In briefSafe Prototypes Versus Safety Directions in Response Embeddings
SummaryThe paper tests whether response safety can be scored by cosine similarity to the mean embedding of known-safe responses. Across two human-labeled corpora and one jury-labeled control, using four frozen encoders and prompt-grouped splits, the safe prototype performs weakly or inverts. An explicit safe-minus-unsafe reference performs substantially better. The authors also show that prompt-label composition can inflate uncontrolled evaluations.
In briefLearned eavesdropping attacks on quantum key distribution under channel noise and device drift
SummaryThe paper studies whether an eavesdropper can gain by adapting to slow drift in QKD channel noise, which the attacker cannot control. Adaptive eavesdropping is modelled as a constrained Markov decision process, and reinforcement learning jointly searches circuit structures and rotation angles. Across several noise models and protocols, the learned attacks outperform the best fixed circuit and approach a dynamic-programming upper bound.
Marcel Mordarski, Benjamin Gras, Abdelrahman Shehata et al.
In briefSAGE: Cleaning Poisoned Training Data Using Similarity to a Small Verified Set
SummaryData poisoning attacks insert malicious examples into training data to make models misclassify a chosen target, a growing risk as machine learning relies on untrusted public data. The paper proposes SAGE, which uses a small set of expert-verified clean and poisoned examples, a generic feature extractor trained on a separate dataset, and similarity-weighted non-parametric prediction to flag poisoned training examples. On standard benchmarks against seven clean-label attacks, even a handful of verified poisoned examples gives a substantial advantage. The authors also find that how verified clean examples are distributed across classes matters more than their number.
Chaeeun Han, Soodeh Atefi, Yevgeniy Vorobeychik et al.
In briefQUFIG: Predicting Quantum Fault Injection Weak Points Gate by Gate with GNNs
SummaryThe paper addresses run-time fault injection attacks on cloud quantum computing platforms, which existing methods cannot locate at gate-level precision. It proposes QUFIG, a circuit-DAG-based graph neural network that predicts how each gate-fault pair affects circuit fidelity and ranks pairs by vulnerability score. Experiments on QASMbench and HamLib MaxCut reportedly find high-impact pairs with fewer inspections than random or depth-based heuristics, reducing gates needing inspection by 2.9 to 19.8 percent.
In briefThe Innocent Courier: A study on secretly leaking data by abusing an LLM's web-fetch tool
SummaryThe paper presents LLMLeak, an attack in which locally running malicious software that cannot reach the internet abuses an LLM's web-fetching tool to create a covert channel. The secret is embedded in a URL that is fetched by the model, and the attacker receives it through a server they control. Evaluated on eleven open-parameter models, the attack reached a 79.7% success rate, and a case study on real-world chatbots was also conducted.
WhyIntroduces a novel covert exfiltration channel via LLM web fetching, with 79.7% success across eleven models and real chatbot case studies.
Alessandro Pegoraro, Daryan Merx, Phillip Rieger et al.
In briefSoK: Where End-to-End Guarantees Break in Decentralized Agent Economies
SummaryThis paper systematizes the security and economic requirements for a single agent task across its full lifecycle, organizing them into 17 property families over six stages. It examines 12 systems and standards, five mechanism families, and four classical baselines, and introduces a guarantee closure criterion to test whether earlier guarantees stay available for later decisions. Using 840 matched executions and an exhaustive check of 11,648 cases, the authors find recurring failures between verification and settlement, such as conforming work left unaccepted or valid evidence ignored.
In briefOptical side-channel attack exposing plaintext configuration data on AMD 7-Series FPGA ICAP
SummaryThis paper implements a proof-of-concept of an AMD-proposed asymmetric-key bitstream encryption scheme for 7-Series FPGAs using partial reconfiguration, and analyzes its security implications and hardware overhead. The authors propose an optical side-channel attack combining Photon Emission Microscopy and Electro-Optical Probing to locate and contactlessly extract plaintext configuration data from the ICAP interface. They locate the ICAP buses on an XC7A200T device and show the data can be extracted with Electro-Optical Probing. They argue that advanced schemes using partial reconfiguration remain vulnerable to such attacks.
WhyProposes an optical side-channel attack extracting plaintext bitstream from ICAP on XC7A200T, a broadly impactful FPGA security finding with partial validation.
Antonio Saavedra, Jan Caspar Marx, Lars Renkes et al.
In briefiX3DH: A Post-Quantum, Subversion-Resilient X3DH Key Exchange Built on Isogenies
SummaryThis paper addresses the risk that devices used for secure messaging can be compromised by malware or supply-chain attacks, which would undermine Signal's X3DH handshake. It proposes iX3DH, a post-quantum X3DH-style protocol based on commutative group-action Diffie-Hellman, whose public values can be re-randomized by a reverse firewall to remove subliminal information. The authors prove authenticated key exchange security in the QROM and show the firewalls are exfiltration-resistant. They also construct IBIS, a candidate post-quantum unique signature scheme, to prevent covert channels in signatures.
WhyExtends reverse-firewall X3DH to post-quantum isogeny group actions and constructs the first candidate PQ unique signature; strong novelty, proofs given but no experiments.
Tako Boris Fouotsa, Trey Li, Bernardo Magri et al.
