In briefInformation-theoretic MPC with communication below n²
SummaryThis paper studies communication costs in secure multi-party computation (MPC) with information-theoretic security. Existing protocols in the honest-majority setting need communication that scales with n² even for small circuits. The authors present a protocol with sub-quadratic o(n²) communication for a wide range of circuits, secure against adaptive malicious adversaries. They also prove that such sub-quadratic communication is impossible against adversaries with stronger rushing capabilities, even for constant-size circuits.}}zh
WhyFirst information-theoretic MPC with sub-quadratic communication for a wide circuit class, breaking the n² barrier, plus a separation result.
In briefLayered defenses for language-model-driven UAV swarm sensor scheduling
SummaryThe paper studies how an attacker who manipulates sensor reports can redirect a swarm of drones whose data-collection schedule is decided by a large language model. The authors implement and test five defense layers that check report provenance, physical plausibility, consistency with swarm geometry and history, and schedule starvation, falling back to a deterministic scheduler when checks fail. Predicted detection boundaries matched simulation results across thirty runs. Rejecting suspect reports stops adversarial control but raises cumulative cost by 79% and 74% for the two detectors compared with the undefended system.
Mohammadhossein Homaei, Yousef Emami, Sajad Homayoun et al.
In briefLow-noise multi-value bootstrapping via lattice search and LUT shifting
SummaryThis paper addresses the high cost of programmable bootstrapping in FHEW and TFHE fully homomorphic encryption. Multi-value bootstrapping shares one blind rotation among several functions, but common choices of common factor can cause unnecessarily large noise amplification for many lookup table collections. The authors propose a log-unit lattice search to select better common factors, complemented by LUT shifting to generate alternative test-polynomial representations, both performed offline. In TFHE at failure probability 2^-128, for 256-bit homomorphic integer multiplication, they report a 1.47x latency speed-up and 1.59x throughput improvement over separate bootstrapping per output.
In briefReversing the Clock: Recovering Chip Design Intent from Clock Networks
SummaryThis paper presents a layout-aware method that combines a recovered gate-level netlist with layout information from scanning electron microscope images to reconstruct and analyze the clock distribution network of a fabricated chip. Applied to a commercial 450 nm IC, it recovers a global H-tree backbone with local X-tree-like branching, an independent clock tree, and global clock gating. It also quantifies latency, skew, and routing lengths and finds no dedicated crosstalk mitigation. The clock tree recovery algorithm is released as open source.
WhyFirst recovery of clock distribution networks from fabricated ICs to infer design intent is novel, but validation is limited to a single 450 nm commercial chip.
Sascha Tommasone, Zehra Karada\u{g}, Christopher Pawlowicz et al.
In briefLiBRA: a detection-aware attack that removes image watermarks by bidirectional latent optimization
SummaryThis paper studies removal attacks on digital watermarks used to attribute AI-generated images. It proposes LiBRA, which makes bounded changes in a public autoencoder's latent space to drive average decoding confidence toward random guessing, so the watermark becomes undetectable rather than inverted. The authors verify removal with an exact two-sided binomial test instead of assuming the confidence target guarantees success.
In briefEvoRiskBench: An Evolving Benchmark for Testing Runtime Security Risks in AI Workspace Agents
SummaryThis paper introduces EvoRiskBench, a benchmark for testing security risks that arise when AI workspace agents run multi-step tasks. It uses the EP-Path-EF framework to build risk cases, which are executed in isolated environments and verified with runtime traces. The benchmark includes 450 adversarial tasks across six scenarios. Evaluations of nine model-harness configurations reveal substantial vulnerabilities, with the worst reaching a 68.44% attack success rate.
In briefWeaknesses of Trigger-Tag Methods for Detecting Misuse in Open-Weight LLMs
SummaryThis paper studies trigger-tag mechanisms, which make open-weight language models emit a detectable signal when used under a target condition such as generating phishing content. The authors distinguish token-level trigger-tags from weight-level trigger-tags and introduce Untag, a unified attack framework. Evaluated on phishing as a case study, the existing mechanisms prove entirely ineffective under the proposed attacks, so the authors argue they should not be relied on as robust misuse detectors.
Toluwani Aremu, Manit Baser, Mohan Gurusamy et al.
