In briefZero-knowledge proofs for quantum networks, a verification method that reveals no extra information
SummaryThis paper develops a framework for zero-knowledge verification based on the indistinguishability of quantum states under operational constraints. It shows that, due to limits on local operations, a verifier cannot extract information about the underlying state yet can still check its correctness. The authors build explicit protocols for multiparty quantum networks that achieve information-theoretic security, meaning collaborating parties learn nothing beyond the statement's validity.
In briefSame Text, Different Authority: How Reserved Tokens Make Chat-Template Prompt Injection Stronger
SummaryThis paper studies prompt injection against LLM agents, finding that forged chat-template markers such as <|im_start|> are far more effective when fed to the model as reserved control tokens than as ordinary subwords. Encoding the same text as subwords lowered attack success on the InjecAgent benchmark by 39 to 66 percentage points on three of four open-weight families. The standard tokenizer mitigation covers only tokens a configuration declares special, so tool-protocol tokens remain unprotected and the gap persists on that channel.
WhyShows reserved control tokens carry injection authority beyond text, quantified across several models, InjecAgent and AgentDojo with ablations, with clear defensive implications.
In briefSustained Participation as a Security Resource: BPC
SummaryThis paper introduces the Bounded Participation Channel (BPC), a formal primitive that repeatedly verifies each identity's participation window by window using fresh, identity-bound challenges under strict deadlines. It proves a cost theorem: sustaining s identities over T windows requires at least sT/τ_h participation channel-windows. Tested AI systems reached 97–100% accuracy on perceptual tasks, yet their throughput remained bounded under the tested conditions.
In briefContinuous assurance for AI security auditors gating software releases
SummaryThis paper addresses LLM-based repository auditors used as security controls in CI pipelines, whose findings decide whether code changes merge. It proposes the Policy-Evidence-Execution Separation Pattern, implemented as the TAIP Assurance Engine and operated as Continuous Control Posture Assurance, which binds admitted evidence to a versioned Posture Tree. The approach was evaluated with unmodified RepoAudit on a fixed Python null pointer dereference benchmark, using 80 executions across two OpenAI model configurations. On a single host, full policy-triggered recomputation across 1,000 independent assurance contexts took at most 1.62 s, below the predeclared 5 s budget.
In briefBuilding Data Diodes from Commodity Hardware and Open Source Software
SummaryData diodes are one-way network devices used to defend against sophisticated cyberattacks, mostly deployed in nuclear plants and government agencies. The paper shows that a data diode's hardware can be assembled from commodity fiber-optic equipment, and focuses on software needed to minimize packet loss, since the receiver cannot request retransmission. The authors found most loss came from slow receiver processing and often occurs in clusters, and identified reliable configurations for UDPcast and lidi among three tested open source programs. The findings were incorporated into pydiode, a cross-platform program for reliable one-way data transfers.
In briefGeneric-group bounds for multi-instance problems, focusing on Inverse Diffie-Hellman
SummaryThis paper studies how hard multi-instance problems over prime-order groups are in the generic group model, where an adversary must solve at least k of n independent instances. It shows that multi-instance CDH and SDH are as hard as solving k independent discrete logarithms, while multi-instance IDH and LKDH can be significantly easier than multi-instance CDH in certain parameter regimes. All these problems offer 1/2(log(p)+log(k)) bits of security. The lower bounds extend Yun's hyperplane query model and are derived using algebraic geometry techniques.
WhyShows multi-instance IDH can be much easier than CDH in generic groups, extending Yun's hyperplane query model with rigorous algebraic-geometry proofs, a notable advance.
In briefPoster: Towards ProofWeave, a privacy-minimised, integrity-anchored evidence plane for continuous agentic AI assurance
SummaryThe paper introduces ProofWeave, a record-time chain-of-evidence concept for agentic AI systems. At each policy-relevant action boundary it produces a privacy-minimised, integrity-anchored evidence transaction binding the agent's intent, the control response, and a policy-at-time snapshot, committed to an append-only ledger. In a scenario where an agent tries to send a secret to an unapproved external sink, it reduces candidate bindings per verdict, validation operations, and evidence storage compared with a logs-only correlation baseline.
In briefTANGO: Watermarking Text From Masked Diffusion Models Using Token Pairs
SummaryThis paper presents TANGO, a watermarking method for masked-diffusion language models that generate text by filling masked positions in parallel. Each new token is tied to a nearby already-unmasked token, with a secret key assigning vocabulary tokens to color classes and biasing the new token toward a color set by the key and that neighbor. Detection requires only the text and the key and does not assume any unmasking order. On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge a fixed green list fail against it.
Kasra Arabi, Nir Weinberger, Micah Goldblum et al.
In briefOT-PCA: A New Side-Channel Key-Recovery Attack on HQC Using Offline Templates and Plaintext-Checking Oracles
SummaryThis paper presents OT-PCA, a side-channel attack on the HQC post-quantum cryptosystem that uses a plaintext-checking oracle. It builds offline templates by calling the public HQC decoder and optimizes them with genetic-style algorithms. Simulations show fewer oracle calls than prior methods, including a 2.4-fold reduction for hqc-128, and robustness when oracle accuracy drops to 95%. A power analysis evaluation on an ARM Cortex-M4 microcontroller validates the approach in practice.
In briefTracking Security Debt Across LLM Coding Agent Trajectories
SummaryThis paper studies how security findings change over the many intermediate code states an LLM coding agent produces, arguing that evaluating only the final output misses this evolution. The authors propose the Security Debt Line Integral (SDLI), which accumulates static-analysis risk whenever an agent reaches a new best test pass ratio. Using four static application security testing tools on SWE-bench, ProgramBench, and MirrorCode runs, they report scanner-based findings rather than validated vulnerability rates.
Prateek Kumar Rajput, Abdoul Kader Kabore, Yewei Song et al.
