Jun Feng

AAAI Conference 2026 Conference Paper

Efficient, Secure, Differentially Private Deep Learning in the Two-Server Model

• Jun Feng
• Hong Sun
• Pengfei Zhang
• Bocheng Ren
• Shunli Zhang

Existing solutions on differentially private deep learning (DPDL) either require the assumption of a trusted data server (centralized DPDL) or suffer from poor utility (local DPDL); and hence their adoptions are hampered in real-world scenarios.We present CRYPTDP, a crypto-assisted differentially private deep learning approach in the two-server model. CRYPTDP employs two non-colluding servers to collaboratively and efficiently train differentially private deep learning over the secret shares of data owners' private data while protecting the confidentiality of the data from untrusted servers. CRYPTDP is the first approach with the best of both local DPDL and centralized DPDL models, which does not resort to trusted server like local DPDL and has the utility like centralized DPDL. In particular, we also make innovations for addressing the major challenges like poor performance and security that beset CRYPTDP: We introduce a new secure computation and differential privacy friendly activation function; we propose a novel garbled-circuits-free most significant bit extraction protocol, and using the protocol we propose an efficient and secure garbled-circuits-free protocol for activation function over secret shares. Exhaustive experiments show that CRYPTDP delivers significantly better performance than the state-of-the-art local DPDL, yields higher accuracy than the state-of-the-art centralized DPDL, and can achieve two orders of magnitude faster runtime than the state-of-the-art approach.

AAAI Conference 2026 Conference Paper

FaceShield: Explainable Face Anti-Spoofing with Multimodal Large Language Models

• Hongyang Wang
• Yichen Shi
• Zhuofu Tao
• Yuhao Gao
• Liepiao Zhang
• Xun Lin
• Jun Feng
• Xiaochen Yuan

Face anti-spoofing (FAS) is crucial for protecting facial recognition systems from presentation attacks. Previous methods approached this task as a classification problem, lacking interpretability and reasoning behind the predicted results. Recently, multimodal large language models (MLLMs) have shown strong capabilities in perception, reasoning, and decision-making in visual tasks. However, there is currently no universal and comprehensive MLLM and dataset specifically designed for FAS task. To address this gap, we propose FaceShield, a MLLM for FAS, along with the corresponding pre-training and supervised fine-tuning (SFT) datasets, FaceShield-pre10K and FaceShield-sft45K. FaceShield is capable of determining the authenticity of faces, identifying types of spoofing attacks, providing reasoning for its judgments, and detecting attack areas. Specifically, we employ spoof-aware vision perception (SAVP) that incorporates both the original image and auxiliary information based on prior knowledge. We then use an prompt-guided vision token masking (PVTM) strategy to random mask vision tokens, thereby improving the model's generalization ability. We conducted extensive experiments on three benchmark datasets, demonstrating that FaceShield significantly outperforms previous deep learning models and general MLLMs on four FAS tasks, i.e., coarse-grained classification, fine-grained classification, reasoning, and attack localization.

EAAI Journal 2026 Journal Article

Semi-supervised tunnel lining water leakage image segmentation via two-stage collaborative mean-teacher

• Peng Geng
• Yimeng Wang
• Xiaofen Wang
• Jun Feng
• Hongbin Xu
• Yuting Zhang

AAAI Conference 2026 Conference Paper

Stabilizing Cross-Modal Bidirectional Attribution: Few-Shot Adversarial Prompt Tuning for Robust Vision-Language Models

• Jun Feng
• Shuhong Wu
• Hong Sun
• Pengfei Zhang
• Bocheng Ren
• Shunli Zhang

Large-scale pre-trained vision-language models (VLMs) like CLIP show exceptional performance and zero-shot generalization. However, their reliability may be severely undermined by a critical vulnerability to subtle adversarial perturbations. Our work reveals a critical cross-modal vulnerability: visual-only perturbations induce substantial, synchronous shifts in decision attribution maps across both image and text. This phenomenon signifies a fundamental disruption of the VLM's internal logic, as it alters both the model's perceptual focus and its decision rationale. To counter this vulnerability, we introduce Cross-modal Bidirectional Attribution guided Few-shot Adversarial Prompt Tuning (CBA-FAPT), a novel method that leverages the model's internal decision rationale as a regularizer for robust learning. Our framework's core mechanism is the alignment of a novel bidirectional attribution map. This map is a unique fusion of two components. It combines forward feature attention to capture the model's perceptual focus. It also incorporates backward decision gradients to act as a proxy for the model's decision rationale, quantifying how each feature influences the final outcome. We enforce consistency on this bidirectional map between clean and adversarial examples. This approach corrects the model's internal logic on two fronts and effectively restores its adversarial robustness. Comprehensive experiments on 11 datasets demonstrate that CBA-FAPT outperforms the state-of-the-art, establishing a superior trade-off between robust and natural accuracy.

