60
55
30
30
30
30
Machine Unlearning as Private Retroactive Algorithms
A cs.CR paper defines private retroactive algorithms, showing machine unlearning is a data-maintenance problem and giving DP constructions for linear statistics, clustering, histograms.
The paper argues that machine unlearning's requirement to emulate retraining from scratch carries no meaningful privacy semantics against adversaries observing sequences of releases, recasting it as a data-maintenance question addressed by retroactive algorithms. It defines private retroactive algorithms, combining retroactivity with differential privacy under continual observation. Constructions achieve privacy and retroactivity at no asymptotic cost over privacy alone for linear statistics, clustering, and histograms, alongside impossibility results.
30
57
45
Low-Rank Masking for Single-Server Matrix Multiplication
Researchers prove rank-r additive masks for outsourced matrix multiplication achieve maximal-correlation secrecy of at most q^-r, with a matching lower bound.
An arXiv paper analyzes statistical privacy for outsourcing matrix multiplication over a finite field to a single server using additive masks of rank at most r. Uniform rank-ball masks and products of independent uniform factors yield maximal-correlation secrecy bounded by q^{-r}, with encoding and decoding costing O(n^2 r) field operations. The authors prove an asymptotically matching lower bound for r=o(n), showing these samplers are optimal among input-independent additive masks even with secret invertible transformations. They also show every such mask requires delta approaching 1 in entry-level (epsilon, delta)-differential privacy for fixed field size.
20
30
30
30
42
30
Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference
Attack breaks permutation-based model confidentiality in hybrid FHE inference, recovering all ResNet-20 linear layers exactly with d+1 queries per layer.
The paper shows output-permutation plus noise fails to protect model confidentiality in hybrid FHE inference: d+1 admissible queries recover an exact permutation-invariant summary of a d-input linear layer, and shuffle-model DP amplification premises cannot hold under correctness-bounded noise. The authors recovered all linear layers of a Safhire-style ResNet-20 end-to-end from TFHE transcripts with zero error, using 5,712 total queries. Exact per-layer recovery was also confirmed on pretrained ImageNet-scale CNNs and ViT-B/16. Leaked layer spectra enable model fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.
45
US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
NSA, CISA and FBI warn Chinese AI firms including DeepSeek and Moonshot systematically extracted billions of tokens from US frontier models since late 2024.
The NSA, CISA, and FBI report that China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from US frontier models such as Claude, GPT-4/GPT-5, Gemini, and Grok 4 since late 2024. The distillation trained DeepSeek's R1 and V3 and Moonshot's Kimi-K2/K3 models, and the agencies mapped the tactics to MITRE ATLAS while noting additional novel techniques like subscription exploitation and request metadata sanitization. They describe the activity as a strategic economic threat to US technological leadership and recommend behavioral detection, differential privacy, and targeted cost-imposing responses.
84
CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok
CISA, NSA and FBI advisory says six Chinese AI firms extracted billions of tokens from Claude, GPT, Gemini and Grok via API proxies since late 2024.
A joint advisory from CISA, NSA and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI harvested billions of tokens across millions of exchanges from Claude, GPT, Gemini and Grok variants since late 2024. Operators allegedly used API proxy 'transfer stations', account pools, bulk premium subscriptions and prompt injection or jailbreak-style requests to force models to reveal chain-of-thought reasoning. DeepSeek's R1 and V3 and Moonshot's Kimi-K2 and Kimi-K3 models reportedly benefited from the extracted data. CISA urged providers to add identity checks, monitor subscription-to-usage ratios, rate limit, and share infrastructure signals with cloud platforms.
72
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
NSA, CISA, and FBI warn DeepSeek, Alibaba, and other Chinese AI firms ran industrial-scale distillation of U.S. frontier models, threatening U.S. AI leadership.
A joint NSA, CISA, and FBI Cybersecurity Advisory (AA26-251A) says China-based firms DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from U.S. frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government knowledge. Campaigns running since at least late 2024 used native APIs, cloud providers, third-party aggregators, gray-market proxy "transfer stations", and shared premium subscriptions to bypass geographic restrictions, evade safeguards, and violate providers' terms of use. The agencies recommend detecting anomalous prompts, accounts, and usage patterns; subtly altering responses to suspected distillers; and cross-organization intelligence sharing. They also call DeepSeek's publicly cited $5.6M training cost misleading because it excludes data acquired through distillation.
76
55
⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit
60
30
30
30
35
I Am No One: Style-Aware Paraphrasing for Text Anonymization
Prompt-driven style-aware paraphrasing with LLMs cuts authorship attribution F1 by 60-70% while preserving content quality.
The paper proposes a style-aware, prompt-driven anonymization approach using pretrained LLMs to build compact stylistic profiles from minimal samples and rewrite text to suppress identifiable style markers while preserving meaning. It addresses stylometric re-identification risks in anonymized text, including ASR transcripts of meetings and call-center calls where leakage persists after acoustic anonymization. Across blog and review datasets, the approach reduces authorship attribution F1 by 60-70%, substantially outperforming both DP-based and non-DP baselines while maintaining readability.
40
60
55
30
60
45
57
55
60
30
55
57
55
30
42