In briefDefending computer-use agents against attacks that steer their branching
SummaryThis paper shows that computer use agents, which operate graphical interfaces, can be steered down dangerous pre-approved branches by crafted web content, even under the Dual-LLM pattern, without explicit injected instructions. The authors introduce STEER-Bench, with 101 tasks across 9 domains, where attacks succeeded 94.4% of the time against standard CUAs and 89.5% against vanilla Dual-LLM CUAs. They propose COBRA, which pairs trusted branching plans with ahead-of-time capability constraints, and report that it reduces attack success to 0% on STEER-Bench while retaining 97% benign utility.
WhyIntroduces branch steering attacks and a new benchmark, with COBRA addressing Dual-LLM weaknesses in GUIs; evaluation covers 101 tasks, modest in scale.
Giulio Zingrillo, Hanna Foerster, Ilia Shumailov et al.
In briefSecJev: Security-specialized decision models for System One tasks
SummaryThis paper introduces SecJev, described as the first family of Jev-style decision models specialized for security, with sizes from 0.8B to 9B parameters. Built on Kev's single-pass candidate scorer, it learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories, trained on the newly built SecJev-Corpus spanning 14 tasks and eight sources. The authors report that SecJev-0.8B outperforms general Kev-9B by 20.51 percentage points in task-macro accuracy.
In briefThree-Move Blind Signatures Based Only on the Discrete Logarithm Assumption
SummaryThis paper constructs blind signatures in pairing-free groups. In the random-oracle model, it gives the first three-move blind signature that is provably one-more unforgeable under only the discrete logarithm (DL) assumption. The scheme also supports partial blindness, and its blindness is statistical. Prior work reached the same round complexity and security under the stronger DDH assumption, while this paper relies on DL alone.
WhyFirst three-move one-more unforgeable blind signature from only discrete logarithm, removing DDH; strong theory, narrower practical reach.
Rutchathon Chairattana-Apirom, Michael Reichle, Stefano Tessaro
In briefBeyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents, a static analysis method for LLM agent security
SummaryThis paper presents AgentSecGraph, a static analysis framework that builds a Security-Aware Agent Dependency Graph for each security-sensitive operation in LLM agents, adding agent relevance, trust-boundary and guard evidence. The authors also introduce AgentSecBench, a corpus of 67 real LLM-agent repositories. On nine held-out cases, Security-ADG preserved 91.1% of reference context and all five observed guards, versus 20.0% for a sink-only view and 40.0% for a simplified ADG.
In briefMultiparty homomorphic secret sharing built from distributed discrete logarithms
SummaryThe paper presents a general framework for building multiparty homomorphic secret sharing from two-party semi-private schemes using a new party virtualization approach. It supports compositions of polynomial computations and restricted multiplication programs, and upgrades to fully private schemes for functions of polynomial degree and bounded Waring rank. The resulting multiparty distributed point functions have key sizes polynomial in the security parameter and log of the domain size, and can be instantiated under standard assumptions such as DCR and class-group assumptions.
Pierre Meyer, Claudio Orlandi, Lawrence Roy et al.
In briefDigital twin-assisted mapping of industrial control telemetry to ATT&CK for ICS, with evidence-based dependency reasoning
SummaryThis paper proposes a digital twin-assisted framework that extracts synchronized state changes from industrial control system telemetry, converts them into evidence-preserving descriptions, and maps them to ATT&CK for ICS using retrieval-augmented large language model reasoning. It also builds a typed dependency graph. Tests on SWaT scenarios show fewer false positives with digital twin enrichment, but the gains are not statistically significant and do not transfer to BATADAL or WADI. The authors conclude the approach has potential but clear limits.
Konstantinos E. Kampourakis, Vyron Kampourakis, Vasileios Gkioulos et al.
In briefPaper arguing peer review should limit evaluative authority
SummaryThis paper argues that peer-review reform should shift from improving evaluators or aggregating judgments to constraining evaluative authority under persistent uncertainty. It proposes authority-constrained peer review, requiring consequential judgments to pass structured scrutiny before being treated as decision-relevant. Proposed mechanisms include critique-authority decoupling, independent secondary evaluation, contestability and reversibility, and accountability for unsupported influence.