EAAI Journal 2025 Journal Article

Cognitive Digital Twins of the natural environment: Framework and application

• Jun Feng
• Hailin Tang
• Siyuan Zhou
• Yang Cai
• Jianxin Zhang

AAAI Conference 2025 Conference Paper

SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning

• Jun Feng
• Yuzhe Lai
• Hong Sun
• Bocheng Ren

Backdoor attacks in federated learning (FL) face challenges such as lower attack success rates and compromised main task accuracy (MA) compared to local training. Existing methods like distributed backdoor attack (DBA) mitigate these issues by modifying malicious clients’ updates and partitioning global triggers to enhance backdoor persistence and stealth. The recent full combination backdoor attack (FCBA) further improves backdoor efficiency with a full combination strategy. However, these methods are mainly applicable in small-scale FL. In large-scale FL, small trigger patterns weaken impact, and scaling them requires controlling exponentially more clients, which poses significant challenges, while simply reverting to DBA may decrease backdoor performance. To overcome these challenges, we propose the self-adaptive distributed backdoor attack (SADBA), which achieves similar performance to FCBA with a lower percentage of malicious clients (PMC). It also adapts more flexibly through an optimized model poisoning strategy and a self-adaptive data poisoning strategy. Experiments demonstrate SADBA outperforms state-of-the-art methods, achieving higher or comparable backdoor performance and MA across various datasets with limited PMC.

YNIMG Journal 2019 Journal Article

Auditory and language contributions to neural encoding of speech features in noisy environments

• Jiajie Zou
• Jun Feng
• Tianyong Xu
• Peiqing Jin
• Cheng Luo
• Jianfeng Zhang
• Xunyi Pan
• Feiyan Chen

AAAI Conference 2018 Conference Paper

Reinforcement Learning for Relation Classification From Noisy Data

• Jun Feng
• Minlie Huang
• Li Zhao
• Yang Yang
• Xiaoyan Zhu

Existing relation classification methods that rely on distant supervision assume that a bag of sentences mentioning an entity pair are all describing a relation for the entity pair. Such methods, performing classification at the bag level, cannot identify the mapping between a relation and a sentence, and largely suffers from the noisy labeling problem. In this paper, we propose a novel model for relation classification at the sentence level from noisy data. The model has two modules: an instance selector and a relation classifier. The instance selector chooses high-quality sentences with reinforcement learning and feeds the selected sentences into the relation classifier, and the relation classifier makes sentencelevel prediction and provides rewards to the instance selector. The two modules are trained jointly to optimize the instance selection and relation classification processes. Experiment results show that our model can deal with the noise of data effectively and obtains better performance for relation classification at the sentence level.

KR Conference 2016 Short Paper

Knowledge Graph Embedding by Flexible Translation

• Jun Feng
• Minlie Huang
• Mingdong Wang
• Mantong Zhou
• Yu Hao
• Xiaoyan Zhu

Knowledge graph embedding refers to projecting entities and relations in knowledge graph into continuous vector spaces. Current state-of-the-art models are translation-based model, which build embeddings by treating relation as translation from head entity to tail entity. However, previous models is too strict to model the complex and diverse entities and relations(e. g. symmetric/transitive/one-to-many/many-to-many relations). To address these issues, we propose a new principle to allow flexible translation between entity and relation vectors. We can design a novel score function to favor flexible translation for each translation-based models without increasing model complexity. To evaluate the proposed principle, we incorporate it into previous method and conduct triple classification on benchmark datasets. Experimental results show that the principle can remarkably improve the performance compared with several state-of-the-art baselines. (a) TransE (b) Flexible Translation Figure 1: Illustration of TransE and our proposed Flexible Translation. There are three triples, which share the same head entity (“Michael Jackson”) and the same relation (“publish song”), while having three different tail entities (“Beat it”, “Billie Jean”, and “Thriller”). (a) TransE can hardly distinguish different tail entities as they all approximated to the sum of head vector and relation vector. (b) Instead of strictly constraining h+r=t, our principle is to enforce that h+r has the same direction with t.

AAAI Conference 2014 Conference Paper

Sequential Click Prediction for Sponsored Search with Recurrent Neural Networks

• Yuyu Zhang
• Hanjun Dai
• Chang Xu
• Jun Feng
• Taifeng Wang
• Jiang Bian
• Bin Wang
• Tie-Yan Liu

Click prediction is one of the fundamental problems in sponsored search. Most of existing studies took advantage of machine learning approaches to predict ad click for each event of ad view independently. However, as observed in the real-world sponsored search system, user’s behaviors on ads yield high dependency on how the user behaved along with the past time, especially in terms of what queries she submitted, what ads she clicked or ignored, and how long she spent on the landing pages of clicked ads, etc. Inspired by these observations, we introduce a novel framework based on Recurrent Neural Networks (RNN). Compared to traditional methods, this framework directly models the dependency on user’s sequential behaviors into the click prediction process through the recurrent structure in RNN. Large scale evaluations on the click-through logs from a commercial search engine demonstrate that our approach can significantly improve the click prediction accuracy, compared to sequence-independent approaches.