The paper investigates class unlearning for video segmentation, showing that existing leakage tests underestimate privacy risks because they evaluate single frames. By averaging predictions over two‑second clips, attackers can recover forgotten classes across multiple datasets, even when per‑frame outputs appear indistinguishable from a retrain oracle. The authors attribute this leakage to cross‑frame redundancy rather than object trajectory, and propose PACE, an unlearning method that suppresses redundancy via a permutation‑invariant pooled adversarial discriminator and a two‑sided temporal consistency objective, achieving significant reductions in attacker performance while preserving segmentation quality.
arXiv:2506. 20893v5 Announce Type: replace-cross Abstract: In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class.
The paper demonstrates that a targeted adversarial perturbation can reduce a vision‑language model’s training loss to near zero for a fixed target caption, yet the same model, when generating freely, still produces the correct description. This phenomenon, termed the train/inference gap, is traced to a single autoregressive step where the target token’s rank is fixed across all images, and further analysis shows that the language decoder, rather than the visual encoder, determines whether the corrupted signal is amplified or suppressed. The study uses a controlled two‑stage PGD attack on Qwen2.5‑VL‑7B‑Instruct and evaluates the effect on 200 held‑out COCO images, revealing that adversarial robustness in autoregressive VLMs largely depends on the language decoder’s prior. whyItMatters":"The findings suggest that defenses and faithfulness evaluations for deployed vision‑language models should focus on the language decoder rather than the visual encoder, as the former is the key determinant of robustness to adversarial perturbations."
LETHE is a new protection method that defends against unauthorized image‑to‑video generation by disrupting how diffusion models read a reference image. It achieves this by collapsing the spread of reference value vectors and attracting subsequent frames to these collapsed tokens, thereby severely degrading generated videos. Extensive experiments on modern I2V models and two human‑centric benchmarks show that LETHE outperforms existing protection techniques.
The paper introduces a unified evaluation framework for assessing the physical adversarial robustness of Vision‑Language Models (VLMs) deployed at the edge. It defines a conditional attack success rate (cASR) metric that counts only images where the model still localizes objects under a gray occluder, and categorizes failures into omission, substitution, and displacement. Benchmarking shows that compact grounding VLMs can be as vulnerable as traditional object detectors, with omission being the only failure visible to downstream systems, while displacement and substitution pose potentially more dangerous risks, especially under distribution shift.
The paper reports a privacy breach in a two-node split‑LLM training system where the returned gradient reveals which data rows were real, despite the system passing standard privacy checks. By exploiting the fact that decoy rows produce zero gradients, an attacker can identify real rows with 100% accuracy across multiple runs. The authors demonstrate that adding gradient clipping and noise can mitigate the leak, but the system remains vulnerable to several untested attack vectors.
The paper investigates what information must be preserved in replay buffers for class‑incremental learning. By treating cached predictions as temporally heterogeneous supervision, the authors separate classes known at storage time from those learned later, and evaluate the impact of deleting logit matching. Experiments on CIFAR‑100 with DER++ show that a simple task‑level offset can largely correct the cost of removing later‑class matching, while the cost of disrupting class correspondence remains.
arXiv:2607. 12354v1 Announce Type: new Abstract: In this paper, we challenge the prevailing view that information dependency (including rote memorization) drives training data exposure to image reconstruction attacks.
arXiv:2609.17856v1 Announce Type: new Abstract: Heterogeneous cooperative perception (CP) enables connected vehicles with diverse sensor setups to share spatial awareness via compact feature maps, wh...
arXiv:2610.09941v1 Announce Type: new Abstract: Large vision-language models (LVLMs) are increasingly deployed in safety-critical applications, yet they remain vulnerable to backdoor attacks. Defendi...
The paper introduces Median Temporal Ensembling, a training‑free aggregation method for action‑chunked visuomotor policies that replaces the standard exponential weighted mean with a coordinate‑wise median. This approach remains robust against adversarial corruption, maintaining a high recovery rate even as attack strength increases, and performs at least as well as the mean across numerous configurations while improving in many cases. It also handles non‑adversarial failures such as blank camera frames and shows limited impact on clean data, though it cannot counteract uniform shifts applied to all predictions.
arXiv:2409. 01062v4 Announce Type: replace Abstract: Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models.
arXiv:2606. 03808v1 Announce Type: cross Abstract: We propose PURGE, a machine unlearning algorithm built on a simple but an under-exploited observation: continual learning (CL) and machine unlearning (MU) which are fundamentally dual problems.