Hanrui Wang, Timo Spinde, Isabella Habereder et al.
In briefFrequency Is Not Sensitivity: Finding Safety-Sensitive Experts in Sparse MoE LLMs
SummaryThis paper studies whether suppressing a few routed experts in a sparse Mixture-of-Experts language model can weaken its safety refusals without retraining. It compares choosing experts by activation frequency against choosing them by router-gradient sensitivity, tested across five MoE architectures. Under the tested budgets, the authors report that gradient-based selection reduces refusals more than frequency-based selection in most conditions.
In briefAgentTrap: Stateful Feedback Deception Against Autonomous Pentest Agents
SummaryThis paper presents AgentTrap, a closed-loop honeypot designed specifically to deceive autonomous penetration testing agents. It uses sentinel endpoints to avoid interfering with benign users, and combines stateful deception grounded in the protected application with behavior-guided escalation to collect agent-side evidence. In evaluations against eight such agents, the aggregate real-target attack success rate fell from 95.8% to 79.2%, and attacker API keys were elicited in 18.8% of runs.
In briefContaining AI Agents on Kubernetes: A Defense-in-Depth Framework
SummaryThis paper argues that LLM agents operating on Kubernetes change production clusters, so their security must be treated as an infrastructure problem that holds even if prompt injection fully compromises the agent. It contributes a threat model with a ten-class taxonomy, nine design principles, and a seven-layer defense-in-depth framework mapped to Kubernetes mechanisms, along with reference architectures for EKS, AKS, and GKE. The evaluation is qualitative, with a coverage matrix and attack walkthroughs, and the authors report no measured attack-success or overhead figures.
In briefRMCW: A Reed–Muller code-based watermark for language models that resists deletion attacks
SummaryThis paper proposes RMCW, a watermarking method for large language models based on Reed–Muller codes, to identify text generated by a specific model. It targets deletion attacks, which shift token positions, by searching local subsequences for surviving algebraic structure and testing them with Berlekamp–Welch tests. Experiments on C4 and ELI5 with OPT-1.3B and Llama-3.1-8B-Instruct report strong detectability on clean text and performance matching or exceeding baselines under several deletion and rewriting attacks.
WhyCombines Reed-Muller codes with local Reed-Solomon consistency for deletion-robust watermarking, a fresh idea; experiments cover only two datasets and two models.
In briefFormal verification of assembly-level additive FFTs in code-based post-quantum cryptography
SummaryThis paper presents the first formal verification of highly optimized additive FFTs used in two code-based post-quantum schemes, Classic McEliece and HQC. The authors extend the open-source tool CryptoLine and reformulate additive FFTs as Chinese Remainder Theorem decompositions, splitting the problem into local checks that computer algebra systems such as Singular can handle. According to the paper, the verification took less than three months of calendar time.
In briefTurning Requirements into Attack Trees: LLM Agents for Design-Stage Security Review
SummaryThis paper presents a multi-agent LLM framework that performs security analysis at the design stage, using product requirement documents and architecture diagrams before implementation. The framework generates misuse cases and attack trees, checks governance and compliance gaps, recommends mitigations, and proposes a candidate revised architecture for expert review. According to the authors, architecture-informed, misuse-driven reasoning improves review quality over single-shot and ablation baselines.
In briefInner momentum to fix clipping distortion in private Muon training
SummaryThe paper addresses how per-example gradient clipping in differentially private training distorts the singular-vector geometry that the Muon optimizer relies on. It proposes averaging each example's Muon gradient over the current model and recent model history before clipping, and shows this bounds clipping-induced distortion and survives Newton-Schulz orthogonalization. In private GPT-2 fine-tuning on E2E and DART, the method beats DP-Muon in every seed-matched comparison and lowers pre-noise polar error by 2-4%.
In briefPost-quantum time-lock puzzles built from isogenies
SummaryThe paper presents what is conjectured to be the first post-quantum time-lock puzzle based on isogenies, with puzzle generation running in about √T time and no setup or preprocessing. Security is proven in the quantum random oracle model under a new conjecture about the sequentiality of isogeny pushforward computations. The authors also report a proof-of-concept implementation, taking about 2.9 minutes serially on an Apple M3 for a one-hour target delay.
