest baseline by 3.32% on HOVER and 2.78% on EX-FEVER.

0 citationsRead paper

Recent publications

Latest Papers

ReflectFact: Self-Reflective Agents for Improving Comprehension and Reasoning in Multi-Hop Fact Verification

Aug 13, 2026

Existing multi-hop fact verification methods often suffer from reasoning deviations or erroneous conclusions due to a lack of global objective awareness and conflicts between parametric knowledge and retrieved evidence. To address these issues, this work proposes ReflectFact, a self-reflective agent framework that introduces a three-stage mechanism—explicit reasoning path planning, evidence drift verification, and reflective reasoning validation—to automatically detect and correct positional and substitution biases within reasoning chains for the first time. By integrating multi-hop question decomposition, evidence-grounded re-answering, step-wise consistency checking, and verification chain aggregation, ReflectFact effectively mitigates the misalignment between subtasks and the overarching verification goal. The method achieves state-of-the-art performance, surpassing the strongest baseline by 3.32% on HOVER and 2.78% on EX-FEVER.

0 citationsRead paper

ROLoad-PMP: Securing Sensitive Operations for Kernels and Bare-Metal Firmware

Aug 13, 2026

Existing protection mechanisms struggle to simultaneously achieve broad coverage and high performance, particularly in resource-constrained low-level systems. This work proposes ROLoad-PMP, a lightweight hardware-software co-design that introduces a keyed read-only memory load instruction to enforce strong integrity for sensitive operations such as control-flow transfers. By integrating compile-time operand classification with a runtime secure loading mechanism, the approach synergistically combines a RISC-V instruction extension, memory layout optimization, and Physical Memory Protection (PMP). Evaluated on an FPGA prototype, ROLoad-PMP incurs less than 1.40% hardware overhead and only 0.853% runtime performance degradation while supporting diverse defenses including forward-edge control-flow integrity, demonstrating superior protection strength compared to ARM BTI and Intel CET.

0 citationsRead paper

TideRL: Boosting Agentic RL Goodput with Readiness-Aware Scheduling

Aug 10, 2026

This work addresses the low training throughput, GPU underutilization, and redundant prefill overhead commonly encountered in multi-turn agent reinforcement learning due to environment interactions. The paper proposes the first task-readiness-aware elastic reinforcement learning system, which dynamically coordinates rollout and training resources through Continuous Task Batching (CTB), a Resource-Aware Ref-Actor Pipeline (RA²P), and Elastic Resource Scheduling (ERS). This approach significantly reduces redundant computation and waiting time while preserving algorithmic correctness. Compared to synchronous and asynchronous baselines, it achieves up to 5.6× and over 33% higher training goodput, respectively, improves KV cache hit rate by 1.58×, reduces per-step training time by up to 44.3%, and cuts total waiting time by as much as 77.6%.

0 citationsRead paper

Who Bridges Safety? Identifying and Targeting Cross-Lingual Shared Safety Pathways

Aug 09, 2026

This work addresses the inadequate safety performance of multilingual large language models on low-resource languages, which stems from a limited understanding of cross-lingual safety signal propagation mechanisms. Moving beyond conventional isolated neuron analyses, the study identifies— for the first time—shared safety-functional pathways within the model that span layers and languages, uncovering an intrinsic bridge through which safety capabilities transfer from high-resource to low-resource languages. Building on this insight, the authors propose a targeted alignment method that fine-tunes only a minimal subset of pathway parameters. This approach substantially enhances safety in low-resource languages while preserving the model’s general capabilities, establishing a new paradigm for parameter-efficient safety deployment.

0 citationsRead paper

Algebraic Attack on Convolutional Neural Networks with Max Pooling

Aug 08, 2026

This work addresses the challenge of extracting parameters from convolutional neural networks (CNNs) containing max-pooling layers, which existing black-box attacks fail to handle effectively due to the nonlinearity introduced by pooling that disrupts conventional parameter extraction techniques designed for fully connected networks. The paper presents the first dedicated parameter extraction attack against such CNNs, leveraging algebraic modeling to identify two critical types of boundary points—ReLU-Pooling Critical Points (RPCPs) and Pooling Switch Points (PSPs). By integrating ideas from cryptographic internal differential analysis with pattern-matching techniques, the method efficiently recovers both weights and biases. Empirical validation on architectures like LeNet-5 demonstrates its effectiveness across models trained on MNIST, CIFAR-10, and random data, achieving high extraction accuracy with polynomial query complexity.

0 citationsRead paper