In briefBatch decryption under new standard assumptions
SummaryThis paper studies batch decryption, where an authority releases a short key allowing public decryption of a chosen batch of ciphertexts, motivated by encrypted mempools. It gives two constructions with different authorization semantics and assumptions. The first is an epochless RSA-group scheme based on Fiat's Batch RSA, with a single-group-element hint, proven adaptively secure under the strong RSA assumption in the random-oracle model. The second is a generic epoch-based identity-based encryption construction, instantiated from the computational Diffie-Hellman assumption.
WhyGives a compact RSA-based batch decryption scheme with adaptive security under strong RSA, plus a generic IBE-based construction from CDH.
Nico Döttling, Bernardo Magri, Benjamin Marsh et al.
In briefCorrect Facts, Wrong Rule: Poisoning RAG Through Misapplied Scope
SummaryThis paper studies retrieval-augmented generation systems that apply a rule outside the scope where it is valid, so correct facts support a wrong answer. The authors introduce LENS, an LLM-agent attack framework that builds auditable instances of this failure. An applicability audit cut target error from 70.8% to 16.4%, compared with 31.2% for task-alignment checking.
WhyIdentifies a new rule-scope misapplication failure in RAG, validated across benchmarks, generators, and an applicability audit with clear impact.
In briefAdaptively UC-secure oblivious transfer built from group actions
SummaryThis paper presents the first adaptively UC-secure oblivious transfer protocol based on group actions, assuming weakly pseudorandom effective group actions such as CSIDH. The receiver learns exactly one of the sender's two messages without revealing its choice. The authors follow the BC15 framework and address the lack of SPHF-friendly IND-CCA encryption from group actions by building a verifiable chameleon hash and a publicly verifiable scheme in the random oracle model.
Olivier Blazy, Céline Chevalier, Saqib Kakvi et al.
In briefWhen Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
SummaryThe paper shows that agents form tool calls from model-visible interfaces, but hosts select the implementation later, so standard dispatch ignores the link between descriptor and handler. An unchanged, schema-valid call can therefore carry different security effects during rollout, reconnection, or delayed approval, which the authors call schema-epoch drift. They propose formation-consistent dispatch (FCD), which ties implementation analysis to execution authority and verifies each call's effects against its security contract. Across 32 official releases, 29 needed no release-specific change and three were escalated.
Geonwoo Kim (1), Brent ByungHoon Kang (1) ((1) Korea Advanced Institute of Science, Technology (KAIST))
In briefEfficient TCitH-Based Alternatives to SLH-DSA: A Cross-Layer ASIC Design of Mirath
SummaryNIST has standardized several post-quantum signature schemes and is evaluating non-lattice alternatives to SLH-DSA. This paper presents the first ASIC implementation of Mirath, a TCitH-based signature scheme, in a RISC-V system using a cross-layer approach spanning algorithm and hardware. Implemented in 22nm FD-SOI technology, the design achieves 17.8x lower signing latency and 58% less total cell area than an SLH-DSA ASIC in the same technology node.
Hiandra Tomasi, Maximilian Sch\"offel, Johannes Feldmann et al.
In briefDecryption failures in NGCC lattice KEMs under correlated blocks and omitted noise
SummaryThis paper recomputes decryption failure probabilities for several lattice KEMs submitted to China's NGCC post-quantum competition. It examines three mechanisms: correlated decoding blocks, compression noise omitted from Cheetah's specification, and bounded noise in two-dimensional codes used by Rudraksh2 and Scabbard. The authors report that several estimated failure costs fall below nominal security levels under a 2^80 query cap. No key recovery attack is described.
WhyIdentifies several decryption-failure mechanisms and recomputes failure rates, exposing insufficient margins in several parameter sets; evidence relies on modelling assumptions and extrapolation.
In briefCyclotomic Cosets: a quantum sieve for hidden subgroups with prime-power moduli
SummaryThis paper studies the Learning With Errors (LWE) problem, a basis of post-quantum cryptography, by introducing the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of the Dihedral Coset Problem that keeps an exact hidden-subgroup structure. The authors use a π-adic ideal chain in cyclotomic rings to build a quantum sieve that reduces phase states step by step. For fixed prime p and modulus q=p^t, they report solving CCP in time and sample complexity 2^{O_p(log n log q)}, with extensions to uniform EDCP and Gaussian cases. The authors state that this result alone does not yield a quasi-polynomial-time algorithm for standard LWE.
WhyIntroduces cyclotomic coset problem and a π-adic quantum sieve, extending power-of-two EDCP results to prime powers, though not directly applicable to standard LWE.
In briefStill There, No Longer Seen: Compression-Induced Risk in Vision-Language Models
SummaryThis paper studies the risks that arise when Large Vision-Language Models compress visual tokens to reduce inference cost. The authors define a compression-specific failure as an adversarial input that is answered correctly with full tokens but fails after compression. They propose CIRA, an attack that perturbs images using only vision-encoder access to induce such failures. The paper also reports that a cross-view selection-stabilization defense substantially suppresses CIRA, though an adaptive variant partially restores its effectiveness.
In briefCyclotomic Cosets: A Hidden-Subgroup Generalization and Quantum Sieve for LWE-Related Problems
SummaryThis paper introduces the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of the Dihedral Coset Problem that keeps an exact hidden-subgroup structure. The authors build a quantum sieve using a π-adic ideal chain, which for fixed prime p and modulus q=p^t solves CCP in time and sample complexity 2^{O_p(log n log q)} with polynomial quantum space. The method also extends to uniform EDCP and Gaussian S|LWE>, but the authors state it does not by itself give a quasi-polynomial algorithm for standard LWE.
