In briefLights, Camera, Attack: Using pulsed light to disrupt HDR image fusion in cameras
SummaryThis paper introduces FLASH, an external pulsed-light attack that creates inconsistencies between exposures captured for temporal HDR fusion. Tests on eight physical camera platforms show it can cause darkening, overexposure, and loss of visibility, and it affects a traffic-cone target in a controlled OpenPilot case study. A proof-of-concept exposure-rejection defense reduced median output-brightness deviation by 79.16% in a night-only stress test.
WhyNovel external pulsed-light attack exploiting cross-exposure inconsistency in temporal HDR fusion; validated on eight physical cameras with matched controls and an OpenPilot case study, indicating bro
In briefWhere LLMs decide to ignore their rules under prompt injection: locating the compliance mechanism inside the network
SummaryThis paper asks which internal layer of a large language model actually decides to follow an injected adversarial instruction instead of its system role. Using layer-by-layer causal activation patching on five models from 4B to 32B parameters, the authors find attack information is decodable early but has causal influence only at a late-layer bottleneck. Patching that bottleneck reversed compliance in 77–92% of cases.
WhyLayerwise causal patching across five models localizes prompt-injection compliance to a late-layer bottleneck, a novel and well-supported finding with notable defensive implications.
In briefMeasuring GPS Spoofing of Ships at Sea Worldwide
SummaryThis paper presents the first large-scale study of GPS spoofing in maritime traffic, using global ship tracking (AIS) data. The authors detect groups of vessels whose reported positions jump in physically implausible, correlated ways, and grade the evidence in each region. Analyzing over 367,000 vessels from late November 2024 to early February 2025, they identify 31 persistent anomalous hotspots, at least 22 with strong evidence of spoofing. The study also reports spoofing in the Red Sea months before the MSC Antonia grounding, which had not been documented previously.
WhyFirst large-scale measurement of maritime GPS spoofing using a motion-aware regional detection method on over 367,000 vessels, with substantial impact on maritime security.
Anna Raymaker, Ryan Von Brock, Ryan Pickren et al.
In briefTHEMIS: A Co-Designed System for Encrypted Transformer Inference
SummaryThis paper presents THEMIS, a system for Transformer inference under fully homomorphic encryption (FHE) that co-designs stages around depth budgets and modulus-chain placement. It reports speedups over MOAI and Euston for matrix multiplications and attention, and a faster, higher-precision softmax compared with THOR. On a CPU, BERT-base inference takes 400.06 amortized seconds per input, with GLUE accuracy comparable to plaintext.
In briefLevis: Extension-free multi-key fully homomorphic encryption in the plain model
SummaryThis paper presents Levis, a multi-key fully homomorphic encryption scheme that needs no trusted or interactive setup. Its Cofactor Compatibility technique lets ciphertexts under independently generated local keys be evaluated directly, without first extending them to joint-key ciphertexts. A compact variant, Levis-small, reduces per-ciphertext communication. A proof-of-concept implementation reports evaluation speedups over the MPS scheme for 2, 4, and 8 parties.
In briefVirusCascade: Hijacking Shared Self-Reflection in LLM-Based Recommender Agents
SummaryThis paper studies LLM-powered agentic recommender systems, where users and items are agents that refine their states through collaborative reflection. It shows that adversarial evidence injected into one agent can be rationalised as a genuine preference, stored in memory, and spread to other agents. The authors propose VirusCascade, a black-box targeted promotion attack, and report a mean E@20 of 0.384 on four real-world datasets, 0.185 above the strongest baseline.
WhyProposes a new collaborative-reflection hijacking attack, validated on four datasets and several architectures, reaching mean E@20 0.384, beating the strongest baseline by 0.185.
In briefNOMOS: Secure Non-Interactive kNN Search Under CKKS
SummaryThis paper presents NOMOS, an encrypted k-nearest neighbor protocol for candidate sets under the CKKS fully homomorphic encryption scheme. It targets the cost of encrypted ranking and top-k extraction by adding a gap-amplified sign approximation and k-means preprocessing to reduce sign-approximation calls to near-linear scaling. The authors report latency reductions of nearly 8x on a Mazzone-style ranking benchmark and up to 828x against Engorgio on candidate-set workloads. On the SIFT dataset, they report 100% top-1 and top-8 retrieval accuracy on the evaluated candidate sets.
In briefJanus: Recording AI Agent Actions Before They Happen, Verifiable Offline
SummaryThis paper presents Janus, a system that logs each proposed step of an agentic LLM, along with validator or human verdicts, in a signed, hash-chained log before the step can run or its effect is released. An auditor can re-derive every verdict offline using only the log and one public key. The authors evaluate it through crash injection, offline verification of a 100-million-event log, and a lending workflow with a real model. They also report a post-approval substitution flaw found during their own audit, along with its fix.
WhyA new evidence-before-effect logging paradigm with offline re-derivation, backed by crash injection, a 100-million-event verification, and a real-model lending experiment that found a substitution fla
In briefSLUB Harvest Season: From an io_uring Flaw to New Sheaf-Based Exploitation Methods
SummaryThis paper examines security risks in two Linux kernel components: the io_uring I/O subsystem and the sheaf/barn caching layer added to the SLUB allocator in Linux 6.18. The authors report two previously unknown io_uring vulnerabilities and build one into a local privilege escalation chain that works under a hardened kernel configuration. They find that the sheaf/barn design changes assumptions behind existing techniques such as cross-cache attacks and weakens SLUB freelist protections. Three new sheaf-based exploitation techniques are proposed, including an RCU-sheaf cross-cache method that moves objects between caches without relying on the buddy system.
WhyProposes three novel sheaf-based exploitation techniques and demonstrates a full io_uring-to-LPE chain under hardened configuration, with substantial kernel security impact.
In briefHiding LLM Multi-Agent Topology with Phantom Structure Injection
SummaryThis paper addresses the risk that the communication topology of LLM-based multi-agent systems can be inferred from observable reasoning traces, leading to intellectual property leakage. It proposes MIRAGE, a framework that keeps the genuine topology for task execution while shaping visible semantic evidence toward a constructed phantom topology. Experiments across three topology optimization frameworks and four benchmarks show that MIRAGE substantially reduces topology inference attack effectiveness while largely preserving task utility.