In briefCombining encryption and differential privacy in federated learning for safer model checks
SummaryThis paper proposes a federated learning framework that uses homomorphic encryption during training and differential privacy for model inspection and release. The authors estimate privacy with a Markov chain Monte Carlo-based Bayesian method. On the FEMNIST dataset, the framework reached a test loss of 1.09 versus 2.37 for differential privacy alone, with an estimated posterior mean privacy parameter ε of 4.32 versus 7.26.
Ceren Y{\i}ld{\i}r{\i}m, Kamer Kaya, Sinan Y{\i}ld{\i}r{\i}m et al.
In briefContext-blind, device-bound anonymous credentials built from signatures and proofs
SummaryThis paper presents a modular construction of context-blind device-bound anonymous credentials, where each presentation requires fresh secure element (SE) participation without revealing its context to the SE. The construction combines a position-binding vector commitment, a signature scheme, a round-optimal blind signature, and a non-interactive zero-knowledge argument, with proofs of correctness, one-more unforgeability, unlinkability, and SE-obliviousness. The authors instantiate it with CAPSS and Griffin/Jive Merkle commitments, reporting timings and proof sizes for 16 attributes and four disclosures using the Longfellow Ligero backend and an Aurora backend. It is presented as the first concrete construction assembled entirely from plausibly post-quantum components.
Mark Manulis, Alan Pulval-Dady, Daniel Slamanig et al.
In briefIntegrating Physical Layer Deception into EAP-TEAP Wi-Fi Authentication
SummaryThe paper notes that credential-based EAP authentication cannot tell a legitimate holder from an attacker using compromised credentials. The authors add a batched Physical Layer Deception (PLD) re-verification step to the Enterprise Wi-Fi TEAP/RADIUS/IEEE 802.11 chain, implemented end to end in the open-source hostap 2.12 codebase. Across 1593 attempts, the prototype rejected all 30 attempts by the implemented naive credential-bearing attacker and evaluated the security-reliability trade-off for one to three active rounds.
In briefChaining Skills to Hijack LLM Agents: how attackers can use linked agent skills to steer AI actions
SummaryThe paper notes that LLM agents often run several skills in sequence, so output from one skill can shape later decisions, and skills from open-source repositories may carry attacker-controlled claims. The authors introduce APEX, a method that builds and refines adversarial skill chains for a given user task and an attacker-chosen action. On SkillsBench across four targeted-action families and six models, the chains induced the selected action in 512 of 690 attempts (74.2%). A prompting defense reduced attack success on GPT-5.4 but also substantially lowered the test-pass rate on benign tasks.
WhyIntroduces cross-skill chaining attacks on LLM agents, showing higher success than merged skills across six models, with moderately broad experiments and a defense trade-off.
In briefFalse Floors: A paper showing LLM safety routing evaluations break under distribution shift
SummaryThe paper argues that a major safety routing benchmark selects its comparison model using the evaluation data, which inflates the apparent benefit of routing under distribution shift. The authors measure this bias on HELM Safety and AgentDojo and find it grows under held-out category splits. They recommend evaluating routers under shift against a baseline chosen without test labels.
In briefOverAct: Measuring and Mitigating Excess Data Access by LLM Tool-Calling Agents
SummaryThis paper studies how LLM agents that call external tools can retrieve more private user data than a request needs, a behavior the authors call proactive over-authorization. They introduce OverAct, a benchmark across eight privacy-sensitive domains, and find that all seven tested models exceed their authorized scope. They also propose SelfAudit, an inference-time method that filters unjustified tool calls before execution, reducing privacy-oriented excess by 43%.
In briefDeniable Secret Sharing: Toward Practical Faking
SummaryThis paper studies deniable secret sharing (DSS), where shareholders can be forced to reveal their shares and can use a faking function to produce fake shares that look real but reveal nothing extra about the secret. It analyzes two properties of the faking computation: how much the fakers learn about the secret, and how many messages they must exchange. The authors show that information-theoretic constructions need a nonzero number of messages, and give a general construction matching this bound in many cases, such as threshold structures. For computational settings, they present two constructions requiring no interaction beyond knowing who the fakers are.
Ignacio Amores, Tamar Ben David, Matteo Campanelli et al.
In briefNonce misuse resilience of GCM using Rijndael-256-256 (GCM-256 proposal)
SummaryThe paper examines the weakness of GCM when nonces are reused, a problem that matters in distributed systems. It notes that NIST is considering Rijndael-256-256, but a larger block size alone does not prevent the effects of nonce misuse. The authors propose GCM-256, which uses the discarded half of the block cipher output as the GHASH key, and show it stays secure for fresh nonces even when nonces are misused.
In briefKey-reuse weakness in phase-keyed Fourier-curve modulation: leakage and key-refresh cost on coded links
SummaryThe paper argues that judging such keyed modulation by key-space size and a keyless receiver's error rate is insufficient, since reusing keys with harmonically coupled waveforms leaks information. Using integer relations among harmonic indices, the authors build an attack that recovers the key without enumeration. With one key per codeword on an LDPC-coded link, the attack meets a predeclared compromise criterion at most tested operating points. The paper also evaluates artificial noise countermeasures and the key cost of different refresh schedules.
