Deep neural networks (DNNs) have become a foundational component of modern computing systems with a wide range of applications, such as computer vision, edge intelligence, etc. For the sake of low latency and data privacy, DNN models are increasingly compiled into executables and deployed on local devices. However, that exposes the models to model theft, enabling adversaries to recover proprietary assets via reverse engineering techniques. While code obfuscation naturally emerges for protecting executables from reverse engineering, existing schemes are primarily designed for traditional programs, focusing on complex control flow structures and integer-based operations. They are fundamentally inappropriate for DNN binaries, which exhibit relatively simple code structures and heavily rely on floating-point computation. In this paper, we propose FLOB, an obfuscation framework that protects floating-point computations in DNN binaries using Mixed Boolean-Arithmetic (MBA) transformations. Our approach lifts floating-point values into a higher-precision binary expansion space and performs MBA transformations at the representation level. The computation is carried out entirely in the lifted space, and the final result is then projected back to the target precision, yielding outputs that are semantically equivalent under the original floating-point format, without introducing additional rounding error. The experimental results show that FLOB outperforms the state-of-the-art obfuscation schemes against existing reverse engineering analyzers and deobfuscators, while preserving computational correctness without introducing additional numerical error, allowing flexible trade-off between protection and performance. Specifically, FLOB reduces the operator recovery rate to 4.51% on average, achieving a 32.82 percentage-point reduction compared to existing methods.
Modern Network Intrusion Detection Systems (NIDS) generate vast volumes of low-level alerts that remain semantically fragmented, requiring labor-intensive manual correlation with high-level adversarial behaviors. Existing automation, namely rule-based systems and machine learning classifiers, has critical limitations: rule-based approaches fail to adapt to novel attack variations, while machine learning methods lack contextual awareness and treat tactic-technique (TT) mapping as syntactic matching rather than reasoning. Although Large Language Models (LLMs) show promise in cybersecurity, preliminary experiments reveal that existing LLM-based methods frequently hallucinate technique-tactic pairs or produce decontextualized mappings due to single-step classification. We introduce RHINO, a framework that decomposes LLM-based attack analysis into three structured phases: (1) behavioral abstraction, translating raw logs into contextualized narratives; (2) partitioned inference over the ATT&CK tactic space, generating candidate techniques by evaluating behavioral evidence against MITRE ATT&CK knowledge; and (3) knowledge-grounded refinement, cross-referencing predictions with official MITRE definitions to reduce hallucinations. We evaluate RHINO on three benchmarks (DAPT2020, CICIDS2017, IoT23) across four backbone models (ChatGPT-4o, Gemini 2.5 Flash, Claude Sonnet 4, and DeepSeek V3). Under a scenario-documented single-label formulation covering 11 distinct techniques, RHINO achieves an average top-1 accuracy of 87.34% under micro-averaging and 63.77% under macro-averaging, surpassing the strongest baseline by 16.78 and 13.60 points respectively. These results show that structured LLM reasoning can effectively translate low-level network observations into high-level adversarial behaviors.
Zhengyi Li, Yakai Wang, Jingwen Leng Shanghai Jiao Tong University, Kang Yang, Yu Yu, Jiaping Gui Shanghai Jiao Tong University, Yu Feng Shanghai Jiaotong University, Ning Liu 等 9 位作者
For Transformer models, cryptographically secure inference ensures that the client learns only the final output, while the server learns nothing about the client’s input. However, securely computing nonlinear layers remains a major efficiency bottleneck due to the substantial communication rounds and data transmission required. To address this issue, prior works reveal intermediate activations to the client, allowing nonlinear operations to be computed in plaintext. Although this approach significantly improves efficiency, exposing activations enables adversaries to extract model weights. To mitigate this risk, existing works employ a shuffling defense that reveals only randomly permuted activations to the client. In this work, we show that the shuffling defense is not as robust as previously claimed. We propose an attack that aligns differently shuffled activations to a common permutation and subsequently exploits them to extract model weights. Experiments on Pythia-70m and GPT-2 demonstrate that the proposed attack can align shuffled activations with mean squared errors ranging from 10^{-9} to 10^{-6}. With a query cost of approximately $1, the adversary can recover model weights with L1-norm differences ranging from 10^{-4} to 10^{-2} compared to the oracle weights.
尚无 AI 解读，展示原文摘要
cs.CL
Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · 2026 · 正式发表