In briefA provable subexponential-time LWE algorithm using about n+o(n) samples, via Wagner-style Gaussian sampling
SummaryThis paper presents a randomized subexponential-time algorithm for decision Learning with Errors (LWE) in two complementary parameter regimes. It builds on the Wagner-style Gaussian sampler of Ducas, Engelberts, and Loyer (CRYPTO 2025), using random P-ary lattices, a statistically approximate shifted discrete Gaussian sampler, and the Aharonov–Regev Fourier distinguisher. The authors state that for any secret distribution it succeeds with probability 1-o(1) using m=n+Θ(n/ln ln n) samples, with expected time and space 2^{Θ(n/ln ln n)}. The analysis covers unstructured LWE with independent uniform public vectors and does not directly apply to ML-KEM, which is based on Module-LWE.
WhyExtends Wagner-style Gaussian sampling with P-ary lattices and martingale analysis for subexponential LWE, broadening parameter regimes, though proofs are intricate and empirical support is limited.
In briefSuccinct arguments for QMA in the quantum random oracle model
SummaryThis paper constructs the first succinct argument for QMA in the quantum random oracle model (QROM), without relying on additional cryptographic assumptions or unproven conjectures. The core is an efficiency-preserving transformation that compiles quantum interactive oracle proofs (QIOPs) into quantum arguments for the same language, using a quantum commit-and-open paradigm. The authors also formalize and construct extractable vector commitments for quantum states with local openings in the QROM.
WhyFirst succinct argument for QMA in the QROM, relying only on unstructured hardness, with an efficiency-preserving QIOP-to-argument compilation.
In briefConfidence-guided intermediate representation for LLM-aided security protocol modeling
SummaryThis paper presents a human-in-the-loop framework that converts natural-language descriptions of security protocols into formal models verifiable with Tamarin. The authors identify semantic accuracy, rather than syntactic validity, as the main correctness bottleneck. They introduce a human-auditable protocol intermediate representation and an interface that highlights uncertain fields based on model confidence so users can review key decisions before model generation.
In briefBackdoor Mitigation in Decentralized LLM Fine-Tuning
SummaryThis paper studies backdoor attacks that spread during decentralized fine-tuning of a large language model, where organizations share trainable adapters without a central coordinator. It shows that one poisoned node can backdoor neighboring nodes that never saw poisoned data, causing them to refuse prompts containing a secret trigger. The proposed Chorus mechanism lets each node judge neighbors' adapters by behavior against its own trusted adapter, with neighborhood voting before aggregation. Across two instruction-tuning datasets and model architectures, Chorus reduces the neighbors' average attack success rate from 48–63% to at most 2.2%, at negligible communication cost.
Sayan Biswas, Jade Garcia Bourr\'ee, Rachid Guerraoui et al.
In briefCollision detection is near instance-optimal below the birthday threshold
SummaryThe paper asks whether structural knowledge of a hash function can speed up black-box collision detection, using instance optimality as the measure. It shows a single algorithm that, for any function where a structure-aware algorithm finds a collision with q queries in expectation (q up to O(√(n/log n))), finds a collision within O(q log n) queries. The O(log n) overhead matches a prior lower bound, implying that structural backdoors for collision finding cannot be planted.
WhyProves a near instance-optimal collision-detection algorithm below the birthday threshold, with a tight log factor partially resolving an open question.
Omri Ben-Eliezer, Tomer Grossman, V\'aclav Rozho\v{n} et al.
In briefAutoMark: Using Autonomous Research Agents to Find Better AI Text Watermarks
SummaryThis paper presents AutoMark, a framework that autonomously discovers distortion-free watermarking schemes for large language models. The authors define reliability criteria, propose statistical tests to check them, and rank schemes by detectability, quality, and robustness. Running the framework with three frontier models, they found over 50 schemes, several outperforming prior work, including some fundamentally new ideas.
In briefArgos: A Multi-Tenant SaaS Architecture for Coordinating Distributed Edge Security Devices
SummaryThis paper presents Argos, a multi-tenant SaaS command-and-control architecture for transparently and automatically managing distributed edge devices over the long term. It provides role-based access control, tenant isolation, persistent task management, and cron-based workflow automation. The system was tested on three geographically distributed edge devices running 810 automated tasks mapped to MITRE ATT&CK techniques, with a global failure rate of 3.33%. The evaluation methodology, sanitized datasets, and statistical scripts are publicly available.
Agustin Javier Di Bartolo, Mohammadhossein Homaei, Andres Caro et al.
In briefCyberattack Robustness of Local Energy Markets: A False Data Injection Case Study
SummaryThis paper examines how community-based local energy markets, which rely on demand and PV forecasts, can be vulnerable to coordinated false data injection attacks. It proposes a bilevel optimization framework that finds worst-case bus-level attacks on interconnected multi-community markets in a distribution network, balancing voltage-deviation impact against detectability. Case studies on an IEEE 33-bus system with three communities show that even bounded, system-level attacks can reshape local trading and reduce voltage security margins. Vulnerability depends strongly on where and when falsified data is placed rather than on uniform spreading.
In briefQuantum leakage resistance of Shamir secret sharing
SummaryThis paper studies whether standard Shamir secret sharing over prime fields stays secure when each share holder leaks one qubit through a local quantum channel. Without pre-shared entanglement and with a threshold rate above about 0.73339, the adversary's distinguishing advantage is exponentially small. Security still holds for a linear number of devices sharing entanglement with each other and the adversary when the threshold is high enough. The authors also show that a GHZ state among exactly t devices breaks security even with classical one-bit leakage.
WhyFirst study of quantum leakage resilience for Shamir sharing, with exponential security bounds and entanglement attacks proven rigorously, a theory-only contribution.
Rishabh Batra, Fuyuki Kitagawa, Ryo Nishimaki et al.
In briefBeyond Semantic Narrowing: Robust, Efficient LLM Watermarking via Hamming Neighborhoods
SummaryThis paper proposes HammingMark, a semantic watermarking method for text generated by large language models. It uses the semantic hash of the preceding sentence as a dynamic center and accepts candidates whose hashes fall within its Hamming neighborhood, so fewer natural semantic continuations are rejected. Experiments on C4 and BookSum report strong robustness, high detectability, and generation quality close to unwatermarked text, needing only 2.2 sampled candidates per accepted sentence.
In briefWhen Cyber Scoring Systems Disagree: A Comparison Study
SummaryThis paper empirically compares four vulnerability scoring systems: CVSS, EPSS, SSVC, and IronMiner. It uses a reconstruction of the 2015 Ukraine power grid operational-technology network as the comparison basis. The results show substantial disagreement among the systems, suggesting that the choice of scoring system could significantly affect mitigation and prioritization, and that a composite or hybrid approach may be more suitable.