In briefRobust, leakage-resilient device-independent oblivious transfer from post-quantum one-way functions
SummaryThe paper builds device-independent oblivious transfer and bit commitment from post-quantum one-way functions, with honest parties using only trusted classical computation to operate untrusted quantum devices. Security is simulation-based against quantum polynomial-time adversaries. The protocol tolerates a constant rate of honest-device faults in one regime and an inverse-polylogarithmic rate under polylogarithmic qubits of adaptive leakage in another. Since oblivious transfer is complete for secure computation, this yields a device-independent protocol, with abort, for any efficiently computable classical functionality.
WhyConstructs device-independent oblivious transfer and commitment with simulation security under two leakage models, plus a parallel-repetition bound for Magic Square.
In briefEvidence coverage for intent-bound execution: scope, obligations, and cutoff reasoning
SummaryThis paper presents an analytical model for checking retrospectively whether declared execution-evidence obligations were covered. A verifier may authenticate every available record yet still lack grounds to call an execution account complete, so it must justify which records were due. The authors separate closure of the obligation inventory from closure of the relevant verifier view and define three reporting results: COMPLETE_WITHIN_SCOPE, INCOMPLETE, and UNKNOWN. Completeness is conditional on the declared obligation profile and assessment premises.
In briefCan system-wide keys create irreversible face templates that still allow duplicate detection?
SummaryThis paper asks whether PolyProtect, a biometric template protection method, can produce irreversible protected templates from face embeddings when all subjects share the same system-specific keys (C and E parameters) instead of individual keys. Such sharing would allow identity de-duplication in the protected domain, which individual keys prevent. The authors report experiments showing at least three systematic ways to select system-specific keys that yield irreversible templates, concluding this is feasible without weakening protection.
In briefHigh-quality Data Do Not Mean Safe: Poisoning LLMs After Data Selection
SummaryThis paper studies how safety-aligned large language models can be compromised by fine-tuning on small sets of harmful or benign-looking data, even after quality-based data selection. The authors find that selection removes many overtly harmful samples, but some retained high-quality samples can still degrade safety alignment. They propose Bi-QSTO, a method that optimizes poisoned samples under a quality constraint so they survive selection while keeping their safety-degrading effect. Even at 90% filtering, harmful-seeded samples reach a retention rate above 90%, and the attack transfers across models.
In brief"Sleeping Secrets": How Fine-Tuning Can Revive Privacy Risks in Language Models
SummaryThe paper shows that fine-tuning a large language model can recover private information it previously learned but can no longer reveal through direct queries. The authors propose ReGap, a data-free attack that uses task structure to generate candidates, filters them by answer-token likelihood, and updates the model via low-rank adaptation. Across six GPT-2, OPT, and Qwen3 models, ReGap improves target-association recovery by 6 to 21 percentage points over the post-training target model.
In briefPACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
SummaryThis paper addresses the risk that tool-using large language model agents can be steered by poisoned tool metadata, retrieved pages, memory, or reusable skills, since vetting artifacts before admission does not fully solve the problem. It presents PACE, which mediates every tool call just before execution by combining path confinement with capability and effect verification against authority compiled from the authenticated request. On eight executable agent-security benchmarks across three model families, the evaluated configuration achieves the strictly lowest attack success in 62 of 79 eligible attack columns and ties in 14, with full-benchmark native utility losing at most three points.
WhyProposes execution-time provenance and capability enforcement before tool calls, validated across eight agent benchmarks, three model families, and a full ablation study.
In briefRe-aggregatable multisignatures without hop hints: constructions and lower bounds
SummaryThis paper studies multisignatures, which compress signatures on a common message into one aggregate, when aggregation happens over multiple hops with overlapping partial aggregates. The authors prove that idempotent multisignatures allowing unrestricted overlapping aggregation must have signature size linear in the number of signers. To avoid this bound, they propose unique multisignatures built with incrementally verifiable computation, which keep signatures constant-size. Using this primitive in authenticated Dolev-Strong Byzantine Broadcast yields two-round termination with an honest sender and reduces communication from O(n^3) to O(n^2).]
WhyIntroduces idempotent multisignatures with a proven linear size lower bound and constructs constant-size unique multisignatures, a substantial theoretical advance with limited empirical validation.
In briefSelectively Disclosable Watermarks for Generative AI: Proving One Output Without Revealing Others
SummaryThis paper proposes a cryptographic watermarking method for generative AI that hides a mark identifying outputs as machine-generated without affecting output quality. By default only the model owner can detect the watermark, and the owner can issue a short token certifying any single output to third parties while other outputs stay undetectable. The authors formalize two new security properties alongside existing ones and prove their construction, built on prior work, satisfies all four. It applies broadly to autoregressive models, including LLMs.
In briefJambon: Low-Communication Asynchronous Universally Composable Threshold FHE
SummaryThis paper presents Jambon, a threshold fully homomorphic encryption scheme that splits decryption authority among several parties. It applies deterministic rounding to partial decryptions to reduce the modulus used for decryption responses, and bounds setup and decryption errors separately. The authors prove exact recovery for BFV, extend the approach to CKKS under an extra condition, and claim universally composable security against static malicious corruption in the random-oracle model. Under the stated parameters, numerical decryption responses are reported to be at least 60% smaller than those of the updated KLL+26 construction, excluding proof and setup traffic.