In briefSUCRE: a masking countermeasure that protects ML-DSA rejection sampling from physical attacks
SummaryThis paper presents SUCRE, a countermeasure that physically protects the rejection sampling step of ML-DSA, a NIST-standardized post-quantum signature scheme. Its masking gadget unmasks a vector while randomly permuting its coefficients, preserving the infinity norm so rejection sampling works without complex mask conversions. The authors give a formal proof against d-probing adversaries, based on a new MLWR variant with a concrete security analysis. The implementation runs four to six times faster than Coron et al. (TCHES 2024), at the cost of higher memory usage.
WhyProposes a novel permutation-based unmasking gadget for ML-DSA rejection sampling, with a formal probing proof and a new MLWR variant analysis.
Sonia Belaïd, Ryad Benadjila, Julien Devevey et al.
In briefChange Web State Before Acting: Protecting Web Agents from Deceptive Interfaces
SummaryLLM-based Web agents can complete user tasks autonomously, but deceptive interfaces can steer them toward outcomes against users' interests. The paper identifies a failure mode in which a task-valid action still causes an unauthorized consequence due to the current Web state. The proposed Veer defense builds a prospective intervention trajectory toward a safe state and verifies it before modifying the live environment. On TrickyArena and WebDecept, Veer achieves the highest safe task completion across three evaluation settings and reduces dark-pattern success on WebDecept to 0.3%.
In briefJevVibe: Classification-guided method for making AI-generated code more secure
SummaryThis paper addresses security weaknesses in code generated by large language models. It introduces Jev, a decision model that selects Common Weakness Enumeration (CWE) labels directly from candidates and returns probabilities, and evaluates it on a 50-way classification task using 1,916 CyberSecEval examples. Jev outperforms six open-weight baselines and, compared with GPT-5.6-Sol, performs better on Top-3 and Top-5 accuracy with much lower latency and cost. The authors also build JevVibe, a repair agent guided by Jev's diagnoses, which raises the security pass rate from 63.5% to 70.7%, above 66.1% for LLM-guided repair.
In briefDGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards
SummaryThis arXiv paper introduces DGF-Bench, a benchmark in which AI agents act as a governance board reviewing synthetic project dossiers while an attacker plants deceptive content in unvouched evidence. Most tested models reached correct outcomes on nearly all gates without attacks, but attacks that imitate the organization's own process markedly lowered some models' correct-decision counts. The paper defines a DGF score for the share of attacks a model blocks and releases the open-source package dgf-bench to compute it.
In briefJEV as a Judge for Agent Trace Security: Comparing a Typed Model with Generative LLM Judges
SummaryThis paper examines whether JEV, a typed decision model, can serve as a judge for classifying security risks in tool-using agent traces, compared with generative LLM judges. Across four benchmarks totaling 5,219 trajectories, JEV achieves a higher average positive-class F1 (77.8) than the strongest generative configuration, GLM-5.2 (74.1). JEV's median latency is 0.99 seconds and its estimated cost is about $0.000195 per valid judgment. The authors conclude JEV is an economical screening signal, with trade-offs in precision and recall.
In briefTEE Anchor: Cross-TEE organizational endorsement to reduce physical attacks on TEEs
SummaryIn 2025, practical physical-access attacks on TEEs, such as TEE.fail and Battering RAM, were disclosed. The paper proposes TEE Anchor, a lightweight X.509-based mechanism in which an organization issues certificates over each CPU's Chip ID to form its own PKI, and a Verifier checks the Chip ID in attestation evidence to prove the machine's organizational affiliation. It needs no extra root of trust such as a (v)TPM, and the prototype's operations, including provisioning and verification, complete within a few milliseconds.
In briefPhysics-Verified Federated Learning: Protecting Collaborative Anomaly Detection in Critical Water Infrastructure
SummaryThis paper addresses data poisoning in federated learning, where fabricated telemetry can corrupt shared intrusion detection models. The authors use physical process invariants, such as conservation laws and actuator couplings, mined from clean data as a verifiable admission gate for federated updates. They evaluate seven aggregation rules on the SWaT and WADI water testbeds and the BATADAL benchmark against fabrication, replay poisoning, and adaptive adversaries. The paper also uses zk-SNARKs so clients can prove invariant compliance without revealing operational telemetry.
In briefCoSec: Benchmarking Agent Security in Communities
SummaryThis paper introduces CoSec, an executable benchmark for testing whether LLM agents operating within and across communities protect private information and enforce authorization. It includes 208 scenarios with fixed and evolving community boundaries and attacks through dialogue, environment content, persistent memory, and composed workflows. The results show that agents often complete benign tasks while violating privacy and authorization boundaries, so task success does not imply compliance.
In briefGeometric Forgeries: Structural Cryptanalysis of MAYO. A paper attacking the post-quantum signature scheme MAYO by exploiting its underlying mathematical structure.
SummaryMAYO is a post-quantum signature scheme based on UOV that uses whipping to make public keys more compact. The paper presents the first structural forgery attack exploiting the geometry of its multivariate quadratic maps, combined with the Pseudo-Oil Attack and a descent to the binary field. It also introduces a multi-target reduction for homogeneous MQ maps. The authors report that these attacks lower the estimated bit security of MAYO Round 2 Levels I and III by about 18 and 16 bits, with Level I falling 15 bits short, and reduce estimated security of the Round 3 parameters, leaving MAYO2 3 bits below its required level.
WhyFirst forgery attack exploiting geometry induced by whipping, plus a multi-target reduction; strong novelty. Evidence rests mainly on estimated bit-security, not implemented attacks.
In briefImproving and securing image watermarking channels for traceable AI content.
SummaryRecent rules require traceable generated content, so modern watermarking uses post-hoc multi-bit schemes built from neural encoder-decoder pairs. The paper analyzes these networks statistically and shows they implicitly form parallel AWGN channels with BPSK modulation, which limits capacity and lacks a secret key, making them insecure. Based on this analysis, it introduces SNW, a post-hoc watermarking system that significantly outperforms state-of-the-art baselines in capacity and offers strong security guarantees.
