In briefClimbing the Hill: Curriculum RL Red-Teaming for Prompt Injection Against Frontier Models
SummaryThis paper studies prompt injection, a major security risk for LLMs and LLM-based agents, and proposes a curriculum reinforcement learning method for red-teaming. It addresses the cold-start problem, where an attacker model receives no learning signal because every attack fails against frontier models. The attacker is trained against progressively more robust targets, with each stage partially succeeding to provide learning signals. On AgentDyn, the reported attack success rates (ASR@10) are 93.8% against GPT-5.6-Luna and 45.0% against GPT-5.6-Terra, while RL-Hammer and PISmith achieve 0%.
In briefThe Cost of Peeking: Anytime-Valid Leakage Detection on ML-KEM Traces
SummarySide-channel evaluators often check leakage tests during data collection and decide whether to continue or stop based on the results. This paper studies anytime-valid leakage detection using betting-based tests, which keep the false-alarm probability controlled at all times under an explicit conditional symmetry null. On an open ML-KEM electromagnetic dataset, the method needed about 1.68 to 2.38 times as many traces as a fixed-horizon randomization test to detect leakage in synthetic and degraded recordings. On undegraded recordings, the monitored procedure stopped early, with median stopping points of 62 to 316 traces.
In briefSaplingGuard: A Profile-Aware Multi-Agent Safety Guardrail for Adolescent-LLM Chats
SummaryThis paper introduces SaplingGuard, a plug-and-play safety guardrail that uses user profiles and dialogue context to detect implicit developmental risks when adolescents interact with LLMs, without modifying the downstream models. It uses three agents for profile construction, context-aware risk assessment, and intent-preserving prompt optimization. On SaplingBench, a set of 276 three-turn dialogues across seven developmental risk categories, the authors report that profile-aware retrieval raised the Major Hit rate and that the full intervention lowered the average harmful response rate.
In briefInformation Blackhole: a study of backdoor attacks on 3D point cloud autoencoders
SummaryPoint cloud autoencoders are core tools for representing 3D scenes, yet backdoor attacks on them remain little studied. The paper argues that the generative latent space mixes benign and malicious data, so reconstructions can collapse toward the source data. The authors propose the Information Blackhole principle and Adaptive Gaussian Matching (AGM), which regularizes poisoned latent distributions to improve attack controllability. Experiments on ModelNet and ShapeNetPart are reported.
In briefWhere the Numbers Come From: Auditing Provenance-Based Intrusion Detection Evaluation
SummaryThe paper audits nine released provenance-based intrusion detector implementations and runs four of them with their own code. It identifies three measurement effects: ThreaTrace reports 0.938 precision with neighbourhood credit, though only 7 of its 994 alarms carry its own attack label; removing test-label checkpoint selection lowers attack detection precision by 0.16 to 0.33; and a buffer-reuse defect gives a linear encoder unintended degree-dependent inputs.
In briefLower bounds on signature length for hash-based schemes in the random oracle model
SummaryThe paper asks whether the large signature size of hash-based post-quantum signatures is unavoidable. Within the pure random oracle model, it proves lower bounds for schemes with non-adaptive verifiers that satisfy a property called salted soundness. For one-time signatures, the combined public key and signature length must be Ω(λ²/log λ), and for many-time signatures the signature length alone must meet this bound.
In briefWhat It Means to Forget a Person: Individual-Level Unlearning in Vision-Language Models
SummaryThis paper introduces IDUnlearn-Bench, the first benchmark for individual-level multimodal unlearning in vision-language models (VLMs). It represents each person as connected multimodal evidence and evaluates four task families: attribute access, identity access, identity binding, and identity reconstruction. Experiments show that attribute-centric forgetting often leaves substantial identity-level knowledge intact, and that reducing one risk can amplify another.
In briefComplete classification of whole-output linear structures in FEILIAN-type components
SummaryThe paper determines all input differences that give constant whole-output XOR derivatives for a four-word ARX structure containing a FEILIAN SubColumn. For any word width and XOR-linear internal maps, the linear-structure space contains a universal two-dimensional MSB family and has dimension at most five, with this bound attained. For the 64-bit FEILIAN component, the complete space equals this universal family. The results concern component structure and constancy at successive boundaries, and do not classify all endpoint structures of the iterated permutation or establish an attack on the hash.