In briefGNSS Spoofing in Smartphones: A Survey of Effects and Defenses
SummaryThis survey examines how smartphone GNSS receivers, which rely on weak satellite signals, can be attacked by jamming and spoofing, with spoofing forging signals to produce false location results. Because existing surveys do not address the hardware limits and restricted access to the receiver processing chain in phones, the paper focuses on countermeasures feasible on mobile architectures. It proposes a taxonomy of attack effects and defenses, reviews historical smartphone vulnerability studies, and compares detection and mitigation techniques by their pros and cons on mobile platforms.
In briefAutomated Detection of Open-Source Software Threats Using Taxonomy-Aligned Large Language Models
SummaryThis paper proposes a large language model framework that automatically detects and classifies open-source software supply chain threats into five attack categories. The authors build a dataset of 999 verified real-world incidents from 2018 to 2026 across eight package ecosystems. Using taxonomy-aligned prompting with GPT-4, the framework reports 97% accuracy and 97% macro F1, and the authors find taxonomy alignment matters more than model scale or fine-tuning.
In briefA framework that reorganizes system call logs to better detect host intrusions
SummaryThis paper addresses host intrusion detection, where system call sequences from different processes are interleaved, making attack patterns hard to find. The proposed ReSHID framework reconstructs semantically continuous sequences using syscall semantic invariants and file descriptor lifecycle tracking, then uses GATv2 on a subject behavior graph to capture multi-subject attacks. The authors report that it achieves the best F1-score (98.64%), ROC-AUC (99.80%), and PR-AUC (98.10%) among compared methods, with about 75.2% and 44.1% fewer n-gram features than raw sequences and MGFE.
In briefReCast: Privacy protection for remote multimodal reasoning on charts and speech
SummaryReCast is a plug-in framework that replaces sensitive content in charts and speech locally before sending them to a remote multimodal model, while keeping task-relevant relations and the required input format. On 4,000 held-out ChartQA and NMSQA examples, it reaches 75.10% accuracy, retaining 92.43% of the accuracy of unprotected remote reasoning. A model-based audit still flags source-content leakage in 7.95% of solver-bound requests.
In briefA subexponential algorithm for binary LWE needing fewer samples
SummaryThis paper studies Binary LWE with polynomial modulus when the number of samples is linear. It gives a randomized algorithm that distinguishes LWE-style pairs from uniformly random pairs, with expected time and space exp(O(n/log log n)). The authors use a new instantiation of auxiliary superlattices in the Gaussian-Wagner framework, combined with an Aharonov-Regev Fourier distinguisher, to achieve a sublinear number of samples.
WhyReduces the sample count of a subexponential binary LWE algorithm to sublinear via new superlattice instantiation and rigorous dual-minimum analysis.
In briefFrom Mathematical to Executable Certificates for Machine Unlearning: a release-time check that verifies removed-data models match retraining.
SummaryThis paper addresses the gap between mathematical guarantees for machine unlearning and the concrete finite-precision artifacts that are actually deployed. It introduces ExecCert, a release-time layer that certifies the candidate artifact, using either the method's native certificate or Retraining-Reference Release Verification (RRV). For frozen representations with a mutable ridge head, the authors develop an incremental RRV that maintains evidence across sequential deletion requests. Experiments report that RRV eliminates false releases caused by stored-equation verification and that incremental certification is cheaper when release checks are frequent.
In briefFast Models, Slow Evidence: Evaluating Quick Decision Models for LLM Agents
SummaryThis paper compares two fast single-pass decision models, an open-weight model (Laya) and a hosted model (Jev), across 11 decision points typical of LLM agent systems, using 7,283 base cases and 6,640 robustness variants drawn from 18 public sources. Jev is significantly more accurate on 9 of the 11 decision points, while Laya changes 30% of its answers when option order is reversed and degrades with many similar candidates. The authors also audit their own pipeline, identifying analysis errors and a design confound that distorted headline deployment-savings claims.
WhyPaired evaluation of two System-1 models across 11 decision points, with self-audit of errors; strong evidence but largely standard benchmarking.
In briefBuilding Trustworthy Household Robots Through Open-World Safety
SummaryThis position paper argues that foundation models let household robots handle more objects and instructions, but cluttered, changing homes expose them to unfamiliar situations. The authors call for open-world safety, meaning robots should keep specified safety requirements even in unseen situations, including when they cannot complete a task. They propose a research agenda to specify, learn, and ground safety requirements, enforce them with reliable recovery, and evaluate how well these protections generalize.
In briefJev-IDS: System One Models for Network Intrusion Detection
SummaryThis paper presents JEV-IDS, an open experimental network intrusion detection system built on the Jev System One Model to detect zero-day attacks when labeled data is scarce. It analyzes one network flow per request, outputting an attack probability and a finite-choice traffic category. On a 300-flow NSL-KDD pilot split at k=1, it reached an F1-Score of 0.859 and novel-attack recall of 0.838, and was faster and cheaper than GPT-5.6 Luna.
In briefSafety must persist through self-improvement: why failures linger and how agents recover
SummaryThis paper studies whether agents undergoing recursive self-improvement (RSI) can keep their safety across generations. Using a controlled testbed of stateful authorization tasks, fixed LLM editors optimize executable agent components while independent traces record their effects. When a new authorization dependency invalidates earlier tested optimizations, historical scores keep unsafe programs in many histories, and refreshing scores restores correctness on the original suite but leaves residual failures on independently composed tests. Full validation with validated rollback ends with fully correct programs in the core trajectory study while retaining over 43% deployment savings.