WhyShows deep watermarking channels reduce to BPSK parallel AWGN and formalizes key-based security, then proposes a capacity-approaching scheme; strong novelty, evidence details limited.
In briefBinding Humans to Keys: A Decentralized Proof of Personhood Protocol
SummaryThis paper proposes S-GYID, a decentralized protocol that cryptographically links a digital identity to one unique living person without a trusted central authority. It replaces raw biometric transmission with an encryption-based digital fingerprint, aiming to resist identity theft and ghost key attacks. The protocol also uses a three-tier generational authority hierarchy with bounded tenure and VRF-based session selection to limit collusion. The authors prove resistance properties under standard cryptographic assumptions and provide a hypergeometric analysis for setting parameters.
In briefStallGrid: A protocol-native tarpit that stalls scanners in industrial control systems, with internet-exposure measurements
SummaryThis paper presents StallGrid, described as the first application-layer tarpit for OT/ICS, which stalls scanners using Modbus exception codes and prolonged IEC-104 connected states. Five variants ran for 24 days, logging 6,709 sessions and over 2,000 hours of accumulated connection engagement. The authors position protocol-native tarpitting as a low-cost complementary defense where patching is infeasible.
Arthur Cordeiro, Casper Andersen, Emmanouil Vasilomanolakis
In briefImproved near-capacity lower bound for Reed-Solomon lists on multiplicative subgroups
SummaryThe paper gives an elementary construction of large Reed-Solomon lists on multiplicative subgroups. For fixed rational rates, the leading entropy exponent of list sizes doubles the antipodal bound of Arnon, Boneh, and Fenzi. It also shows that the exponent constant c2 in the S-two whitepaper's universal list-size conjecture must be at least 2.
In briefAn Operator-Norm Method for Security Under Quantum Advice: A Quantum Cryptography Theory Paper
SummaryThe paper introduces an operator-norm approach to non-uniform security in the quantum random oracle and random permutation models, giving one reduction that covers both search success probability and distinguishing advantage. The framework yields tight bounds for Yao's box with and without salting, improved bounds for pseudorandom generators, and an optimal generic salting theorem for decision games. By separating offline and online query contributions, the authors also obtain stronger bounds for salted permutation and random-function inversion.
In briefOperator-norm method for security with quantum advice
SummaryThis paper introduces an operator-norm approach to non-uniform security in the quantum random oracle and random permutation models. It gives a unified reduction covering both search success probability and distinguishing advantage. The framework yields tighter bounds for Yao's box and pseudorandom generators, and an optimal generic salting theorem for decision games.
WhyA unified operator-norm framework yields tight bounds for Yao's box and salting, improving prior decision-game results with rigorous proofs.
In briefAuxMark: A Watermark Against Unauthorized Agent Distillation
SummaryThis paper introduces AuxMark, a behavioral watermarking framework for detecting when AI agent trajectories are illegally used to train student agents. It inserts harmless auxiliary actions into teacher agent trajectories and stores the surrounding context as private evidence cards, then audits suspect models through a black-box sign test. Across three agent benchmarks, two teacher agents, and four student architectures, the authors report detecting all 24 distilled models with zero false positives on 48 clean models. The method is also reported to remain effective against flooding, paraphrasing, truncation, and adaptive cleaning attacks.
In briefMMSkillRisk: Can AI agents stay safe when image-based skills hide malicious instructions?
SummaryThis paper introduces MMSkillRisk, a benchmark for end-to-end safety testing of attacks hidden in images within multimodal agent skills. The authors design NCVA, an attack that disguises malicious instructions as native parts of teaching images, such as annotations and interface labels. Across nine model-harness configurations, NCVA reaches a pooled attack success rate of 43.1%, 16.4 percentage points above a text-carrier baseline. The results show attacks can succeed while legitimate tasks are also completed, so task success alone does not prove safe skill use.
WhyFirst systematic runtime evaluation of image-borne attacks in multimodal skills; NCVA beats the text baseline by 16.4 points across nine configurations.
In briefSEAD: A State-Based View of Attacks and Defenses in Tool-Using Agents
SummaryThis paper frames attacks and defenses on language-model agents that use tools as partially observed state control, since earlier actions can change state so that a later routine-looking action becomes harmful. The attack method DART breaks harmful goals into locally plausible steps and uses real tool-execution feedback to guide search. The defense method SAGE investigates relevant state through read-only queries before allowing or blocking each action. Reported results include DART improving semantic attack success by 18.8 to 35.9 points, SAGE preserving 95.79% of benign trajectories while intercepting 92.73% of harmful paths, and reducing DART's executable attack success from 48.0% to 4.0% in online evaluation.
WhyUnifies attack and defense as partially observed state control, proposing DART and SAGE; multi-model and online experiments give strong support for tool-using agent security.
In briefTaming Multi-Category Harms: Adaptive Safety Steering for LLMs
SummaryThis paper proposes CAM-Steer, a framework that improves LLM safety by modifying internal activations during inference without updating model parameters. It estimates the risk of each harm category by comparing the hidden state with safe and unsafe prototypes, then combines category-specific safety directions into one steering direction and sets the intervention strength. Experiments across three LLM backbones and seven harm categories show higher average defense success rates than the evaluated baselines, including when categories co-occur, with negligible inference overhead.
In briefCoDeL: Co-evolving defense that trains LLM agents to resist hidden prompt-injection attacks
SummaryThis paper presents CoDeL, a training-based defense that protects LLM-based agents from indirect prompt injection, where malicious instructions hide in external tools or content. The defender is updated with LoRA-based GDPO using a decoupled reward covering safety, task progress, and format compliance. A co-evolving prober searches for injections that still succeed against the current defender, creating a shifting training curriculum. Experiments on three benchmarks, nine baselines, and two base models report an 88.5% reduction in attack success rate.