In briefDifferential privacy of gradient descent on perturbed objectives
SummaryThe paper analyzes the privacy of releasing the N-th iterate of deterministic gradient descent on a regularized empirical risk with a random linear perturbation, rather than the exact perturbed minimizer. Under an explicit condition, the map from the noise vector to the iterate is shown to be a C^1-diffeomorphism with a quantitative lower bound on its Jacobian's smallest singular value. For generalized linear models, the privacy bound has no explicit ambient-dimension factor once the iteration condition holds.
WhyProves finite gradient-descent iterates on perturbed objectives are diffeomorphisms with explicit Jacobian bounds, removing ambient-dimension factors; rigorous theory with no experiments.
In briefOutput-adaptive ABE for circuits from LWE, revisiting partitioning techniques
SummaryThis paper introduces output-adaptive security, an intermediate notion between selective and full adaptive security for attribute-based encryption. The adversary commits to a policy structure in advance but chooses the target output value adaptively during the challenge phase. The authors build the first such scheme for general circuits from the standard LWE assumption, applying classical partitioning techniques to the circuit output space. They argue the notion suffices for applications such as biometric matching, weighted thresholds, and wildcard search.
In briefHow normalization can flip robustness conclusions in quantum attention ablations
SummaryThe paper audits robustness ablations in a four-qubit quantum-attention detector trained on generated power-grid trajectories. A learned input-scaling module looks beneficial under a fixed physical attack budget, but the ordering reverses when perturbation bounds are matched at the encoder. The authors conclude that neither comparison alone establishes that the module causes a robustness benefit.
Owen Friedewald, Srikar Alla, Ali Shiri Sichani et al.
In briefLimits of quantum Fourier sampling for auditing delay-based PUFs: a three-gate protocol
SummaryThis paper examines whether quantum Fourier sampling can audit the spectral learnability of delay-based physical unclonable functions (PUFs), and proposes a Three-Gate Quantum Audit Protocol. It finds that low degree does not imply small support at reachable challenge lengths, and that growth in a quantum-kernel geometric difference can arise from classical Gram-matrix ill-conditioning alone. No end-to-end advantage was found in the evaluated regime, though ideal sampling used fewer coherent calls on the thresholded task.
In briefControl OSWorld: A Safety Test Environment for AI Agents That Use Computer Interfaces
SummaryThis paper introduces Control OSWorld, an evaluation environment that pairs 318 OSWorld tasks with 81 harmful side tasks, such as exfiltrating a private file, that an agent must complete without being caught. The authors use it to study monitors that detect malicious agents operating a graphical user interface. A weaker monitor reliably separates honest from malicious trajectories when it sees the full trajectory, reaching 97% recall at a 3% false positive rate. When it must score each step before execution, recall drops at low false positive rates, and access to the agent's visible text matters more than screenshots.
In briefPincer: Digital-twin-based permission control for AI coding agents
SummaryThis paper presents Pincer, a defense operating at the resource layer that works alongside existing tool-call-layer protections for coding agents. Its core is a digital twin, an isolated-context model that learns and enforces user-specific least-privilege policies and acts as the user's proxy for permission requests. The authors introduce a user-centric dataset based on multi-day user-agent interaction transcripts. The evaluation reports that Pincer performs strongly on both security and utility against several baselines, including LLM judge variants and adaptations of Conseca.
Mayank Rathee, Alexander Stepanov, Shalin Madabhavi et al.
In briefGram Moments and Pairwise Mixing Analysis of AES
SummaryThis paper analyzes how closely AES with independent, uniform round keys reproduces a random permutation's joint output distribution on two distinct plaintexts. It preserves diffusion-induced dependencies using Gram-moment estimates and by jointly estimating two consecutive transitions. The authors prove that the pairwise total variation distance is below 2^(-92.19-41k) for 8+2k rounds, so 10, 14, and 16 rounds reach accuracies of 2^(-128), 2^(-192), and 2^(-256).
WhyPreserves diffusion-induced dependencies via Gram moments and joint two-round transitions, yielding a rigorous new pairwise mixing bound for AES with broad implications.