In briefMOMAT: A Low-Power Multi-Atlas Framework for Jailbreak Defense in Quantized LLMs
SummaryThe paper notes that quantizing large language models for edge devices weakens their safety alignment, making them vulnerable to jailbreak attacks. It proposes MOMAT, which groups harmful and benign samples into semantic "atlases" and combines retrieval-augmented guarding with a lightweight Mixture-of-Experts detector. A compute-in-memory similarity engine accelerates retrieval, and the authors report large energy reductions over DRAM-based baselines while matching state-of-the-art defense performance.
In briefDevice-independent group keys via parity-extended non-local games
SummaryThis paper studies device-independent conference key agreement, where a group of parties builds a shared secret key using untrusted quantum devices, with security certified by non-locality. The authors introduce Parity-G games, which extend any two-player game to N players, so that security follows from analyzing the two-player game alone. Applying this to the Magic Square Game yields the first DI-CKA protocol based on a pseudo-telepathy game, which the authors prove secure against coherent attacks.
WhyGeneralizes any two-player nonlocal game to N players and gives the first pseudo-telepathy-based DI-CKA protocol, proven secure against coherent attacks.
Suvradip Chakraborty, Ronak Ramachandran, Aniruddha Sen
In briefHelol Tunnel: a covert channel abusing TLS extensibility and privacy features
SummaryThis paper proposes the Helol tunnel, a covert channel that hides data by rearranging cryptographic information elements in TLS Client Hello packets. It exploits anti-ossification measures that push middleboxes to preserve Client Hello parameters, and applications varying their configurations to resist fingerprinting. The authors demonstrate that the approach can evade next-generation firewalls with interactive proxies and comprehensive threat protection. Using real traffic captures and public TLS fingerprinting data, they numerically show it outperforms state-of-the-art TLS-based covert channels.
In briefABSENTIA: Finding Broken Access Control Bugs in Web Apps
SummaryThe paper presents ABSENTIA, a framework that guides general LLM agents to systematically audit web application backends for broken access control vulnerabilities. The agents first map application routes to their backing code, then check each route by inferring the authorization properties the code should enforce and reporting unenforced ones for maintainer review. The authors also release BAC-Bench, a benchmark of 30 access control advisories published in 2025 or later, each paired with its fixing commit.
WhyProposes route-wise invariant falsification with LLM agents and a new fix-paired benchmark; comparisons against CodeQL, Semgrep, and an unstructured agent provide reasonably strong evidence.
In briefDeBERTa-ConPara: Detecting AI-Generated Text Robustly Against Attacks
SummaryThis paper presents DeBERTa-ConPara, a detector for AI-generated text that combines attack-aware Unicode preprocessing with a contextual transformer encoder trained on HC3 Plus, M4, MAGE and RAID. The authors find that preprocessing has opposite effects depending on placement: normalising training data removes adversarial examples, while normalising at inference is an effective defence. The best setup, raw training with normalised inference, reaches 99.61% AUROC on the official RAID hidden test. The paper also reports two negative results.
In briefKettle: Short Post-Quantum Threshold Signatures Based on the HAWK Scheme
SummaryHAWK is a lattice-based signature scheme that was a third-round candidate in NIST's additional post-quantum signature call. This paper argues that HAWK's design is well suited to multi-party computation (MPC) and is not affected by a publicized AI-driven cryptanalysis result. The authors present Kettle, a UC-secure threshold signature protocol that outputs standard-compliant HAWK signatures and scales to any number of parties. It reports lower online round and communication costs than threshold protocols built on ML-DSA or Falcon, with as few as 2 online rounds and about 2 kB online communication per party.
Calvin Abou Haidar, Daniel Escudero, Thomas Espitau et al.
In briefMasked Knuth–Yao sampling: a side-channel-resistant way to sample lattice-crypto noise
SummaryThis paper presents the first masked implementation of the Knuth–Yao sampler, a generic building block for discrete Gaussian sampling in lattice-based cryptography, designed to resist side-channel attacks. By evaluating the sampler's tree structure as a bitsliced Boolean circuit, it requires exactly L − 2 masked AND gadgets, where L is the total Hamming weight of the target distribution's probability expansions. On ARM Cortex-M4, it outperforms the state-of-the-art masked CDT approach at masking orders 1 to 5, running up to 2.3 times as fast at order 1.
In briefNon-interactive proof scheme that hides which witness is used, built from targeted hitting-set generators
SummaryThe paper studies targeted hitting-set generators (HSGs), tools from pseudorandomness and derandomization, and uses them to soundly instantiate the Fiat–Shamir transformation in the plain model against uniform PPT adversaries. Combining this with the MPC-in-the-head technique, the authors give a black-box construction of a non-interactive witness-indistinguishable commit-and-prove scheme. The construction relies on an injective one-way function with efficiently recognizable range and a sufficiently strong targeted HSG.