WhyProposes co-evolving defender and prober with latency-guided attack mining; validated on three benchmarks and nine baselines, cutting ASR by 88.5%.
In briefCheap to Hypothesize, Costly to Verify: Defending Against AI Agents in Vulnerability Discovery
SummaryThe paper observes that autonomous LLM agents can generate vulnerability hypotheses cheaply but verifying them is much costlier, so verification effort under a fixed budget becomes a defensive target. The authors propose RedHerring, which inserts certifiably safe decoys that attract verification effort away from real vulnerabilities. Across 33 OSS-Fuzz projects, 70 instances and five models, it reduced real vulnerabilities discovered by 38.7% to 60.4%.
WhyNovel verification-asymmetry framing and certifiable decoy defense; evaluation spans 33 projects and 70 instances, moderate scale.
In briefEvaluating How Well Windows Malware Detectors Resist Evasion Attacks
SummaryThis paper evaluates nine state-of-the-art evasion attacks against eight Windows malware detectors, seven open-source and one commercial, while keeping modified samples executable. It measures robustness through attack effectiveness, complementarity, transferability, and adversarial hardening. The authors find that detector vulnerability depends on model representation and attack type, and that no detector family is uniformly robust across all attacks.
Mashal Zainab, Salijona Dyrmishi, Hamid Bostani et al.
In briefReproBench: Testing AI Agents on Rebuilding Software Vulnerabilities from Scratch
SummaryThis paper introduces ReproBench, a benchmark that tests whether LLM agents can reproduce a vulnerability starting only from a CVE identifier, including rebuilding the execution environment. The reproduction workflow is split into six phases, each evaluated with verifiable artifacts. Using 30 real-world IoT firmware vulnerabilities, the authors found that 45.3% of runs resorted to vulnerability simulation, while only 5.3% of CVE-model pairs reproduced real vulnerabilities successfully.
In briefSimilarity Is Not Validity: Defending LLM Semantic Caches Against Poisoning
SummarySemantic caches cut LLM serving costs by reusing answers to similar queries, but retrieval relies only on embedding similarity, so an attacker can store a malicious answer under a query that looks benign. The paper proposes a defense that recovers distinguishing information from the raw cache-key text, exploiting a rewrite-residual structure in adversarial queries. Using Deletion Gain and an Answer Check, it blocks 82.0% to 98.2% of poisoned entries across three attack classes at a 5% false-positive rate, with negligible serving overhead.
In briefQuantum security of the XOR of random permutations, analyzed with Fourier methods
SummaryThis paper studies whether the XOR of several independent random permutations (XoP) stays secure against quantum attacks that query it in superposition. The authors prove explicit upper bounds on the advantage of any q-query quantum algorithm in distinguishing XoP from a random function. The bounds hold across the whole query range well beyond the 2^(n/3) limit from quantum collision finding. The proof uses a Fourier-analytic version of the polynomial method.
WhyProves quantum beyond-birthday security for XOR of permutations, the first such result, using a Fourier-analytic polynomial method with careful low-degree term analysis.
In briefIn multi-tenant quantum computing, coherence, not error rate, governs privacy
SummaryThis paper examines how much one tenant can learn about another when several users share a cloud quantum processor. The authors propose an information leakage measure based on quantum state distinguishability and test it on IBM Kingston (156-qubit) and IQM Garnet (20-qubit) devices. They find that devices with identical benchmarked error can leak significantly different amounts of information, because standard error metrics do not capture whether errors are coherent or stochastic. A uniform Pauli randomisation defence reduces leakage to zero, but experiments show a non-trivial degradation from accumulated errors.
WhyProposes a distinguishability-based leakage metric showing average error hides privacy risk; measured on two commercial devices only.
In briefTPOKÉ: A Threshold Public-Key Encryption Scheme Built on POKÉ
SummaryThis paper presents TPOKÉ, threshold public-key encryption schemes based on POKÉ, an efficient isogeny-based encryption scheme. The main construction, S-TPOKÉ, supports any (t,n) threshold, while Ch-TPOKÉ arranges the parties' secret isogenies in a chain for the (n,n) case. Compared with running n independent POKÉ instances, both schemes reduce the number of isogenies computed during encryption and roughly halve ciphertext size for large n.
In briefBefore Agents Act: Assurance-Aware Semantic Scheduling for Distributed Evidence Acquisition
SummaryThe paper proposes Assurance-Aware Semantic Scheduling (AAS), which jointly selects witnesses and schedules evidence acquisition under quorum, diversity, freshness, deadline, and resource constraints, so that tool-using agents do not act on expired evidence before infrastructure changes. In three generated infrastructure workloads, AAS produced 1,075 of 1,200 valid candidates versus 647 for a constraint-aware forward scheduler, and reduced stale candidates from 440 to 12. The authors stress these are controlled simulation results, that the bounded oracle shares a temporal search component, and that transfer to deployed systems is untested.
In briefSeparation of duties for privileged LLM agents: a governed execution architecture with measured security-utility trade-offs
SummaryLLM agents are increasingly given real privileges such as running commands and modifying files, so an erroring agent has already acted. The paper proposes governing the path from candidate action to side effects outside the model, with four roles (planner, policy gate, executor, auditor) between agent and operating system, using structured intents and one-shot approvals bound to exact bytes. On a 313-case benchmark, effective attack success fell from 98.3% under direct execution to 7.7% when deployed, with a corrected false-denial rate of 11.1%.
In briefError-aware scale design for faster encrypted LLM inference
SummaryThis paper proposes a scale design for CKKS-based privacy-preserving LLM inference that accounts for how numerical errors propagate through Transformer computations. It assigns operation-wise scales and modulus levels based on the precision each operation requires, reducing unnecessary conservatism. Reported results show modulus consumption reduced by 30.0% and bootstrapping operations reduced by 83.6% versus THOR on a standard Transformer, and by 33.6% and 80% versus PowerFormer on an HE-friendly Transformer.
