2026· Proceedings of the 23rd International Conference on Security and Cryptography· 0 citations· 39 references
TL;DR
An insider adversary manipulates the distance function to induce discriminatory clustering outcomes against demographic groups, exposing a gap in current fairness auditing practices and demonstrating the urgent need to expand the scope of the algorithmic audit to include distance-function verification.
Abstract
: Clustering algorithms are increasingly deployed in high-stakes decision-making systems under the assumption that transparent, explainable methods using standard distance metrics are inherently trustworthy. We challenge this assumption by demonstrating a configuration-based attack exploiting ε -semimetric distance functions, which satisfy nearly all properties of a topological metric while allowing arbitrary manipulation of pairwise distances. Building on the mathematical framework of ε -semimetrics introduced in prior work, we make three novel contributions: (1) we formalize a threat model in which an insider adversary manipulates the distance function to induce discriminatory clustering outcomes against demographic groups , exposing a gap in current fairness auditing practices that focus on data integrity and algorithm transparency but overlook configuration integrity; (2) we provide empirical feasibility analysis demonstrating successful attacks on K-means, DBSCAN, and agglomerative clustering with 100% manipulation accuracy for sample sizes up to m = 130, with construction cost O ( m 6 ) , and validate the attack on real census data (UCI Adult Income), demonstrating that Demographic Parity Difference increases from 0.200 to the theoretical maximum of 1.000 under attack; and (3) we propose concrete defenses including cryptographic metric commitment and statistical detection methods. The attack is most feasible for targeted discrimination affecting small groups ( m < 50, under 30 seconds), precisely where aggregate fairness statistics lack power to detect violations. Our findings demonstrate the urgent need to expand the scope of the algorithmic audit to include distance-function verification.
In environments where adversaries engage in active surveillance and covert communication, defenders face the dual challenge of when to deploy steganography and whether it yields measurable operational benefit. We present a game-theoretic model of steganographic operations that captures the strategic interaction between a defender and an adversary through calibrated monetary primitives and nonlinear utility mappings. The model derives mixed-strategy equilibria that determine conditional and unconditional success rates for hiding and detection, and introduces a time-varying adversarial advantage metric that quantifies when an attacker’s incentive exceeds the defender’s effective concealment or detection capability. By linking this advantage to a currency-unit risk measure, we extend the classical risk formulation into a decision-aware, monetised framework. The quantitative evaluation combines nonlinear equilibrium analysis, a Monte Carlo ensemble of 10,000 draws, and empirical calibration on Break Our Steganographic System database (BOSSbase) 1.01 using four spatial-domain adaptive steganographic methods: Wavelet Obtained Weights (WOW), Spatial Universal Wavelet Relative Distortion (S-UNIWARD), High-pass, Low-pass and Low-pass (HILL), and Minimising the Probability of Detection (MiPOD). The payloads are 0.100, 0.200, and 0.400 bits per pixel. Two lightweight convolutional neural-network steganalysis back-ends are used to estimate the defender signal, defined as 1 − TPR@FPR = 0.10. The aggregated trajectories show persistent positive adversarial advantage in most configurations, with mean normalised advantage reaching 0.22 and maximum normalised risk reaching 0.20. Lower-risk cases show average positive advantage of approximately 0.01, while higher-risk regimes reach approximately 0.18 to 0.19. In the monetary setting, the maximum epoch-level risk reaches £210,375, high-risk configurations produce mean risks close to £196,000, and the maximum observed security benefit is £11,250. Detector performance further shows best-epoch area under the curve (AUC) values of at least 0.95 for the more stable detector, while the more volatile detector produces defender-signal values spanning approximately 0.015 to 0.915. These results show that adversarial advantage can be translated into interpretable monetary risk estimates for assessing whether steganographic defences decrease, amplify, or only marginally affect organisational exposure.
Obinna Omego, Farzana Rahman, Onalo Samuel et al.· PeerJ Computer Science· 0 citations
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
We prove that Nakamoto proof-of-work consensus has a budget-determined population structure with three security regimes. We compose three layers: the imported Garay-Kiayias-Leonardos (GKL) sufficiency theorem [3]; new attack constructions, native to the GKL round model, showing that when adversarial hashrate weakly exceeds honest hashrate the private-chain attack violates Persistence with probability one and a censorship attack violates Liveness; and an economic model of $n$ heterogeneous miners under an operational-security threshold that determines the honest/adversarial partition endogenously. The composition yields a safe region where GKL guarantees apply, a margin region where they fail although honest miners retain a hashrate majority, and a majority-loss region where the certainty-style attacks apply. The block-rate side of the GKL condition is derived from difficulty adjustment, not assumed. Extensions cover probabilistic compromise, mining-pool aggregation with both safety-positive and safety-negative effects, a conditional adaptive-corruption upper bound (when adaptive reach contains the budget-determined static compromised set), and post-halving entry-exit dynamics.
C. S. Wright· International Conference on...· 0 citations
ProxyDrift is presented, a framework that identifies and measures drift between production traffic and offline evaluation sets, and constructs and refreshes those evaluation sets accordingly; all without access to raw user data.
Michael Levit, Josh Ledgard, Haoyu Dong et al.· 0 citations
Metric Differential Privacy (mDP) extends classical differential privacy (DP) by replacing Hamming adjacency with application-aware distance metrics, which offers utility-preserving protection for structured and continuous data including locations, trajectories, images, and text embeddings. This Systematization of Knowledge (SoK) paper synthesizes a decade of progress (2013-2025), clarifying mDP's foundations and its connections to central and local DP, and surveying three principal mDP mechanism families: homogeneous distance mechanisms, non-homogeneous distance mechanisms, and optimized perturbation mechanisms. We organize applications across geo-location privacy, text and embeddings, image and voice protection, graphs and network telemetry, and federated/edge settings. We also surface open challenges, including robust composition and adversarial modeling, context-adaptive privacy, high-dimensional scalability, and principled geometry-aware trade-off bounds, and distill practical guidance for selecting metrics, mechanisms, and metrics of utility. The goal is a unified reference and roadmap for deploying scalable, utility-preserving metric privacy in real-world systems.
Xinpeng Xie, Chenyang Yu, Yan Huang et al.· Proceedings on Privacy Enhan...· 0 citations
Jailbreak attacks on large language models are usually evaluated by attacker-centric metrics such as attack success rate (ASR), yet an attack that breaks a model is not necessarily useful for improving its safety. We propose a defender-centric view of jailbreak evaluation, where attacks are evaluated by the downstream safety improvements they enable when used as red-teaming data for safety training. Building on this view, we introduce A-MESS (Minimal Effective Attack-Subset Selection), a setting-agnostic framework for attributing and selecting jailbreak attacks from black-box subset utility observations. A-MESS estimates AttackSHAP, a Shapley-based score that attributes marginal utility to individual attacks and selects compact attack subsets under user-specified budgets via greedy or surrogate-based optimization. Across controlled utility landscapes and real LLM safety settings, we find that ASR rankings are weakly aligned with defender-centric utility, that AttackSHAP can be estimated accurately with limited utility queries, and that directly optimizing subsets yields stronger safety utility than attacker-centric or attribution-only selection. These results suggest evaluating jailbreak attacks as resources for improving safety, not only as tools for breaking models.
Yukai Zhou, Feiyang Lu, Xiaokai Mao et al.· 0 citations