In briefAuraForge: Scaling security supervision to train safer coding agents
SummaryThis paper introduces AuraForge, a method that synthesizes and validates executable security tests to train secure coding agents. The authors built AuraGym, a training gym of 679 feature-implementation tasks from 344 real-world repositories across Python, JavaScript, and TypeScript, covering 177 CWE categories. On a subset with human-written security tests, AuraForge produced about 3 times as many tests and cut the false-positive rate by 83.23%. Training Qwen3.5-4B with synthesized tests yielded larger gains than with human-written tests on three languages.
In briefDo LLM Extraction Defenses Hold Up Against Different Attacks? A Benchmark for Black-Box Model Extraction
SummaryThe paper introduces a unified benchmark covering six extraction attacks, ten defenses, and two adaptive attacks that paraphrase or back-translate protected responses before training surrogates. It controls model configurations, query data, budgets, and evaluation conditions within each comparison. Measurements include surrogate capability, fidelity to the victim, output quality via Rep-4, and sensitivity to query budget.
In briefRandomized early-stopping Byzantine agreement protocol and its use in round-efficient MPC
SummaryThis paper studies synchronous Byzantine Agreement (BA), combining the benefits of expected constant-round and early-stopping protocols. The authors present a compiler that lifts a broad class of expected-constant-round BA protocols to also achieve O(f) worst-case rounds, where f is the actual number of corrupted parties. The results extend to parallel broadcast (interactive consistency) and yield an MPC protocol with constant expected rounds and O(f) worst-case rounds.
WhyA general compiler gives expected constant-round Byzantine agreement near-optimal O(f) worst-case rounds, extended to parallel broadcast and MPC.
In briefSafeDepth: Safety-Aware Token-Level Adaptive Computation for Transformers
SummaryThe paper finds that token-level adaptive models that skip Transformer layers to save computation produce more harmful responses than their original backbones, with safety effects depending on which layers are skipped and when. The authors propose SafeDepth, a lightweight plug-in framework using a router and adapter to select layer execution, trained jointly while the pretrained backbone stays frozen. On Llama-3-8B-Instruct, SafeDepth lowers unsafe-response rates compared with FlexiDepth across five harmful-request benchmarks and reduces the XSTest false-refusal rate from 12.0% to 4.0%.
In briefSapien: A stateful policy engine that restricts what autonomous AI agents can do with tools based on their history.
SummaryThis paper presents Sapien, a policy engine that constrains AI agent tool calls by checking them against task-specific policies that account for what the agent has already done. Policies are written as regular expressions extended with stateful predicates, deferred policy generation, and scoped semantic checks. The authors report that Sapien keeps utility within a few percent of an unconstrained agent and blocks 93-95% of attacks on AgentDojo and 62-85% on Toolathlon, roughly twice as many as tool allowlists on long-horizon tasks.
Corinn Tiffany, Wen Zhang, Eugene Bagdasarian et al.
In briefA Kleptographic Attack on CSIDH (a method where a tampered device leaks key information)
SummaryThis paper describes an attack scenario against the CSIDH isogeny-based cryptosystem in which a subverted device of Alice leaks her shared curve with Bob through the public curves she publishes in later CSIDH sessions. The authors adapt the Young-Yung kleptographic attack from classical Diffie-Hellman to CSIDH, using the Goldreich-Levin theorem and rejection sampling. They prove that such a public curve remains computationally indistinguishable from an honest one, relying only on the computational assumptions underlying CSIDH itself.
In briefIdentity-Bound Governance for LLM Agent Halts: An Accountability Proof Block
SummaryThis paper addresses a case where an LLM agent has detected a persistent observability or drift failure and cannot itself decide who may resume, deny, or recalibrate it. It proposes an Accountability Proof Block, combining a system-built evidence block and a human decision block signed with ed25519 by a registered principal. The authors prove four theorems and report experiments over 3,812 halt events, 1,800 attacks, and six open LLMs, concluding that the drift threshold must be measured per deployment.
In briefCustom-Designed Image Watermarks: Composing Methods to Meet Specific Requirements
SummaryThe paper proposes TAILOR, a framework that composes multiple image watermarks according to a user's request, balancing attack resistance, false-positive rate, image quality, and latency. It first measures each fragment's performance as response curves offline, then uses an SMT model to select the lowest-distortion composition, and finally calibrates on the user's images. Across 7,321 requests, five scenarios, and 20 attack settings, it reports 96.21% scenario-averaged request satisfaction and a mean PSNR of 41.02 dB.
WhyComposing complementary watermark fragments via SMT solving with live calibration is a fresh approach, backed by large-scale experiments over 7,321 requests and 20 attacks for provenance use.
In briefCrossing the Cyber Divide: Transferring Reinforcement Learning Cyber Attack Agents Between Simulators and to Real Systems
SummaryCyber attack agents are usually trained and tested in one simulator, so it is unclear whether their learned policies work elsewhere. The authors propose a framework that separates state alignment from action translation, allowing a policy trained in one environment to run in another without retraining. They evaluate transfer across CyberBattleSim, NetSecGame, CyberWheel, and NASim, including emulated NASim deployments. Zero-shot transfer preserved source performance in closely aligned environments, and transferred policies showed a Jensen-Shannon divergence of 0.085 from native policies in emulated virtual machines.
