The paper introduces REMARK, a watermark‑based fingerprint framework designed to verify ownership of Graph Neural Networks (GNNs). REMARK generates in‑distribution watermark graphs that maximize output differences between GNN models, thereby reducing performance loss from out‑of‑distribution watermarks. It then extracts robust fingerprints from these output differences, eliminating the need for surrogate models trained on watermark data or reliance on specific output levels, and achieves state‑of‑the‑art verification accuracy across real‑world datasets and GNN architectures.
By Han Zhang, Yan Wang, Guanfeng Liu, Pengfei Ding, Huaxiong Wang, Kwok-Yan Lam
arXiv:2606. 01437v1 Announce Type: cross Abstract: Deep Neural Networks (DNNs) are highly susceptible to adversarial perturbations, leading to extensive research on robustness for safety-critical applications.
By Daniel Sadig, Mohammadreza Maleki, Hamed Karimi, Reza Samavi
The paper introduces Imperfect Restoration Poisoning (IRP), a new data poisoning technique that maintains high image quality while effectively disrupting both supervised and self‑supervised learning models. It builds on a theoretical critique of the existing Convolution-based Unlearnable Dataset (CUDA) method, revealing CUDA’s sub‑optimal gradients and class‑bias strategy. Extensive experiments demonstrate IRP’s superiority over eight baseline attacks and its resilience against five defense methods.
By Yi Huang, Jeremy Styborski, Mingzhi Lyu, Fan Wang, Adams Kong
arXiv:2606. 31653v1 Announce Type: cross Abstract: Certified training aims to produce models whose predictions can be formally verified against adversarial perturbations, typically by optimising upper bounds on the worst-case loss over an allowed perturbation set.
By Matteo Melis, Jesus Martinez Del Rincon, Vishal Sharma
arXiv:2606. 08467v1 Announce Type: cross Abstract: While confidence calibration is essential for trustworthy decision-making in safety-critical applications, the robustness of calibrated GNNs to adversarial structural perturbations remains largely unexplored.
By Cuong Dang, Jiahao Zhang, Hieu Ta Quang, Dung Le, Lu Cheng, Suhang Wang
arXiv:2504. 14798v2 Announce Type: replace Abstract: Machine Unlearning (MUL) has emerged as a key mechanism for privacy protection and content regulation, yet current techniques often fail to guarantee the complete removal of sensitive information.
By Hao Xuan, Xingyu Li
arXiv:2410. 01574v4 Announce Type: replace-cross Abstract: The rapid advancement of Generative Artificial Intelligence (GenAI) capabilities is accompanied by a concerning rise in its misuse.
By Sina Mavali, Jonas Ricker, David Pape, Asja Fischer, Lea Sch\"onherr
arXiv:2608. 12100v1 Announce Type: cross Abstract: In high-stakes applications, reliable confidence estimates are as important as the predictions themselves.
By Coby Penso
arXiv:2607. 04145v1 Announce Type: new Abstract: Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the 'piecewise linearity' of deep learning based models.
By Naman Goyal, Milan Chaudhari
arXiv:2607. 22035v1 Announce Type: new Abstract: Currently, most foundation models can reproduce or strongly depend on copyrighted training content, but output similarity alone is insufficient for infringement detection, because similar outputs may also arise from public-domain concepts, common stylistic conventions, or ordinary statistical generalization.
By Xiafeng Man
arXiv:2606. 28416v1 Announce Type: cross Abstract: Deep neural networks (DNNs) have shown outstanding performance in visual recognition tasks within vision sensor networks; however, they are still vulnerable to adversarial manipulations and imperceptible perturbations that can lead to erroneous predictions.
By Maher Boughdiri, Mounira Msahli, Albert Bifet
PANDA is a scalable system that uses zero‑knowledge proofs to certify the robustness and fairness of neural networks without revealing their private parameters. Built on the CROWN robustness framework, PANDA introduces a novel algorithm for proving linear relaxation bounds on non‑linear activation layers, producing lightweight proofs. The system can generate proofs for networks with over 2.9 million parameters in just five minutes and verify them in ten seconds, scaling polynomially with network size and enabling verification of models four orders of magnitude larger than prior ZKP‑based approaches.
By Youwei Zhong, Ben Merbaum, Timos Antonopoulos, Ning Luo, Charalampos Papamanthou, Katerina Sotiraki, Ruzica Piskac