Kirsi Hellsten, Joni Herttuainen, Ambrose Kam et al.
In briefToolFence: Fine-Grained Authorization to Secure Tool-Using LLM Agents
SummaryTool-using LLM agents are vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context. ToolFence compiles a typed authorization blueprint before execution and enforces it with a deterministic monitor, asking a judge to grant new capabilities only when the blueprint is incomplete. On AgentDojo with Qwen3-max, it reduces overall attack success rate to near zero, with a 3.80 percentage-point drop in clean utility.
In briefWhen Tools Silently Lie: Testing How Data Agents Handle Wrong Tool Outputs
SummaryThe paper studies whether tool-augmented data agents verify tool outputs or blindly trust plausible but incorrect results. The authors introduce ToxicBench, which measures checking and adoption under numerical, label, schema, and retrieval errors. In a 118-task GPT evaluation, poisoned observations lowered task success by 26 to 39 percentage points.
In briefA fast way to check whether abelian surfaces are supersingular or superspecial
SummarySupersingular abelian surfaces matter for isogeny-based cryptography, yet no efficient method existed to check whether a given surface is supersingular. This paper gives a Monte Carlo algorithm over F_p that runs in O(log p) time with negligible failure probability, and a conclusive algorithm when the order is smooth. It also presents efficient algorithms for checking minimality or maximality of abelian varieties of any dimension, and superspeciality of Jacobians of any dimension.
Maria Corte-Real Santos, Gioella Lorenzon, Krijn Reijnders
In briefQuantum superposition attacks that recover secret keys from Dilithium and Fiat-Shamir signature schemes
SummaryThis paper assesses the security of NIST's standardised signature scheme ML-DSA and its predecessor identification schemes under an extended quantum adversary model that can interact with a signer using quantum resources. The authors develop new superposition attack techniques and use them to achieve full key recovery against several lattice-based identification schemes, then extend the attacks to Fiat-Shamir signature schemes. The original CRYSTALS-Dilithium and the NIST Round 1 and 2 proposals are shown to be fully attackable in the Q2 model, while modifications made during standardisation prevent these attacks against the final ML-DSA.
WhyIntroduces new superposition attack techniques yielding full Q2-model key recovery on Dilithium, though evidence is largely analytical rather than experimental.
In briefScreaming Channel: A Survey of Far-Field EM Side-Channel Attacks via Radio Coupling
SummaryThis paper is the first systematic survey of screaming channel attacks, a form of far-field electromagnetic side-channel attack (FEM-SCA) on IoT devices. These attacks exploit unintended coupling between digital computation and the radio transmission chain to capture sensitive information from radiated signals at long distances. The authors organize existing studies into a hierarchical framework and compare representative works across factors such as target implementation, attack distance, and profiling requirements. The survey concludes with one central trade-off, three major limitations, and three future research roadmaps.
In briefReceipts for Tool Agents: Binding Claims, Evidence, and Execution for Auditing
SummaryThe paper addresses a gap in tool-using AI agents, where citations and execution logs may each look valid while a shown claim is not the one produced by the recorded execution or supported by the cited source. The authors propose a claim-anchored execution contract that jointly binds the emitted claim, its exact source span, the ordered execution prefix, and the source version and access state. A deterministic verifier checks these bindings separately from a support check. Across 1,280 cross-object attacks, the joint contract detected 1,275 substitutions (0.9961).
In briefOPFL: Optimistic verification of federated learning using an empirical boundary
SummaryThis paper presents OPFL, a framework for checking whether clients in privacy-preserving federated learning follow the prescribed training procedure or send malicious updates. It replays training inside secure multi-party computation and uses an offline-calibrated empirical boundary to separate harmless numerical differences from manipulation, auditing only sampled training steps to reduce cost. Experiments on LeNet, BERT, and Qwen report a 0% attack success rate against model poisoning and PGD-based attacks, and a speedup over full MPC-based and ZK-based approaches on a LeNet workload.
In briefTAILOR: A Type- and State-Aware Multi-Agent Framework for Automated CVE Reproduction
SummaryThe paper argues that CVEs differ in runtime form, trigger interfaces, and prerequisite state, so fixed pipelines fit them poorly. It presents TAILOR, which first matches each vulnerability to an execution path and, on the Web path, builds the required prerequisite state before triggering the exploit. On a dataset of 200 CVEs, TAILOR reproduced 59.24% of Web vulnerabilities and 44.19% of traditional ones.
In briefCollageAttack: Spatial text composition attack exploiting cross-modal alignment flaws in text-to-image models
SummaryThe paper proposes CollageAttack, an automated single-prompt black-box jailbreak for text-to-image models. It moves harmful semantic assembly into the image plane by combining context-relevant scenes, scene-grounded text carriers, and spatially distributed text fragments. Experiments on several open-weight and commercial models report attack success rates up to 86.0%, and show that distributed fragments can reconstruct the intended meaning after generation, revealing a cross-modal safety gap.
In briefMulti-layer forensic method for detecting tampered PDF documents
SummaryFree online editing tools have made it easy to alter or forge PDF documents, often without visible traces on screen. The paper proposes a two-stage forensic pipeline: a security-gating layer checks format compliance and flags embedded malicious payloads, and a forensic engine inspects internal objects such as metadata, visual overlays, and dual-source OCR consistency. A weighted scoring engine combines these indicators into an interpretable risk score. The approach was validated on real medical work-stoppage certificates.
Titouan Millet, Thomas Valade, Fran\c{c}ois Gonnet et al.
In briefVStress: Auditing and Budgeting Repeated Verifier Calls by Correlation
SummaryThe paper introduces VStress, an auditable replay contract, and VStress-CA, a correlation-aware policy that decides whether another verifier call adds conditional information and stops or abstains when it does not. In controlled tests, majority voting helped at 35% symmetric corruption but lost accuracy at 65%. At a matched fixed budget, VStress-CA achieved the highest balanced accuracy among the compared allocation methods. Dependence diagnostics rose from same-model repeats to cross-family channels.
In briefControlled decoding attacks that bypass safety alignment in black-box LLMs using only text outputs
SummaryThe paper studies how to bypass the safety alignment of large language models through interfaces that return only sampled text, without exposing token probabilities. The authors propose \method{}, a framework with three components: sample-based distribution reconstruction, risk-gated residual control, and speculative multi-token execution, which together reduce query costs. Across four target endpoints and three benchmarks, the method reports the highest mean score in most comparisons against baselines.