In briefProgressive-precision secure aggregation for federated learning, releasing finer layers later
SummaryThis paper introduces a new progressive-resolution secure aggregation functionality for federated learning, where clients upload only once. The server can later be authorized to obtain successively finer resolutions of the same aggregate without renewed client participation. The proposed protocol, PSA, represents clipped, dithered updates as compatible nested-lattice digits, with separately releasable layers protected by secure aggregation and an extra aggregate pad. That pad stays unavailable to the server until a non-colluding release controller authorizes the layer.
In briefRemoving Backdoors from LoRA-Tuned LLMs by Projecting Out Malicious Directions
SummaryThis paper proposes a method to purify backdoors in large language models fine-tuned with LoRA, a parameter-efficient method, without needing known triggers, clean reference data, or retraining the suspect parameters. The approach extracts backdoor directions and builds orthogonal null spaces in each layer or head, then projects the LoRA updates onto them. The authors report that attack success rates drop from nearly 100% to below 10%, while the base model's general performance and the adapter's downstream abilities are preserved.
In briefPoisoned Cryptography: Solving Direct-Sum LIP in Half the Dimension
SummaryThis paper analyses the Lattice Isomorphism Problem framework of Ducas and van Woerden when instantiated with a direct sum of two rescaled integral Barnes-Wall lattices. All primitives in the framework share one public key, so recovering the secret matrix breaks each of them. The authors show that a transformation computable from the public key alone splits the instance into two isomorphism problems in half the dimension. For d=1024 and g=43, the estimated key recovery cost drops from 220 to 124 classical bits.
In briefContaining LLM backdoors by quarantining and shutting down a dedicated expert
SummaryThis paper studies backdoored large language models that act normally on benign inputs but produce attacker-chosen outputs under hidden triggers. The authors propose Quarantined Expert Shutdown (QES), which lets the backdoor form during training but routes it into a designated expert that can be disabled at deployment by zeroing its routing weight. The reported results show attack success rate dropping from 100% to 0–10% in most settings, with downstream utility often preserved or only modestly affected.
In briefHierarchical cyber defense using frozen large language models, from planning to execution
SummaryThis paper studies whether frozen, zero-shot large language models can control hierarchical cyber defense without retraining. Using the Cyberwheel environment, the authors compare reinforcement learning and LLM configurations across six models from 3B to 70B parameters. Replacing only the planner with an LLM gives limited gains, while extending LLM control to execution improves results for sufficiently capable models across small, medium, and large networks.
Harshith Doppalapudi, Nathaniel D. Bastian, Ankit Shah
In briefNo Single Architecture Wins Everywhere: Cross-Environment Test of Hierarchical Red Team Agents
SummaryThis paper compares two hierarchical red team attack agents, one using reinforcement learning for both planning and execution and one using large language models, to stress-test AI-enabled cyber defenses. Both were evaluated against expert defenders in CybORG CAGE-4 and two Cyberwheel network sizes across 18 configurations. The ranking reversed by environment: the RL design led in CAGE-4 and the 100-host network, while a pretrained cybersecurity LLM agent led in the 1010-host network. The authors conclude that single-environment findings may not generalize.
Ayan Javeed Shaikh, Arunesh Sinha, Nathaniel D. Bastian et al.
In briefHarbormaster: A Replay-Safe AWS System for Maritime Anomaly Detection with Evidence Gating
SummaryThis paper presents Harbormaster, an AWS system for detecting anomalies in maritime AIS position reports, which can be false or missing. Each report passes physics checks before any learned model runs, and DynamoDB writes are guarded by log sequence numbers so projections stay consistent. Candidate models must pass a holdout gate and shadow comparison, then a canary rollout with burn-rate checks. The authors prove that replaying any prefix or suffix of the change log leaves each key at its highest applied LSN value, and note effects this result does not cover.
In briefBlind unforgeability implies plus-one unforgeability in quantum settings
SummaryThis paper proves that quantum blind-unforgeability implies quantum plus-one unforgeability, resolving an open question in the literature. Because plus-one unforgeability is known not to imply blind-unforgeability, the result shows blind-unforgeability is strictly stronger in the quantum setting. The proof uses a new smoothing technique that coherently rescales the query histories of a quantum-query algorithm in a black-box manner.
WhyProves blind-unforgeability implies plus-one unforgeability via a new coherent smoothing technique, settling an open question with a rigorous proof and moderate subfield impact.
In briefA study of the simplest block cipher that stays secure against quantum attackers.
SummaryThis paper studies the quantum security of the key-alternating Even-Mansour cipher, which uses public permutations. A one-round version is broken by a quantum attack based on Simon's algorithm, while earlier security results for two or more rounds covered only non-adaptive adversaries. The authors prove that the two-round cipher is information-theoretically secure in the ideal permutation model against adaptive quantum adversaries. They also show that nearly any cipher using a single public permutation call is quantum-insecure, making this construction minimal.
WhyProves two-round Even-Mansour is information-theoretically quantum-secure against adaptive queries, and shows single-call constructions are insecure.
Gorjan Alagic, Joseph Carolan, Christian Majenz et al.
In briefZoneClaw: Protecting Computer-Use Agents from Persistent Memory Attacks Through Memory Zoning
SummaryThe paper describes how OpenClaw-style computer-use agents store external content in persistent memory that is reloaded automatically, so an attacker can plant claims that later influence unrelated tasks. The authors propose ZoneClaw, which replaces flat memory with hierarchical trust zones, so external claims gain action-guiding authority only when they cross an explicit boundary. Across 480 attack trials, attack success drops from 372 to 6 while utility is retained in 458 trials.