In briefQuantum security of XOR of permutations via Fourier analysis
SummaryThis paper studies the quantum security of the XOR of r independent random permutations (XoP), a construction that goes beyond the birthday bound classically. The authors prove that XoP is indistinguishable from a random function for quantum algorithms making up to about 2^n/57774 queries, far beyond the quantum birthday bound. They use a Fourier-analytic polynomial method and present heuristic attacks suggesting the bounds are nearly tight.
WhyFirst proof that XOR of permutations is quantum beyond-birthday secure, using Fourier analysis and compressed oracles, with heuristic attacks showing tightness.
In briefCATP: Local Agent Authorization and Audit Evidence Design
SummaryThe paper presents CATP, a specification for turning local pre-execution authorization decisions into audit evidence that can be verified offline. Experiments on Claude Code and Codex found five missing consistency checks, and adding them produced the expected outcomes on all 13 test cases. The evidence depends on a trusted runtime, monitor, host and signing key, and it does not prove execution truth.
In briefRADNPO: A reference-free method for making LLMs forget specific content
SummaryLarge language models can memorize sensitive, private, or copyrighted text from pre-training, so unlearning methods are needed to remove targeted knowledge. This paper proposes RADNPO, which suppresses forget targets while explicitly guiding how the next-token probability is redistributed. It contrasts each target with alternative tokens favored by the current distribution and adjusts forgetting strength using target confidence and distribution concentration. Experiments on TOFU and MUSE show it achieves a better trade-off between forgetting quality and model utility than current baselines.
In briefCertified Multi-Source Integrity for Structured Agent Actions: Verifying Multi-Source Data Before LLM Agents Act
SummaryThe paper addresses LLM agents that carry out privileged, often irreversible structured actions, such as paying an invoice, using fields drawn from documents and tool outputs an adversary could corrupt. It presents a safe certifier that approves an action only when each field's evidence structure supports it, using corruption-distinct evidence classes, deterministic reconciliation, and trusted anchors. Tests across five models in a real agent loop found the certifier admits no unsafe action, while baseline defenses were broken by some attack.</summary>
WhyProposes certifying structured agent action integrity under shared-source corruption budgets, a novel framing; validated via ablations, sanctions and supply-chain data, and a real agent loop.
In briefRaising the Bar for Chinese Adolescent LLM Safety: A Culturally-Grounded Benchmark
SummaryThe paper introduces QH-Bench, a Chinese-language benchmark for adolescent content safety, built on Chinese social and cultural scenarios, with 715 single-turn items and 100 four-turn trajectories. Evaluating 13 open-weight models, it finds offline-contact scenarios to be a shared weakness, with every model scoring negatively on over half of such items. The authors note that leading aggregate scores do not show these specific weaknesses have been resolved.
In briefImproved attacks on local pseudorandom generators using XorMaj predicates
SummaryThe paper presents two seed-recovery attacks on local PRGs that apply XorMaj predicates to map an n-bit seed to an m-bit pseudorandom string. The Guess-Filter-Solve (GFS) attack extends the GAS framework and outperforms GAS, especially for short outputs. The Filter-Guess-Propagate (FGP) attack speeds up Belief Propagation compared with GADec. Both are extended to XorMod predicates and applied to a ZKP protocol and QuietOT, yielding attacks on witness indistinguishability and OT receiver privacy respectively..
WhyExtends GAS and GADec with GFS and FGP attacks, with experiments showing large complexity reductions over prior methods, affecting local PRG security evaluation.
In briefLong-term outage planning using scenario-based system load forecasts
SummaryRapid growth of hyperscale data centers in Northern Virginia is increasing electricity demand, requiring transmission reinforcement that needs planned outages evaluated months ahead. Conventional studies use monthly or seasonal peak-load assumptions, which can be overly conservative and cause short outages to be postponed or denied. This paper compares daily, weekly, and monthly load forecasts built with SARIMA, Prophet, Gradient Boosting, and Random Forest, reconciled bottom-up across horizons, against peak-based methods. Results indicate granular forecasts reduce unnecessary conservatism and accommodate outages better, especially short ones, without changing reliability criteria.
Akash Debnath, Shiuli Subhra Ghosh, Jaime De La Ree et al.
In briefRevisiting dual lattice attacks on bounded distance decoding with a heuristic-free trade-off
SummaryThis paper examines the assumption that scores of short dual vectors in dual lattice attacks are mutually independent. In the Haar-random lattice model, without heuristic assumptions, the authors prove an explicit asymptotic trade-off between target radius and query time for decision bounded distance decoding with preprocessing. Using Siegel and Rogers moment identities, they analyze cosine scores over complete dual balls and bound error probabilities. The resulting trade-off matches the asymptotic prediction of the Ducas-Pulles conditional model.
WhyProves an explicit asymptotic BDD preprocessing trade-off in the Haar-random lattice model without heuristics, matching the conditional prediction.
In briefFaultless: a technique for checking whether neural decompilers' code matches the original program.
SummaryThis paper introduces Faultless, a program equivalence technique for translation validation of neural decompilers. It compares neural decompiler output with code from a deterministic decompiler or a reference solution. The authors note that neural decompilation poses challenges such as limited extrafunctional context and systematic semantic inconsistencies, which existing methods do not handle well. Faultless uses a static symbolic execution approach with an execution model and memory model designed for these challenges.
