As a classical type of machine learning algorithms, tree models have been widely employed in various fields, such as financial analysis and health diagnostics, offering high-accuracy and low-latency prediction services to users. However, tree evaluation also raises significant privacy concerns, particularly with respect to the tree model and the query sample, while the existing private decision tree evaluation schemes are unable to reach a good trade-off between privacy and efficiency in practice. Therefore, in this paper, we propose an efficient and privacy-preserving tree evaluation scheme based on additive homomorphic encryption, namely PACT. Specifically, PACT introduces an innovative algorithm by leveraging the overflow characteristic of two’s complement to support AHE-based parallel comparison, and it utilizes the lightweight homomorphic addition to select tree paths non-interactively. Meanwhile, we carefully design perturbation and shuffle methods to enhance model and sample privacy. The security of PACT is verified based on the ideal-real paradigm. Experimental results on real-world and synthetic datasets demonstrate the lossless accuracy and superior running efficiency of PACT.
Jiaqi Zhao, Hui Zhu, Junpeng Zhang et al.· IEEE Transactions on Informa...· 0 citations
Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools report success rates above 80% on their respective datasets. However, these evaluations are often confined to homogeneous environments, such as one repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this benchmark, we evaluate five tools spanning program analysis, LLM prompting, and LLM agents under aligned settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases.
Jincheng Yang, Yulong Fu, Chengwei Liu et al.· 0 citations
Deploying outsourced graph neural network (GNN) inference services in the cloud is gaining widespread application across various fields, such as fraud detection and social network analysis. Cloud servers utilize outsourced model to analyze the graph data of data owners, enabling data owners to enjoy high-quality GNN inference services. However, this approach leads to privacy concerns regarding GNN models, graph data and inference results. To address the privacy issues, some privacy-preserving GNN inference schemes have been proposed. But the existing schemes are only applicable to graph convolutional network and not to graph attention network (GAT) with stronger expressive power. Therefore, we propose a secure GAT inference scheme (SecGAT) for outsourcing scenarios. First, we represent the Beaver triple-based multiplication process as a two-phase multiplication, which allows us to combine specific algorithms to optimize the communication overhead. Then, we design a graph data encryption method to protect the privacy of outsourced graph data. Finally, we propose a series of customized algorithms for secure GAT inference. Based on the proposed building blocks, we construct a complete GAT inference process. Rigorous security analysis and extensive evaluations demonstrate the effectiveness of our scheme. By comparing the core algorithms, our scheme can improve computational efficiency by more than 20% and reduce communication overhead by 20%−40% compared to existing schemes.
Ruoli Zhao, Hui Zhu, Yandong Zheng et al.· IEEE Transactions on Network...· 0 citations