In briefOut of Sync, Out of Sight: A study of timing-based evasion of industrial IoT intrusion detection
SummaryThe paper introduces the Phantom State Attack (PSA), which targets machine-learning intrusion detection systems in industrial IoT by subtly shifting attack traffic timing across sliding-window boundaries. It requires no packet modification, classifier queries, or model of benign traffic. Evaluated on ToN-IoT and CIC IIoT 2025 against Random Forest, MLP and XGBoost, PSA degrades detection mainly for flows with enough packets, while a query-based baseline needs many queries per window. The authors present temporal aggregation as an attack surface under weaker assumptions than prior evasion methods.
In briefCITADEL: LLM and Data-Flow-Graph Framework for Generating CWE-Guided Hardware Trojans
SummaryThis paper presents CITADEL, a framework that combines Large Language Models and Data Flow Graphs to automatically synthesize hardware Trojans grounded in CWE weakness semantics. It helps identify vulnerabilities, localize the module around an insertion point, and perform intent-conditioned RTL modifications. The authors report that all generated Trojans are syntactically correct, evade large-scale random simulation, and trigger under their intended activation conditions, positioning the method for realistic HT benchmark creation.
Jayanth Thangellamudi, Raghul Saravanan, Sudipta Paria et al.
In briefWhether simple quantum processes can behave like true randomness
SummaryThis paper studies the quantum version of Gowers' conjecture, asking whether repeatedly composing simple random local operations can produce global behavior indistinguishable from random. The authors construct efficiently samplable one- and two-qubit gate distributions that yield approximate unitary t-designs, yet an efficient quantum algorithm can still distinguish them from random, refuting a quantum analog of a permutation conjecture. They also argue that unitary designs may not faithfully model information scrambling in black-hole physics and propose new conjectures about how pseudorandomness can emerge in random quantum circuits.
WhyConstructs local random gate walks that become approximate unitary designs yet are efficiently distinguishable, refuting an analogue of a classical conjecture.
Jesko Dujmovic, Jonas Haferkamp, Alexander Poremba
In briefSideKernel: A Usable microVM Sandbox for Running AI Coding Agents on macOS
SummaryThis paper argues that AI coding agents are untrusted yet need autonomy on developer machines, creating a security problem. A user survey found that fewer than 40% of users run such agents in a sandbox and identified key usability barriers. The author built SideKernel, an open-source, local, microVM-based macOS sandbox designed for usability. In a comparison across 23 capability tests against qualifying sandboxes, Docker Sandboxes and SideKernel scored highest on usability-related features.
In briefCAROUSEL: A private vector search method using GPU-accelerated homomorphic sketching
SummaryThis paper addresses the problem that vector search on untrusted servers leaks the query embedding, which reflects the user's intent. The proposed Carousel scheme has the server score every vector in the corpus under encryption, then compresses the results into a logarithmic number of ciphertexts so the client can rank them. The authors report recall@100 of 0.9715 on the billion-scale BIGANN SIFT1B using multiple GPUs, and recall@100 of 0.9845 on 100 million SIFT vectors with a query latency of 3.735 seconds on a single GPU.
In briefEvaluating and Improving Large Language Model Robustness to Adversarial Input Variations
SummaryThis thesis studies how robust large language models are against adversarial input changes such as prompt injections, backdoors, and manipulation of automatic quality metrics. It proposes R_stab(f), a generative robustness metric based on Jensen-Shannon divergence, and ASA, an adaptive black-box attack on LLM-as-a-Judge systems reaching up to 73.8% attack success rate. It also introduces AttestMCP, which attests tool calls in agentic systems, reducing average attack success rate on the 847-scenario MCPBench from 53.7% to 12.4%.
WhyProposes a generative robustness metric, adaptive attack ASA, and AttestMCP, with concrete benchmark comparisons giving solid evidence and moderate-to-broad impact.
In briefWhiteout: Reducing Private Data Leaks from LLMs
SummaryLarge language models can memorize and repeat personal information such as birth dates, phone numbers, and addresses. This paper presents Whiteout, a tool that, upon an individual's request, overwrites their real personal data in a model using carefully designed obfuscation samples. Tested on modern LLMs of various sizes and makers, including an OpenAI model, Whiteout effectively prevents disclosure with negligible impact on utility and safety. The authors also evaluate it against jailbreaking, relearning, and quantization attacks.