WhyNovel text-only decoding attack combining distribution reconstruction and risk-gated control; evaluated on four endpoints and three benchmarks, threatening deployed black-box LLM safety.
In briefPractical Secret Extraction from Black-box LLMs
SummaryThis paper presents a framework for extracting secrets, such as API keys, memorized by commercial black-box LLMs that only offer output access. The method combines cross-validated knowledge distillation into a local proxy model with proxy-guided sampling and candidate filtering. On controlled API-key benchmarks, the authors report better recovery effectiveness, higher real-key rates, and lower latency than baselines. They also state that a responsible real-world evaluation recovered masked credentials from three independently deployed systems.
In briefA continual learning method for locating image forgeries as new manipulation types appear
SummaryAs image manipulation techniques evolve, existing image forgery localization methods often fail to adapt to newly emerging forgeries. This paper introduces the first continual learning framework for this task and a benchmark under cross-dataset and cross-content data-evolution protocols, showing substantial performance degradation for current methods. The authors propose a forensic-aware adaptation framework with forensic trace mining and Fisher-weighted gradient surgery to reduce forgetting, reporting state-of-the-art results in pixel-level localization and image-level detection.
In briefSURE: A framework for defining and enforcing AI safety in trustworthy models
SummaryThe paper proposes SURE, a framework for customizing AI safety attributes and ensuring the safety defined. It builds taxonomies of adversarial prompts that could threaten AI safety and creates prompts from them, along with templates for desirable responses and an absolute safety scoring scheme. The authors then perform AI alignment on datasets to gradually improve safety, and report experiments with various base models demonstrating its effectiveness.
In briefContractWarden: Kernel-enforced limits on AI agent damage through human-approved contracts
SummaryThis paper presents ContractWarden, a Linux reference monitor that limits the operating-system damage an AI agent can cause, without trusting the agent itself. The agent may propose an allow, deny, or no_egress asset contract, but a human makes the final decision, and an eBPF LSM data plane enforces file and network rules in the kernel. Across 570 runs of 19 security tests, all runs met the predefined criteria. Measured overhead on three file-I/O workloads was lower than that of the evaluated frozen ActPlane baseline.
In briefSKILLLITE: An evidence-guided method for auditing malicious Agent Skills using compact LLMs
SummaryAgent Skills extend LLM-based agents with task-specific instructions and executable components, but third-party Skills create a supply-chain risk because malicious ones can abuse agent privileges. The paper proposes SKILLLITE, a framework that extracts security-relevant behaviors and infers intended functionality from Skill packages, then uses a compact LLM to judge maliciousness. Experiments report improved detection across several compact LLM backbones, better results than representative baselines, generalization to in-the-wild malicious Skills, and low inference latency.
In briefSafer Content or Firmer Refusals? Hybrid Defense Against Harmful Fine-Tuning
SummaryThis paper addresses how harmful data mixed into fine-tuning can weaken a language model's safety alignment. It proposes VaccineBooster, which combines embedding perturbation and weight-level gradient attenuation within one alignment procedure. On Llama-2-7B, it reports the lowest moderation score (0.315) while Booster-Only keeps the highest refusal rate (50%). The authors note the evaluation uses ten prompts and a single unseeded run, so the trade-off is an observed pattern rather than a statistically resolved result.
Muhammad Zeeshan Akram, Mufid Kamel Marican, Anvesh Reddy Yenugu et al.
In briefDoes Gradient-Based Jailbreak Detection Hold Up in Multi-Turn Conversations?
SummaryThis paper examines whether GradSafe, a gradient-based jailbreak detector designed for single prompts, works in multi-turn dialogue. The authors add a Context Window Scanner that scores fixed-size windows of user turns and uses the highest window score for the whole conversation. Performance is strong on synthetic benign conversations (ROC-AUC 0.98) but drops to 0.76 on real WildChat conversations and varies with attack type and target model.
In briefFactoring RSA Moduli via Affine-Padded Rabin Oracles at Special-Sieve Cost
SummaryThis paper revisits the Joux-Naccache-Thomé construction for the Rabin case (e=2), using an affine-padded square-root oracle that returns a single canonical root. The authors use a one-sided number field sieve to obtain congruences of squares that split the modulus with probability 1/2 per dependency, claiming complexity L_n(1/3, (32/9)^(1/3)), below the general sieve. An open-source implementation is said to confirm a performance improvement in factoring speed.
Alexandra-Ioana Buzățoiu, Diana Maimuț, David Naccache
In briefModalFidelity: a lightweight router that picks which audio or video stream to inspect for deepfakes under a fixed compute budget.
SummaryDeepfakes increasingly alter only the few seconds where a video's meaning changes, yet detectors still read every window of audio and image streams. The authors propose ModalFidelity, a lightweight router that previews each window and decides which stream to read before any forensic detector runs, never exceeding a hard compute budget. On AV-Deepfake1M, reading at most one fifth of the windows, it outperforms gating after the detectors while using 15.9x less compute, and retains over 96% of an oracle's accuracy.
Oguzhan Baser, Kaan Kale, Sriram Vishwanath et al.
In briefAgent-Warden: Kernel-level eBPF tracking of which processes and files LLM agents touch
SummaryThis paper presents Agent-Warden, an eBPF-based monitor that tracks task and file states across process creation, file access, and termination in LLM agents. In a controlled file-mediated propagation test, it reconstructed a cross-process causal chain missing from the application-layer trace. On x86-64 and ARM64 bare-metal hosts, the evaluated workloads showed 0.2-3.5% end-to-end overhead.
In briefpikit: A Toolkit for Testing Indirect Prompt Injection Attacks and Defenses
SummaryThis paper presents pikit, a research toolkit for systematically evaluating indirect prompt injection, where malicious instructions hidden in external content manipulate LLM agents. It covers 13 attack methods, 16 carriers across text and file modes, and 9 prevention strategies plus 3 offline detection baselines. In tests, the best prevention strategies reduced attack success rate by 71.8% relative, with few_shot_warning and instruction_hierarchy performing strongest. Offline detectors had perfect precision but low recall, suggesting they complement rather than replace prompt-level defenses.