In briefLoRo-Mark: A Provably Lossless and Robust Watermark for LLM Agents
SummaryThis paper addresses the problem of LLM agents being repackaged and presented under another party's identity. It proposes LoRo-Mark, a watermarking mechanism that embeds ownership evidence without affecting normal functionality. The watermark is placed in a cryptographically authenticated forensic branch that activates only on owner-authorized requests, and ownership information is redundantly spread across forensic behavior sequences for recovery after partial modification. Experiments on multiple LLM agents report no degradation on normal tasks and reliable ownership verification under sequence modifications.
In briefPerceptFence: A Content-Mediation Architecture for Screen-Share AI Assistants
SummaryThis paper proposes PerceptFence, a layer that sits between screen and speech capture, memory, and model responses, to control what a screen-share AI assistant can observe, retain, or disclose. On 9,600 adversarial strings, it neutralised 0.828 of digit-PII payloads versus 0.183 for Presidio on shared seeds, while Presidio led on other families. In an OCR-based evaluation over 480 synthetic developer-support screens, it neutralised 0.918 of OCR-surviving secrets and PII, compared with 0.581 for Presidio and 0.179 for gitleaks. The authors state the contribution is an architecture and evaluation method, not live deployment or formal privacy guarantees.
In briefSweepMark: Query-free, high-fidelity attack removing robust audio watermarks
SummaryThis paper proposes SweepMark, a query-free black-box attack that removes audio watermarks used to trace misuse of text-to-speech synthesis, without access to target watermarking models or paired clean and watermarked samples. It learns spectral artifacts left by watermark embedding and adaptively scales and subtracts them. Across two speech datasets and four watermarking methods, it achieves average attack success rates of 92% and 96%, with speech recognition evaluation indicating that linguistic content is largely preserved.
In briefOne Unverified Coordinate Is Enough: Key Recovery from Faulty FO Rejection Checks in ML-KEM
SummaryThis paper examines what happens when the Fujisaki–Okamoto re-encryption check in ML-KEM is implemented incorrectly, as some deployed libraries reportedly do by skipping a conditional move or truncating ciphertext comparisons. The authors show that a single unverified ciphertext coordinate is enough for an attacker to recover the secret key from bounded-error observations via least squares. They prove that O(kn log kn) observations suffice under a regularity assumption and demonstrate full recovery on all three parameter sets against a simulated implementation.
WhyShows one unverified ciphertext coordinate enables least-squares key recovery in ML-KEM with provable sample bounds, a high-impact attack validated on a simulated implementation.
In briefGateDrain: Availability attacks and admission defense for confidence-gated edge-cloud AI
SummaryThis paper shows that confidence-gated edge-cloud inference, which sends uncertain inputs to a cloud model, creates an availability attack surface. The proposed GateDrain attack uses bounded input perturbations to lower confidence, redirecting requests that would be answered locally into a shared cloud queue without raising the application request rate. The authors also propose Bounded Escalation, a containment defense combining per-source admission budgets, protected capacity, and trusted-class priority. The paper notes that tighter aggregate containment can reject legitimate unauthenticated offloads and reduce overall accuracy through edge fallback.
Zonghua Gu, Julian Singh-Smith, Junlin Liao et al.
In briefPrivacy risks of crowdsourced fine-tuning: poisoning data to extract others' records
SummaryThis paper examines a privacy risk in supervised fine-tuning of language models that uses crowdsourced user conversations, where untrusted users can contribute data. The authors show that a malicious user can poison a small fraction of the data to amplify extraction of other users' unseen instructions, using only black-box, output-only access to the model. Experiments on four models and two datasets show near-verbatim extraction rising to 3.71 times the unpoisoned rate with 50 poisoned examples. The authors also find that data filtering detects poisoned samples poorly, with the best method reaching only 0.378 F-1.
In briefTrackFlood: Shifting Latency Attacks from NMS-Free Detectors to Real-Time Trackers
SummaryThis paper studies latency attacks on object detectors, aiming to make systems respond too late rather than corrupt predictions, with real-time applications such as autonomous driving in mind. The authors propose TrackFlood, a white-box overload attack that floods the tracker in NMS-free detect-then-track pipelines with phantom detections while detector inference stays unchanged. Tests on an NVIDIA Jetson AGX Orin show tracker latency rising substantially, and a lightweight bounded-admission layer is evaluated as a mitigation.
WhyRelocating latency attacks to downstream trackers is novel; Jetson end-to-end timing evaluation supports it, though standard-budget slowdowns are modest.
Zonghua Gu, Julian Singh-Smith, Junlin Liao et al.
In briefThreshold signatures that identify who aborts, built from one-way functions
SummaryThis paper presents a threshold signature scheme in which N participants share a signing key so that any T of them can jointly produce a valid signature. It builds on a variant of Lamport one-time signatures and Shamir secret sharing, and supports identifiable abort. The scheme is extended to multiple messages using multi-layer Merkle trees, with a bulletin board used to coordinate one-time key usage.
In briefA2A-ForensicTrace: offline checking of tamper-evident records from agent-to-agent interactions
SummaryThis paper presents A2A-ForensicTrace, an offline verification layer for runtime evidence from Agent2Agent (A2A) executions. It turns runtime observations into typed records, derives protocol-related relationships, and commits them under an incident-trace root, with an Ed25519-signed receipt binding the root to the incident context. The evaluation ran 240 executions through the official A2A SDK, including 120 condition runs and 120 matched controls, and all condition runs returned the expected findings while no control raised an indication.
In briefTraining Witnesses: Verifying training runs without trusting the trainer
SummaryThis paper introduces Witnesses, a method for certifying neural network training, data usage, and evaluation. It relies on fast behavioral fingerprints combined with occasional replay challenges to audit training, with low overhead for the trainer and low cost for the verifier. The method was tested on language model training runs from 100M to 2B parameters, and the authors also propose a self-regulating leaderboard of auto-certified runs to support shared baselines and reproducibility.
WhyProposes behavioral fingerprints with replay challenges to audit training, tested on 100M–2B language models with low overhead.