Anna Yoo Jeong Ha, Ronik Bhaskar, Haitao Zheng et al.
In briefUnifying Privacy Accounting: Information Equivalence and Information Loss
SummaryThis paper compares four curve-based notions of differential privacy within a unified information-theoretic framework. Under a mild condition, the two directional (ε,δ)-DP profiles, the hypothesis-testing trade-off functions, and the extended privacy-loss distribution are shown to be information-equivalent, and the exact RDP curve joins this class. Taking the maximum of directional profiles or compressing RDP into a single zCDP parameter can lose information, and the gap grows with composition. Retaining the full RDP curve reduces required noise variance and improves DP-SGD test accuracy on Fashion-MNIST at the same privacy guarantee.
WhyProves information equivalence among four privacy curves and quantifies RDP-to-zCDP information loss, with experiments on DP-SGD and census-scale workloads.
In briefHop-Decayed Influence: New Vulnerabilities in Structural Auxiliary Indexing of LLM-based GraphRAG (paper)
SummaryThis paper examines GraphRAG pipelines that use LLMs, where auxiliary structures built during offline indexing, such as semantic summaries, hierarchical edges, and precomputed scores, control retrieval priority at query time. The authors introduce the 3S Framework and the Hop-Decayed Influence (HDI) attack, which corrupts these schema-level structures after indexing, whereas prior attacks only targeted instance-level components. Tested on two benchmarks and two architectures, HDI reports 88–94% attack success while modifying about 0.016% of auxiliary structures and evading perplexity and paraphrase defenses.
WhyIntroduces a new attack surface on auxiliary schema structures, validated across two benchmarks and two GraphRAG architectures, with broad impact.
In briefBreaking the bounded entanglement barrier in quantum position verification
SummaryThis paper studies quantum position verification (QPV), in which verifiers test a prover's claimed location through an interactive protocol. The authors work in an idealized continuous-time model and present a BB84-based protocol that stays secure against finite coalitions of LOCC adversaries with arbitrary finite quantum storage and entanglement. Honest parties need significantly fewer resources than the adversary, and the resource gap grows as clock precision improves.
WhyBreaks the bounded entanglement barrier in continuous-time QPV with a BB84-based information-theoretic protocol and provable polynomial resource gaps.
In briefMIRROR: A Multipath Majority-Vote Defense Against Message Tampering in LLM Agent Communication
SummaryThis paper addresses attacks in which an intermediary manipulates messages between agents in LLM multi-agent systems. It proposes MIRROR, which sends one canonicalized message over several routes and accepts it only when a strict majority of routes report the same digest. The authors give an integrity guarantee when fewer than half of the routes are compromised. In their experiments, MIRROR reduces attack success to 0% below that threshold at 1x token cost.
Ryuichi Yamafuji Lun, Jingzhen Wang, Shreyas Kolte et al.
In briefKaliBench: a benchmark for turning plain-language requests into Kali Linux security tool commands, with rewards checkable without running them.
SummaryKaliBench is a benchmark and dataset of 8,504 natural-language-to-command pairs covering 1,642 Kali Linux tools across 23 capability dimensions and 5 security phases. The authors report that no open-weight model exceeds 42% exact-command accuracy in the unrestricted setting. They also state that supervised fine-tuning and reinforcement learning with rewards derived from KaliBench lift an 8B model to performance comparable to a 685B MoE model.
In briefIntent-hiding jailbreaks: an information-theoretic framework for combining harmful requests with benign tasks
SummaryThis paper studies a class of jailbreak attacks on large language models in which a harmful request is hidden by combining it with benign tasks into a seemingly innocent query. The authors use an information-theoretic formulation, treating each task's estimated probability of being judged harmful as a prior over the full collection and a posterior over the selected bundle, and select auxiliary tasks so these match. Experiments on several open-source models show that compositional queries can elicit target behaviors beyond a direct-request baseline under the evaluated search budgets. However, for several models, response-level target preservation tends to decrease as bundle size increases.