In briefEpistemic Typing as a PostgreSQL Table Access Method Under Adversarial Conflicts
SummaryThis paper presents KNDB, a PostgreSQL 18 table access method that assigns each row an engine-determined epistemic kind (MEASURED, INFERRED, or DERIVED) and resolves conflicts between writes at write time. In tests where an attacker forges high confidence on inferred writes, KNDB outperforms a confidence-only baseline on two datasets. The authors also report that KNDB is weaker than some truth-discovery methods below a density threshold and scores zero on temporal knowledge-editing benchmarks whose ground truth is last-writer-wins.
Venkata Maguluri, Swapna Kommuri, Kritica Sinha et al.
In briefSurvey of attacks that slow deep learning inference and how to defend against them
SummaryThis survey reviews adversarial attacks that aim to increase inference time, energy use, or response latency rather than change predictions. It covers perception pipelines, input-adaptive neural networks, and autoregressive and agentic systems such as LLMs and tool-using agents. The authors classify attacks by the computational bottleneck they exploit and propose a work-budget defense abstraction. The paper also analyzes when added model cost becomes a system-level availability failure, along with threat models, defenses, and open challenges.
In briefEfficient library-boundary compartmentalization on CHERI hardware
SummaryThis paper presents a linkage-based model for in-process compartmentalization using CHERI memory safety, applied across the entire UNIX user space. It scales to over 10,000 compartments on desktop systems and creates 500+ compartments per process for large applications such as Chromium. Of thousands of C/C++ programs tested, only the V8 engine needed source changes. The model is implemented for CHERI-extended Armv8-A and RISC-V.
WhyAutomatic CHERI compartmentalization along library boundaries, validated on Chromium and real CHERI hardware, offers strong novelty and solid experimental evidence.
In briefUnderstanding Private Evolution as a learning-augmented clustering method for private synthetic data
SummaryPrivate Evolution is a differentially private method for generating synthetic data. This paper recasts it as Wasserstein learning augmented by a generative model, and shows theoretically that better performance bounds are possible when the generator captures some features of the true distribution. The authors find that standard PE variants can fail to converge on simple well-clustered instances, and they propose a geometry-aware version that provably converges on such instances. Experiments show the new algorithm is competitive with standard baselines and can improve recall.
In briefRefusal Localizes, Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning
SummaryThis paper studies how a few harmful training examples can strip refusal behavior from aligned language models, and whether refusal can be restored by patching hidden states at a specific layer depth. Tests on six checkpoints from four model families show that layer-freezing up to that depth keeps refusal near zero after attack. The authors also find that an attacker who spreads the update can defeat the repair, and they propose five checks for defenses against adaptive fine-tuning.
WhySystematically tests safety-layer localization and freezing defenses across six checkpoints, showing adaptive attackers can bypass them.
Jungseob Lee, Dongyub Jude Lee, Sugyeong Eo et al.
In briefSelf-Evolving Defense: Continual Security Policy Learning for LLM Agents
SummaryThis paper introduces Self-Evolving Defense (SED), a training-free framework that turns harmful agent trajectories into reusable security policies without updating model weights. It retrieves relevant policies for new tasks to adapt to emerging attacks while retaining knowledge across attack types. Tested on three open-source models and eight benchmarks covering jailbreaks, prompt injection, and insecure code generation, SED reportedly lowers AGENTDOJO prompt-injection success to 0.42% and adaptive X-TEAMING attack success on HARMBENCH to 7.8%, while preserving benign task utility.
In briefDIBench: A benchmark for whether GUI mobile agents make honest decisions under deceptive injections
SummaryThis paper introduces DIBench, a benchmark that measures the decision integrity of GUI-based mobile agents. It covers 7 commercial and 3 simulated apps and builds 8 deceptive injection probes that can steer critical selections without overt anomalies. Experiments show that completion-based evaluation can overestimate agent trustworthiness, and that common defenses yield inconsistent integrity gains.
WhyProposes a decision-integrity benchmark for in-task goal deviation in mobile agents, filling a gap beyond execution anomalies. Large-scale experiments across frameworks; impact mainly evaluative.
In briefCyberPersistBench: Testing whether AI attack agents can keep access after a break-in
SummaryThis paper introduces CyberPersistBench, the first benchmark for evaluating whether LLM-based attackers can install and maintain access after initial compromise. Agents must keep footholds across staged system disruptions using native host mechanisms, scored on a six-level deterministic scale (L1–L6) over 203 core tasks. Across five frontier agents, autonomous persistence reached only 27.6%–44.8%, falling to 5.5%–13.3% on defense-enabled tasks.
WhyFirst benchmark for post-compromise persistence with deterministic six-level scoring, evaluating five frontier agents across 203 core tasks and defense extensions.
In briefCounterSteer: Blocking Hidden Instructions in AI Agent Tool Results
SummaryIndirect prompt injection makes language model agents follow instructions hidden in untrusted retrieved text. CounterSteer is an inference-time defense that fits a direction inside the model from paired examples and subtracts it from tool-result tokens during prefill. Across five open-weights models, held-out attack success and AgentDojo compromise rates drop sharply while benign utility stays high. Attacker-chosen parameters inside legitimate calls are only partially resisted.
WhyApplies inference-time activation steering to suppress indirect prompt injection, validated across five models and adaptive attacks.
In briefImproved differential-linear attacks on Orthros, Gleeok, ZIP-AES and ZIP-GIFT
SummaryThis paper improves differential-linear distinguishers and gives key-recovery attacks on reduced-round versions of several pseudorandom functions. It extends the analyzed coverage of Orthros from 7 to 9 rounds and of Gleeok-128 from 4 to 5 rounds. The authors use automated differential and linear trail search together with existing round-based correlation estimation.
In briefInference-Layer Security: Guarding LLM Services Against Adversarial Use
SummaryThis technical report studies how providers of large language model services can defend the inference layer against jailbreaking, denial-of-service, and distillation attacks. Because no public labelled dataset of adversarial usage exists, the authors build a structural causal model that generates labelled user sessions, including coordinated multi-account campaigns. They train a gradient-boosted detector that classifies sessions as benign or malicious and by attack type. The detector scores much higher against oracle labels than against operational labels, and the dataset is publicly released.
In briefANCHOR: Context-grounded, stateful LLM investigation of system provenance for attack tracing
SummaryThis paper presents ANCHOR, a system that turns suspicious activity flagged by provenance-based intrusion detection into coherent attack narratives. It combines curated evidence with context-grounded LLM reasoning, using deployment-specific normal-behavior baselines and a confidence-gated cache that tracks attack state across time windows. The authors evaluate it on six DARPA Transparent Computing E3/E5 datasets and report better IoC recovery and attack-stage attribution than existing provenance-based baselines.