In briefA2A-CaseVerify: Merkle-linked verification of case evidence for cross-organization A2A workflows
SummaryThe paper presents A2A-CaseVerify, a deterministic offline verifier that maps A2A runtime objects, business events and typed support edges into a directed case evidence graph committed by a deterministic Merkle root. It returns SUPPORTED only when protection and profile-specific reconstruction checks pass. Evaluated on one canonical healthcare-profile bundle and 13 controlled mutations, the canonical and SDK-generated bundles were accepted and all mutations were rejected.
In briefNear-duplicate families cause false membership attribution for exact records
SummaryMembership inference asks whether a specific record was in a model's training set and is increasingly used as evidence in data provenance and copyright auditing. The paper shows that near-duplicate content common in web-scale data confounds standard methods: on CC-News, a clean-reference LiRA auditor labeled 99.70% of family-present exact non-members as members at a 1.00% false-positive rate. The authors conclude that positive model-only evidence may establish family-level exposure without establishing exact-record provenance.
WhyIntroduces a four-world audit showing near-duplicate families cause severe false membership attribution, with controlled interventions separating classification from language modeling.
In briefCan prompt anonymity stop LLM providers from re-identifying users?
SummaryThis paper examines whether anonymizing proxies, which separate user identity from prompts, still let LLM providers re-identify users through the prompt content they can see. The authors built PromptAnonBench, a benchmark of over 175,000 cleaned multi-turn prompts from SWE-Chat and WildChat. Even with text-based defenses, an attacker could re-identify at least one anonymized conversation for 50–75% of SWE-Chat users and up to 10% of WildChat users at a 10% false acceptance rate.
In brief"No Free Efficiency": a paper on how making model training cheaper can weaken robustness and security.
SummaryThe paper systematically studies the trade-off between training efficiency and model vulnerability across vision and language models. It finds that efficiency-oriented training increases susceptibility to adversarial and privacy attacks, linked to sharper loss geometry and changed representational structure. Models trained with simplified zero RL recipes show greater catastrophic forgetting and overconfidence than those trained with conventional alignment. The authors call for multi-objective training that jointly optimizes performance, cost, and security.
In briefThe Cost of Stability: Deanonymizing Onion Services' Long-Lived Introduction Circuits
SummaryThis paper presents an intersection attack that exploits the fixed 18 to 24 hour introduction circuits used by Tor onion services. An adversary observing one Tor relay at a time can use this stability to identify an onion service's network location. The authors tested the attack on the live Tor network against a self-operated service, reconstructing the full circuit in all nine end-to-end runs. They also propose periodically rebuilding internal introduction circuits to limit evidence accumulation without changing publicly advertised information.
WhyExploits long-fixed introduction circuits for an intersection attack, validated across nine live Tor experiments, with notable novelty and broad impact.
In briefRAISE: Improving LLM Access-Control Policy Synthesis with Symbolic Evaluation
SummaryThe paper introduces CedarInstruct, a dataset of 5,800 scenarios across 44 domains with verified target policies and executable verification plans for Cedar policy synthesis. It proposes RAISE, a two-stage method combining verified supervised fine-tuning with reinforcement learning driven by verifier signals. The RAISE-OC variant, which uses failed checks and symbolic counterexamples for guided exploration, is reported to outperform zero-shot GPT-6 Astra and Claude Opus 5 on held-out semantic success, and the training transfers to the independently built CedarBench.
In briefTokens Change, Structure Endures: Spectral Watermarking for Generated Speech
SummaryThis paper proposes Redwing, a training-free token-level watermarking method for AI-generated speech that works during generation. It addresses retokenization, where decoding speech to audio and re-encoding it changes token identities and weakens the watermark. Redwing builds a graph from observed token substitutions and jointly optimizes embedding and detection functions over its Laplacian basis. On the Moshi system after eight Mimi resynthesis passes, it reaches 80.7% TPR at 1% FPR, versus 8.3% for KGW.
WhyExploits retokenization substitution structure via graph Laplacian basis with joint embedding-detection optimization; strong gains over baselines after eight passes across several codecs.
In briefSecProbe: An adaptive test of whether coding AI agents can spot and fix security flaws
SummarySecProbe is a framework that adaptively evaluates coding agents on cybersecurity vulnerabilities by combining Item Response Theory with on-demand synthesis of repository-scale vulnerability-repair tasks. The authors built 353 tasks covering six programming languages and 151 CWE types, and evaluated nine frontier models with two agent harnesses. Success rates peaked at 28.33%, and compared with random and one-shot baselines, SecProbe gave comparable ability estimates while requiring up to 29.5% fewer tasks.
In briefMAD-Guard: Comparing Token Generation and Direct Decision Outputs for Multimodal Forensic Tasks
SummaryThis paper studies whether multimodal models need to generate tokens autoregressively or can output forensic decisions directly. Using the same backbone and training budget, it compares several decision interfaces on latency, calibration error, and accuracy. A binary direct head cuts latency by 2.60 to 7.27 times and lowers calibration error, at a small accuracy cost, while multi-task and contrastive head variants outperform the autoregressive baseline. Across five benchmarks, the approach performs well on synthetic, camouflage, and document forgeries but shows a clear limitation on compressed face manipulation.
In briefCOGNIT-Guard: A calibrated safety filter that screens prompts on a CPU and NPU before they reach a language model
SummaryThis paper presents COGNIT-Guard, a real-time system that checks user prompts for safety before they reach a target LLM. A fast CPU gatekeeper hands uncertain cases to a 322M-parameter direct-decision model running on an NPU. On the unseen DUCS-Bench test split it reports 98.85% accuracy and a 0.42% benign false-positive rate, with mean latency of 41.63 ms for the cascade. The authors also evaluate out-of-domain accuracy on SafetyBench-ZH and show that experience replay recovers performance lost to alignment.