WhyProposes trust-zone separation of memory persistence and authority, cutting attack success from 372/480 to 6/480 across scenarios and backbones.
In briefCould F_3^n Subset-Sum Admit Exponential Quantum Speedup? Rigorous Classical Algorithms for Binary-Error LWE
SummaryThe paper studies vector subset sum over F_3^n, where one must find a nonempty subset of m random vectors summing to zero, becoming harder as m decreases. Using the Chen, Liu, and Zhandry framework, the authors give quantum algorithms that solve the problem in polynomial time with m = ε·n² vectors for any fixed ε>0, and establish a full sample-time tradeoff between exponential and polynomial runtime. The key ingredient is a deterministic classical algorithm for binary-error Learning-with-Errors, which also significantly improves earlier classical algorithms for vector subset sums over larger fields.
WhyExtends quantum subset-sum to m=εn² vectors and rigorously proves a sample-time tradeoff for binary-error LWE, a notable theoretical advance.
In briefWhy building quantum pseudorandom states needs coherent access to oracles
SummaryThe paper builds quantum oracles under which quantum-secure one-way functions exist, yet pseudorandom states with superlogarithmic output length do not. It shows that the same impossibility holds for any classically accessible classical oracle, indicating that coherent access is needed to construct these states. The authors also show that logarithmic-length pseudorandom function-like states exist relative to these oracles.
WhyConstructs oracle separations showing superlogarithmic PRSs fail under classical access, revealing that coherent access is necessary for PRS constructions.
In briefVerifiable quantum advantage and computation via quantum circuit obfuscation
SummaryThe paper builds protocols for classically verifiable quantum advantage and classical verification of BQP computations using quantum indistinguishability obfuscation (qiO). One protocol is privately verifiable and assumes only qiO, while another adds post-quantum one-way functions and is publicly verifiable. The authors also propose an approach to constructing qiO by adapting a local-mixing framework.
WhyGives a rigorous cryptographic foundation for verifiable quantum advantage and BQP verification via qiO; novel and impactful, but evidence is purely theoretical constructions.
Alexandru Gheorghiu, Aparna Gupte, Vojt\v{e}ch Havl\'i\v{c}ek et al.
In briefQuantum secret sharing and error correction under no-cloning limits
SummaryThis paper studies quantum secret sharing (QSS) in a variant where several identical copies of the input state are provided but only one copy must be recovered, sidestepping the single-copy no-cloning obstruction. For threshold structures it gives conditions under which QSS is possible and impossible, and introduces a Clique Path obstruction that applies to arbitrary access structures. The upper and lower bounds match exactly for two copies, while the gap for three or more copies is left open. The authors note that similar obstructions apply to quantum error correction for erasure channels.
In briefQuery-Limited RAM Programs for Stateful One-Time Quantum Computation
SummaryThe paper introduces query-limited RAM programs (QLPs), a generalization of quantum one-time programs that supports stateful computation under bounded or policy-driven access while preventing forking or rollback of computational state. To construct them, the authors define one-shot programs, combining one-shot signatures with the single effective query paradigm. They prove that one-shot programs generically imply QLPs and clarify relationships between signature-token primitives and quantum one-time programs.
In briefInformation-loss barrier on Fourier labels for dihedral coset algorithms
SummaryThis paper proves a no-go theorem for a broad class of quantum algorithms for the dihedral coset problem (DCP). It considers the Fourier-sampling and subset-sum-measurement template proposed by Regev. The authors show that if an algorithm discards more than ω(log n) bits from each Fourier label after measuring the lower n-1 bits of the subset sum, it cannot solve DCP. They further argue that a recent 2026 algorithm by Simon does not solve DCP, since it can be implemented using only the most-significant third of the Fourier labels.
WhyProves a no-go theorem for Regev-style Fourier-sampling algorithms on dihedral coset and shows a recent algorithm fails, with a formal Lean verification.
In briefVerifiable quantum advantage using polynomials with hidden structures
SummaryThis paper proposes a verifiable quantum advantage protocol based on IQP circuits described by cubic polynomials with planted independent spaces. A verifier uses a simulation secret to evaluate a cross-entropy test faster than a classical adversary could pass it. Under two conjectures, the authors argue there is a polynomial gap, with both verification and classical spoofing taking exponential time. The scheme may also generate classically certifiable randomness, and the authors estimate it could be implemented with 100 logical qubits at logical error rates around 10^-6.
Markus Bl\"aser, Michael Gullans, Dominik Hangleiter et al.
In briefCodeMimicry: Jailbreaking LLMs via Structured Code Completion Exploiting Safety Lag
SummaryThis paper finds that large language model safety alignment, trained mainly on natural language, fails to transfer to code, creating a code-completion blind spot. It proposes CodeMimicry, a fully automated black-box jailbreak framework that uses structured object-oriented code prompts to elicit harmful outputs. Tested on 8 commercial LLMs, it reports a 96.25% attack success rate with an average of 1.51 queries, and latent space analysis is used to explain how it bypasses safety mechanisms.