In briefFrom Reconnaissance to Response: A Risk-Based Engine for Automated Attack Containment
SummaryThis paper proposes a metrics-driven decision engine that links quantitative risk parameterization with continuous automated response time. It maps CVSS exploitability parameters to attacker success probabilities, uses FAIR Monte Carlo simulations to evaluate defender log distributions, and models SIEM logs as Poisson arrivals with Bayesian threat belief updates. The interaction is framed as a dynamic Bayesian Stackelberg game, yielding a closed-form threshold for when containment is preferred. Simulations parameterized on the 2023 MGM Resorts and Caesars Entertainment incidents show automated SOAR isolation triggered within seconds of adversarial probing.
In briefFinRT: Reusable Adversarial Prompt Generators for Testing Consumer Finance AI
SummaryThis paper presents FinRT, a framework that distills adaptive red-teaming strategies into reusable adversarial prompt generators for consumer finance, where harmless-looking queries can cause large language models to fail safety checks. Across six victim models, FinRT nearly doubles the attack success rate of the adaptive baseline Rainbow Teaming (32.9% vs. 17.2%) and increases maximum adversarial severity by 33%. It keeps semantic diversity within policy domains comparable to iterative search methods and shows high cross-model transferability.
Rikhiya Ghosh, Himanshu Kumar, Sriram Venkatapathy et al.
In briefA Trust Ledger and Execution Check for C-to-Lean 4 Autoformalization, Separating Declined from Silently Wrong Translations
SummaryThe paper presents a deterministic code-property-graph-based exporter that translates C source code into a small Lean 4 core semantics, using a three-tier correctness scheme that keeps declined translations separate from incorrect ones. Applied to the SQLite source tree, 5,222 of 8,602 functions (60.7%) translate hole-free, but only 2,134 (24.8%) are call-closed. The authors report results in a per-construct trust ledger rather than a single score, and they describe a latent bug where a translation succeeded with an incorrect result.
In briefQuantization makes private dense retrieval practical against malicious servers
SummaryDense retrieval, a core part of retrieval-augmented generation, finds relevant documents by comparing vector representations of queries and passages. The paper formalizes private dense retrieval as protecting query privacy and retrieval integrity against a malicious server, and proposes a two-round cryptographic protocol that uses low-bit quantization to keep computation practical. Across six embedding models and corpora up to 2.68 million passages, three-bit quantization with a clipped quantizer largely preserves retrieval quality and downstream RAG accuracy. A private query over a clinical-reference-sized corpus takes one to three minutes of server time.
Louis Tremblay Thibault, Sofiane Azogagh, Marc-Olivier Killijian et al.
In briefAudience-bound persistent memory: authorization across the whole memory lifecycle
SummaryThis paper studies how a personal language agent acting for its owner across private and shared conversations should authorize memory before assembling context. Each memory item records the audience present when it was made, and a memory enters a model's context only if every current viewer belongs to an authorized audience. The approach was implemented in two independent architectures and an agent-memory runtime. In a pre-registered test over 10,000 multi-party histories, no forbidden item entered any architecture's context, while unscoped retrieval exposed forbidden items in 82% of contexts.
WhyProposes audience-bound memory authorization across lifecycle; 10,000 histories showed zero forbidden leaks versus 82% for unscoped retrieval.
In briefTTMark: Pairwise Watermarking That Makes AI Text Easier to Detect
SummaryThis paper presents TTMark, a watermarking framework that extends distortion-free watermarking from single tokens to adjacent token pairs. By watermarking the joint distribution of consecutive tokens, the detector can use both token entropy and conditional entropy. Experiments across several language models and datasets report better detectability without degrading generation quality.
In briefConversable quantum fire in the standard model: quantum states that clone easily but cannot be sent by one-way classical messages
SummaryThe paper presents a construction of quantum fire, quantum states that can be efficiently cloned but cannot be transmitted by one-way classical communication. Unlike earlier provably untelegraphable constructions, which rely on an oracle, this one is based on one-shot signatures and works in the standard model. The authors introduce keyless untelegraphability and conversability, meaning fire can be transferred via two-way classical interaction. Two variants are given, supporting polynomially and exponentially many flames respectively.
In briefCalibrating Membership Inference Attacks Using Neighboring Samples
SummaryMembership inference attacks test whether a given example was part of a model's training data. The strongest current methods need reference models trained for each example, which is too costly for large models. This paper asks whether neighboring samples of the target can provide the calibration needed when only one trained model is available, without training extra models. The authors propose two ways to obtain such neighbors and show that querying an early training checkpoint sharpens the signal. Experiments on three image classification datasets and three training setups report strong membership signals and competitive attack performance at no additional training cost.
In briefDecoyTrace: Using Toxic Decoys to Actively Defend Decentralized Federated Learning
SummaryThis paper addresses decentralized federated learning, where there is no central server and malicious updates such as backdoors can evade passive parameter checks. It proposes DecoyTrace, which deploys a mobile decoy node that sends decoy challenges and dual clean and decoy models based on neighbor trust, then evaluates them with three-state semantic metrics. Once an attack is confirmed, a distributed protocol isolates the source and resets or recovers the model. Across 60 configurations on the NEBULA platform, the F1-score stays within 0.03 of the baseline on MNIST and FashionMNIST and is 0.05 to 0.10 lower on CIFAR-10, while CPU and network usage drop by up to two-thirds.
Pedro Beltr\'an-L\'opez, Enrique Tom\'as Mart\'inez Beltr\'an, Pantaleone Nespoli et al.
In briefEmpirical Study of EU AI Act Compliance Checker Tools
SummaryThis paper presents the first empirical study of automated tools that check compliance with the EU AI Act. The authors characterize 12 mainstream checkers, evaluate their legal coverage and alignment, and analyze the structure, determinacy, and actionability of their generated reports. They find that checker quality varies significantly, that the tools can serve only as early-stage orientation, and that they tend to oversimplify or omit key obligations. The paper also offers design principles for more reliable compliance-support tools.
In briefKey-gated LoRA adapter routing to block private data leakage from LLMs
SummaryThis paper introduces Locket, a framework that trains lightweight LoRA adapters, each implementing a different access policy such as full reveal, PII masking, or differential privacy. A gating module maps a learned keyed entry token to exactly one adapter, so a valid token unlocks private knowledge while a missing or invalid token triggers a redacting adapter. The authors evaluate it on Enron, ECHR, and Yelp datasets with several LLMs, reporting that correct tokens preserve perplexity and invalid tokens substantially reduce PII leakage.
