2026· Proceedings of the 23rd International Conference on Security and Cryptography· 0 citations· 39 references
TL;DR
An insider adversary manipulates the distance function to induce discriminatory clustering outcomes against demographic groups, exposing a gap in current fairness auditing practices and demonstrating the urgent need to expand the scope of the algorithmic audit to include distance-function verification.
Abstract
: Clustering algorithms are increasingly deployed in high-stakes decision-making systems under the assumption that transparent, explainable methods using standard distance metrics are inherently trustworthy. We challenge this assumption by demonstrating a configuration-based attack exploiting ε -semimetric distance functions, which satisfy nearly all properties of a topological metric while allowing arbitrary manipulation of pairwise distances. Building on the mathematical framework of ε -semimetrics introduced in prior work, we make three novel contributions: (1) we formalize a threat model in which an insider adversary manipulates the distance function to induce discriminatory clustering outcomes against demographic groups , exposing a gap in current fairness auditing practices that focus on data integrity and algorithm transparency but overlook configuration integrity; (2) we provide empirical feasibility analysis demonstrating successful attacks on K-means, DBSCAN, and agglomerative clustering with 100% manipulation accuracy for sample sizes up to m = 130, with construction cost O ( m 6 ) , and validate the attack on real census data (UCI Adult Income), demonstrating that Demographic Parity Difference increases from 0.200 to the theoretical maximum of 1.000 under attack; and (3) we propose concrete defenses including cryptographic metric commitment and statistical detection methods. The attack is most feasible for targeted discrimination affecting small groups ( m < 50, under 30 seconds), precisely where aggregate fairness statistics lack power to detect violations. Our findings demonstrate the urgent need to expand the scope of the algorithmic audit to include distance-function verification.
A game-theoretic model of steganographic operations that captures the strategic interaction between a defender and an adversary through calibrated monetary primitives and nonlinear utility mappings is presented, and adversarial advantage can be translated into interpretable monetary risk estimates for assessing whether steganographic defences decrease, amplify, or only marginally affect organisational exposure.
Obinna Omego, Farzana Rahman, Onalo Samuel et al.· PeerJ Computer Science· 0 citations
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
We prove that Nakamoto proof-of-work consensus has a budget-determined population structure with three security regimes. We compose three layers: the imported Garay-Kiayias-Leonardos (GKL) sufficiency theorem [3]; new attack constructions, native to the GKL round model, showing that when adversarial hashrate weakly exceeds honest hashrate the private-chain attack violates Persistence with probability one and a censorship attack violates Liveness; and an economic model of $n$ heterogeneous miners under an operational-security threshold that determines the honest/adversarial partition endogenously. The composition yields a safe region where GKL guarantees apply, a margin region where they fail although honest miners retain a hashrate majority, and a majority-loss region where the certainty-style attacks apply. The block-rate side of the GKL condition is derived from difficulty adjustment, not assumed. Extensions cover probabilistic compromise, mining-pool aggregation with both safety-positive and safety-negative effects, a conditional adaptive-corruption upper bound (when adaptive reach contains the budget-determined static compromised set), and post-halving entry-exit dynamics.
C. S. Wright· International Conference on...· 0 citations
ProxyDrift is presented, a framework that identifies and measures drift between production traffic and offline evaluation sets, and constructs and refreshes those evaluation sets accordingly; all without access to raw user data.
Michael Levit, Josh Ledgard, Haoyu Dong et al.· 0 citations
Metric Differential Privacy (mDP) extends classical differential privacy (DP) by replacing Hamming adjacency with application-aware distance metrics, which offers utility-preserving protection for structured and continuous data including locations, trajectories, images, and text embeddings. This Systematization of Knowledge (SoK) paper synthesizes a decade of progress (2013-2025), clarifying mDP's foundations and its connections to central and local DP, and surveying three principal mDP mechanism families: homogeneous distance mechanisms, non-homogeneous distance mechanisms, and optimized perturbation mechanisms. We organize applications across geo-location privacy, text and embeddings, image and voice protection, graphs and network telemetry, and federated/edge settings. We also surface open challenges, including robust composition and adversarial modeling, context-adaptive privacy, high-dimensional scalability, and principled geometry-aware trade-off bounds, and distill practical guidance for selecting metrics, mechanisms, and metrics of utility. The goal is a unified reference and roadmap for deploying scalable, utility-preserving metric privacy in real-world systems.
Xinpeng Xie, Chenyang Yu, Yan Huang et al.· Proceedings on Privacy Enhan...· 0 citations
A defender-centric view of jailbreak evaluation is proposed, where attacks are evaluated by the downstream safety improvements they enable when used as red-teaming data for safety training, and A-MESS (Minimal Effective Attack-Subset Selection), a setting-agnostic framework for attributing and selecting jailbreak attacks from black-box subset utility observations is introduced.
Yukai Zhou, Feiyang Lu, Xiaokai Mao et al.· 0 citations