In briefPractical null-branch witness attacks on AIMer v2.0 in-the-head signatures
SummaryThis paper presents a classical, public-key-only forgery attack on the AIM2-based AIMer v2.0 signature scheme, which was selected in Korea's KpqC competition. For every honestly generated public key, the authors claim signatures on arbitrary messages can be forged without signing queries. The attack exploits zero factors that leave intermediate values unconstrained, completing them into witnesses that satisfy the full relation. The paper also argues that a satisfying witness need not decode to a one-way function preimage, revealing a gap in AIMer's security reduction.
In briefHESP: A controller that separates what to probe from when to stop in local LLM alert triage
SummarySecurity operations centers receive more alerts than analysts can handle, and organizations that cannot send telemetry to hosted models must automate triage with small open-weight LLMs on their own hardware. The paper presents HESP, a controller that keeps the investigation procedure outside the model, tracking competing explanations, choosing read-only probes by expected information gain per cost, accepting only evidence-backed verdicts, and ending investigations itself. Across five open-weight models (7B to 72B) and 7,272 audited episodes in a controlled triage environment, HESP substantially raises verified completion, showing that choosing what to probe and deciding when to stop are separable failures.
In briefEnhanced parallel attacks on EC-HMQV-C and ECMQV protocols
SummaryThis paper extends a 2025 parallel impersonation attack by Sarr on ECMQV and EC-HMQV-C to a multi-party setting with initiators and responders. It presents three attacks with estimated parallel running times and per-processor memory costs. For a 128-bit EC-HMQV-C instance on an idealized massively parallel architecture, the improved attack is said to correspond to 78 bits of security in parallel time.
In briefBypassing Expression Sandboxes in Orchestration Platforms: Flaws in Enumerate-and-Block Security
SummaryThis paper argues that enumerate-and-block expression sandboxes in orchestration platforms are fundamentally unfixable. Using n8n's expression sandbox, the authors demonstrate three escalating bypasses that produced three CVEs. They also describe a trust laundering pattern and how AI-assisted enumeration speeds up discovery of coverage gaps, and they offer a coverage analysis method, an open-source tool, and an allowlist-based mitigation.
In briefTesting whether fast security-check models can safely automate agent decisions
SummaryThe paper evaluates System One models (Jev, Laya, Decider, Bespoke Nimble) used to screen agent inputs, comparing them with specialized classifiers and language-model judges on prompt-injection detection, interaction-risk judgment, and harmful-request screening. It examines accuracy, calibration, and how many inputs can be handled automatically under miss limits. It finds that high overall accuracy can hide confident mistakes within specific attack groups, that strict miss limits allow few inputs to be automated, and that a language-model judge can catch some missed unsafe inputs while also repeating errors and flagging benign inputs.
In briefClosing the Gap: Rigorously Proving and Strengthening RPKI Security
SummaryThis paper presents the first rigorous security analysis of the Resource Public Key Infrastructure (RPKI), an IETF standard that protects inter-domain routing against prefix and subprefix hijacks. Using modular security specifications, it analyzes RPKI's interactions with BGP and IP and identifies sufficient conditions under which RPKI provably meets its goals. The authors find that existing deployments do not always satisfy these conditions, for example due to circular dependencies, and propose standard-compliant improvements.
Shay Cohen, Nicholas Scaglione, Yossi Gilad et al.
In briefSecurity Analysis of 84 Candidate Public-Key Schemes in a Chinese Crypto Competition
SummaryThis paper reviews the 84 public-key candidates submitted to the ICCS NGCC round-1 public evaluation, focusing on design flaws that local code fixes cannot resolve. It identifies eight such weaknesses, similar to known pitfalls from NIST post-quantum standardization, including sub-ring projections that reduce IND-CPA security, public data that exposes supposedly secret values, static key reuse without a chosen-ciphertext transform, and rejection sampling that leaks an equivalent signing key. The authors state that all findings were obtained with AI assistance and provide a link to their artifacts.
In briefWhy API secrets should stay out of LLM tokens: threat analysis and vault-mediated execution for AI agents
SummaryThis paper examines how API credentials can leak when tool-using LLM agents handle them, such as through prompts, logs, or memory. It proposes a vault-mediated design in which the model picks a connector identifier while a trusted boundary supplies authentication. In two controlled black-box experiments on the Corvic Security Vault implementation, all 16 probes met their expected outcomes, with the credential absent from the locations tested. The authors also report a failed connector configuration and state that vault mediation is necessary but not sufficient.