In briefAdversarial debiasing of machine learning models to improve DDoS attack detection for network security
SummaryThe paper proposes a DDoS detection method that uses GAN-generated synthetic traffic data to train a Random Forest classifier. Adversarial debiasing is applied to reduce sensitivity to skewed packet-related features. The authors report 99.98 percent accuracy on benchmark data and a 22.60 percent improvement on previously unseen synthetic traffic.
Aadith Sukumar, Isha Singh, Devershika Mohane et al.
In briefPrivacy-friendly audience grouping: on-device, in-browser job-segment inference for ID-free ads
SummaryThis paper presents SIF (Sealed Inference Frame), which infers coarse professional cohorts on the user's device inside the browser and sends only a locally differentially private, taxonomy-coded label into the OpenRTB bid stream, with no cross-site identifier. It reports privacy-utility trade-offs, a re-identification simulation, and an assessment of which attributes are predictable. The authors find that company type and size are predictable, while seniority largely is not.
Om Shankar Tiwari, Navnit Shukla, Guanyu Wang et al.
In briefRendering Inputs as Images to Defend Against Prompt Injection
SummaryThe paper finds that multimodal LLMs are more likely to follow adversarial instructions delivered as text than when the same instructions arrive as images. Building on this modality gap, the authors propose Pictionary, a training-free defense that renders untrusted content as typographic images or audio before it reaches the model. Across ten models and two benchmarks, the method consistently reduces attack success rates while largely preserving benign utility, including against adaptive attacks and human red teamers.
WhyIdentifies a modality gap where text injections succeed more than image ones, proposes training-free rendering defense validated across ten models and two benchmarks.
In briefWhy Backdooring Neural Networks Is So Easy: A Theoretical Analysis Using a Quadratic Neuron
SummaryThis paper theoretically studies how much poisoned data and trigger strength an attacker needs to plant a successful, stealthy backdoor in a neural network. Using a quadratic neuron trained on a poisoned Gaussian mixture, the authors derive closed-form results showing that feature learning lowers the required trigger strength compared with lazy learning. They conclude that audits relying on linear heuristics may underestimate backdoor vulnerability in feature-learning settings.
In briefMulti-Class, Multi-Tier Network Intrusion Detection: A Reproducible Benchmark
SummaryThis paper addresses inconsistent and inflated results on the CIC-IDS2017 intrusion detection dataset by correcting PCAP-level labels and building a complete evaluation pipeline. Eleven tabular classifiers are assessed at three levels: binary attack detection, nine-class attack-family attribution, and fifteen-class fine-grained classification. A soft-voting ensemble of Random Forest, XGBoost, and LightGBM achieves the best fine-tier macro-F1 of 0.955. The configurable pipeline is released as open source.
In briefDistillation defenses can fail after reinforcement learning
SummaryThis paper studies distillation attacks that copy the reasoning abilities of closed-source language models, and the defenses against them. The authors argue that existing defenses are usually tested only right after distillation, ignoring further training with reinforcement learning. They show that simple attacks using data easily available from current APIs can match the reasoning gains of attacks that extract full hidden traces. They conclude that defenses leaking enough information to reconstruct approximate reasoning traces are likely ineffective.
Shidan Javaheri, Alexander Panfilov, Oliver Britton et al.
In briefWhen Privacy Becomes a Weapon: Doxxing and Privacy Risks on Mainland China's Social Media
SummaryThis paper studies doxxing, the malicious disclosure of personal information, in mainland China. Through semi-structured interviews with 18 survivors, the authors build a framework describing how doxxing operates in this setting. They find that platform amplification resembles Western patterns, while compulsory identity linkage, nationalist discourse, fandom culture, Confucian values and low privacy literacy create China-specific dynamics. The authors argue that protection requires constraining systemic vulnerabilities and propose recommendations for legal reform, platform design and social initiatives.
In briefTracekit: Tamper-Evident Auditing of AI Agent Intent, Reasoning and Actions
SummaryAI agents run commands, edit code, send email and move money with operators' credentials, but their logs can usually be altered. The paper presents Tracekit, an open-source tool (version 1.4.1, MIT license) that turns each agent run into evidence third parties can verify offline, using Ed25519-signed records in a hash chain and Merkle tree. Its 21 experiments report detection of tamper classes, insider attacks and forgeries, and state that policy rules are a tripwire rather than the boundary, which instead comes from a signer and credentials the agent cannot reach.
WhyCombines signed hash chains, Merkle witnessing and intent-action reconciliation for agent auditing, with many experiments, though most components are established techniques.
In briefAEBAP: An efficient elliptic-curve-based authentication protocol for wireless networks
SummaryThis paper proposes AEBAP, an authentication protocol based on elliptic curve cryptography (ECC) designed for secure communication in resource-constrained IoT environments. It aims to provide mutual authentication, data integrity, and resistance to passive and active attacks. The authors evaluate performance through experimental implementation and analyze security using informal reasoning and formal verification tools, Scyther and ProVerif. The paper reports strong security with minimal computational and communication overhead.
In briefShort proofs for quantum problems using only basic hash-function assumptions
SummaryThe paper shows that succinct arguments for QMA exist assuming only collapsing hash functions. This is the first such scheme relying only on unstructured Minicrypt assumptions, not known to imply public-key encryption. A key component is a quantum-succinct claw-state generation protocol that uses classical communication to expand a few quantum correlations into many claw-state correlations. Combined with a communication-compression compiler, this yields succinct arguments for QMA with better round complexity and a simpler standard-model proof than prior work.
WhyFirst QMA succinct arguments from only collapsing hash functions, with a simpler claw-state protocol with better round complexity and a standard-model proof.
In briefSEABench: A Benchmark for Misalignment in Self-Evolving AI Agents
SummaryThis paper introduces SEABench, a benchmark of 48 longitudinal task sequences for studying how self-evolving LLM agents, which modify their own instructions, memory, and tools after deployment, can become unsafe. Experiments across several recent LLMs show that self-evolution raises task completion rates but often causes safety failures absent in paired non-evolving baseline agents. The authors also find that safety behavior differs across evolution surfaces and harm types, and that these differences appear in chain-of-thought reasoning, enabling a monitoring strategy that mitigates unsafe behavior with a low false positive rate.
Saswat Das, Parvati Viswanathan, Daniel Donnelly et al.
