Large Language Models (LLMs), such as ChatGPT and Bard, have revolutionized natural language understanding and generation. They possess deep language comprehension, human-like text generation capabilities, contextual awareness, and robust problem-solving skills, making them invaluable in various domains (e.g., search engines, customer support, translation). In the meantime, LLMs have also gained traction in the security community, revealing security vulnerabilities and showcasing their potential in security-related tasks. This paper explores the intersection of LLMs with security and privacy. Specifically, we investigate how LLMs positively impact security and privacy, potential risks and threats associated with their use, and inherent vulnerabilities within LLMs. Through a comprehensive literature review, the paper categorizes the papers into "The Good" (beneficial LLM applications), "The Bad" (offensive applications), and "The Ugly" (vulnerabilities of LLMs and their defenses). We have some interesting findings. For example, LLMs have proven to enhance code security (code vulnerability detection) and data privacy (data confidentiality protection), outperforming traditional methods. However, they can also be harnessed for various attacks (particularly user-level attacks) due to their human-like reasoning abilities. We have identified areas that require further research efforts. For example, Research on model and parameter extraction attacks is limited and often theoretical, hindered by LLM parameter scale and confidentiality. Safe instruction tuning, a recent development, requires more exploration. We hope that our work can shed light on the LLMs' potential to both bolster and jeopardize cybersecurity.
BadPromptFL: A Novel Backdoor Threat to Prompt-based Federated Learning in Multimodal Models
School of Information and Communication Engineering, Dalian University of Technology（信息与通信工程学院，大连理工大学）；School of Computer Science and Technology, Anhui University（计算机科学与技术学院，安徽大学）；New Laboratory of Pattern Recognition (NLPR) State Key Laboratory of Multimodal Artificial Intelligence Systems (MAIS) Institute of Automation, Chinese Academy of Sciences (CASIA)（模式识别新实验室（NLPR）多模态人工智能系统国家重点实验室（MAIS）自动化研究所，中国科学院（CASIA））
With Great Power Comes Great Responsibility: Utilizing Privacy Technology for the Greater Bad
随着世界各地的人们越来越意识到他们的隐私在这个数字时代是如何受到损害的，隐私增强技术（PET）领域蓬勃发展。第一个关于隐私增强技术的研讨会是在2000年，当时被称为“安全性和不可观察性设计问题研讨会”。“到2007年，研讨会已经膨胀成一个完整的研讨会。2015年，第一期《隐私增强技术学报》（Proceedings on Privacy Enhancing Technologies）出版。2019年，共出版了4卷《隐私增强技术论文集》，共收录66篇论文。在这些论文中，我们确定了14篇专门描述了新开发或以新方式使用的PET。我们关注了3篇似乎具有广泛用例的论文。然而，其中一些用例包括犯罪活动。虽然大量关注对抗性行动和能力，但许多安全研究并不关注或考虑不良行为者背后的社会科学和动机。我们认为，这是在处理网络犯罪问题时需要考虑的一个关键因素。在本文中，我们将从计算机科学和刑事司法的角度分析一些前沿PET及其潜在风险。我们认为，隐私增强技术的持续发展有助于网络犯罪的全球上升。
FedDICE: A ransomware spread detection in a distributed integrated clinical environment using federated learning and SDN based mitigation
CSIRO Data61（澳大利亚联邦科学与工业研究组织数据61）；The University of Newcastle（纽卡斯尔大学）；University of Zurich（苏黎世大学）；Cyber Security Cooperative Research Centre（网络安全合作研究中心）
Secure and Privacy-Preserving Federated Learning via Co-Utility
UNESCO Chair in Data Privacy（联合国教科文组织数据隐私教席）；CYBERCAT-Center for Cybersecurity Research of Catalonia（CYBERCAT-加泰罗尼亚网络安全研究中心）；Universitat Rovira i Virgili（罗维拉-威尔吉利大学）