In briefAI Virus Spreading via Shared Files Between LLM Agents
SummaryThis paper studies how large language model assistants that share persistent artifacts, such as reports, can unintentionally pass adversarial content between one another. Malicious content is stored in an assistant's memory, reproduced in later artifacts, and picked up by other assistants. The authors simulate artifact exchange among independent assistants to measure survival across hand-offs, hop count, and spread. They report that attacks propagate across multiple assistants and reach 60-80% of agents in larger simulations, with chains extending to eight hops.
WhyIntroduces a new artifact-mediated self-propagating attack model and shows multi-hop spread in simulated agent populations, though experimental scale is limited.
Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik et al.
In briefThe Compiler May Read It, the Agent May Not: Isolating Parts of Research Code from Coding Agents
SummaryThe paper notes that a physics-based solver needs its compiler to read certain modules to build, yet a coding agent must not access that proprietary code. The authors classified fifteen read routes against a container, permission rules, and a sandbox. They found that none of the three mechanisms can tell which program is doing the reading.
In briefINTCC: A framework enabling interactive work inside confidential computing environments
SummaryThis paper proposes interactive confidential computing, a model that lets untrusted data processors run dynamic, human-guided operations inside Trusted Execution Environments while keeping data confidential. The authors split the TEE into an interactive controller and a verifiable runtime, and implement the INTCC framework on AMD SEV-SNP using Confidential Containers. Reported experiments show overhead below 5% for LLM fine-tuning and under 17% for data analysis compared with baseline execution.
In briefDetecting Fake Data Attacks and Unstable Operation in Smart Grids Using Graph Learning
SummaryThis paper introduces StarGNN, a graph learning framework that learns the stable operating region only from clean stable configurations. It uses a single abnormality score to flag reported configurations that should not be trusted, covering both real instability and false data injection attacks. Each configuration is modeled as a producer-consumer star graph, and physics-constrained pseudo-negatives are generated by perturbing reaction time and price response parameters. On nine unseen attack scenarios, the method detects 0.780 to 0.973 of attacks on stable configurations and keeps post-attack instability recall between 0.972 and 0.999.
Emad Efatinasab, Denis Donadel, Mirco Rampazzo et al.
In briefBeyond Scalar Probes: Using Vector Outputs of ReLU Networks to Extract Signatures
SummaryThis paper revisits cryptanalytic extraction of ReLU networks from a geometric and algebraic perspective. Instead of examining a single output component, it studies the full vector-valued behavior across adjacent linear regions and characterizes Jacobian differences as rank-one, recovering row-signature information along with complementary column-side information. Experiments show this extra structure can aid extraction and improve numerical estimation under float64, float32, and float16 precision. The analysis is extended from high-precision, output-rounding settings to low-precision settings common in practice.
In briefUsing LLMs to Automatically Prove Security of Cryptographic Protocols: Current Capabilities
SummaryThis paper systematically evaluates how well state-of-the-art large language models assist in verifying cryptographic symbolic protocols. It introduces CRoST (Coverage Rate of Solve Tree), a proof-based metric that measures how similar generated lemmas are to reference lemmas. Models achieve 38.82% coverage on average, and 14.4% of generated lemmas exceed 80% coverage. However, the models show failures on complex multi-phase protocols, diminishing returns from naive scaling, and substantial verification overhead.
In briefIndistinguishability of permutation sums via Fourier analysis for classical and quantum security
SummaryThis paper studies whether sums of independent random permutations, and related constructions, can be told apart from random functions under classical and quantum query models. It uses a unified Fourier analytic approach to derive query-dependent security bounds in both models. The authors also analyse linear postprocessing over binary vector spaces and Dinur's variable-output single-permutation construction.
In briefAI-Based Vulnerability Assessment and Cyber Attack Graph Analysis
SummaryThis paper combines two methods for assessing cyber risk to critical infrastructure. One uses multi-agent reinforcement learning over a cyber knowledge graph to identify attack vectors and TTPs; the other is a probabilistic attack graph model that computes system-level risk from network topology and vulnerabilities. Applied independently to the same operational technology network and validated against the 2015 Ukraine power grid attack, both methods matched the documented attack vectors. The authors find industrial control systems to be the most critical enablers of attack propagation, making them priority targets for hardening.
Joni Herttuainen, Kirsi Hellsten, Vesa Kuikka et al.
In brief"Nothing to See Here": Accidental Leaks via LLM Revision Traces
SummaryThis paper studies how LLM assistants can unintentionally reveal information they were asked to remove, by restating the deleted item when describing the edit. An analysis of public conversation corpora found revision traces in 8.8% of revision requests. Using the new RevLeakBench benchmark, the authors found that about half of deliverables state the edit, and a reader seeing only the deliverable could recover the withdrawn item in about 13% of them. The paper also compares prompt defenses and proposes an output-side filter that sharply reduces recovery.
In briefPrivacySkills: How Privacy Guidance Shapes Which Information Sources LLM Agents Pick
SummaryThis paper introduces PrivacySkills, a controlled framework for testing how LLM agents choose among ways to obtain the same task information, such as public personal data, confidential sources, or asking the user. It uses 55 synthetic tasks and 169 skills, comparing system-level instructions with skill-level privacy labels. Without privacy guidance, agents accessed confidential sources in 30% of valid runs, rising to 45% when users were unavailable, while urgency framing had no detectable effect. Combining system instructions with skill-level labels roughly halved confidential access.
Lucas Biechy, C\'edric Eichler, H\'eber H. Arcolezi et al.
In briefPlanarian: Managing Agent State with Statepoints
SummaryThis paper presents Planarian, an agent runtime that manages state using restorable point-in-time versions of the environment called statepoints. It offers snapshot, rollback, and fork primitives so agents and users can undo erroneous actions and explore alternatives in parallel across local and remote state. Remote state changes are reverted through recorded compensating actions. The authors report task quality improvements of up to 15x and only 3% overhead for users recovering from errors.
In briefEmulating Hybrid QKD and Post-Quantum Networks Automatically in the Cloud
SummaryThis paper extends Quditto, an open-source emulator originally built for quantum key distribution (QKD) networks, to support hybrid networks that combine QKD with post-quantum cryptography (PQC). The platform adds a cloud-native orchestrator, an optimized provisioning workflow for large deployments, native post-quantum nodes, and a secure key management module. Experiments on a representative spine-leaf deployment show that orchestration time scales sublinearly with network size and that end-to-end hybrid key establishment succeeds.
Iv\'an Melijosa, Javier P\'erez, Borja Nogales et al.