In briefQuantum Advantage for Two-Party Differential Privacy: Quantum Communication Achieves O(1) Information-Theoretic Error in Estimating Hamming Distance
SummaryThe paper presents quantum protocols for estimating the Hamming distance between two parties' inputs, where both must output the same estimate. Classical information-theoretic protocols incur error Ω(√n) under pure differential privacy. In Klauck's honest, nonpreemptive, message-preserving model, the authors give an O(n)-communication quantum protocol with expected error at most 2/sinh ε + γ. For approximate privacy, the error is strictly smaller, and the separation from classical protocols is preserved.
WhyGives an O(1)-error quantum protocol under information-theoretic privacy, classically impossible, with rigorous proofs separating the two models.
In briefProven lower bounds on preprocessing attacks against quantum cryptography
SummaryThis paper proves near-optimal lower bounds on preprocessing attacks against quantum cryptography in the random oracle model. It shows that an adversary with T queries and S qubits of advice recovers a random key from an n-qubit binary phase state with probability at most O((T²+√(ST))/N), where N=2^n. The authors also tighten an earlier analysis of post-quantum pseudorandom generators and generalize a one-query lower bound for unitary synthesis.
WhyProves near-optimal preprocessing-attack lower bounds for quantum cryptography, improving prior bounds with rigorous proofs, though impact is largely confined to theoretical cryptography.
In briefStudy of whether simple quantum processes can be pseudorandom
SummaryThe paper asks whether repeatedly composing simple local random quantum gates can produce global unitaries indistinguishable from random. It shows that unitary designs, which match statistical moments, do not generically yield pseudorandomness, since an efficient quantum algorithm can distinguish such ensembles from random. The authors also report a stronger separation at polynomially bounded moments and propose new conjectures about how pseudorandomness may emerge in random quantum circuits.
WhyShows simple local random quantum walks form unitary designs yet are efficiently distinguishable, refuting the unitary analog of a permutation conjecture with rigorous proofs.
Jesko Dujmovic, Jonas Haferkamp, Alexander Poremba
In briefHomomorphic Advantage Operator: keeping reinforcement learning stable when data is encrypted
SummaryThis paper proposes the Homomorphic Advantage Operator (HAO), a method to stop polynomial approximations from diverging in deep reinforcement learning run under Fully Homomorphic Encryption (FHE). It applies zero-mean centering from advantage estimation to temporal-difference targets, removing the uniform state-value baseline that causes Bellman drift. The authors report that HAO kept network pre-activations within the safe polynomial range, with 0% boundary breaches across all random seeds tested.
Abid Mohamed Nadhir, Ahmad Al Hanbali, Beggas Mounir
In briefCan AI Oversight Be Zero Knowledge? A Study on Verifying Oracle-Dependent AI Outputs Without Revealing Private Data
SummaryThe paper studies whether AI outputs that depend on external oracles, such as human judgment or experiments, can be verified without revealing confidential inputs. The authors prove that in the random oracle model, zero-knowledge proofs do not exist for all oracle-aided computations, and this limitation also applies to debate. However, if the oracle signs each answer cryptographically, every such computation can be verified in zero knowledge, assuming only collision-resistant hash functions.
WhyProves zero-knowledge verification of general oracle-aided computation is impossible in the random oracle model, and gives a positive signed-oracle construction.
In briefPseudorandom correlation generators for matrix triples, which produce shared random matrix products for secure computation
SummaryThe paper introduces two new pseudorandom correlation generators that produce shares of matrix triples (A, B, A·B) for secure computation. Such triples are used in protocols involving matrix arithmetic, such as privacy-preserving machine learning and threshold cryptography. Previous generators had seeds growing linearly with matrix dimension and slow expansion, while the new constructions achieve smaller seeds and better performance.
Maxime Bombar, Geoffroy Couteau, Nikolas Melissaris et al.
In briefCan AI Oversight Be Zero-Knowledge? A Theory Study on Verifying AI Outputs Without Revealing Data
SummaryThis paper studies how to verify that AI outputs are correct without revealing confidential data. The authors prove that, in the random oracle model, zero-knowledge proofs do not exist for general oracle-aided computations, and this impossibility extends to debate-based oversight. However, if the oracle signs each answer cryptographically, every such computation can be verified in zero knowledge with efficient prover and verifier, assuming only collision-resistant hash functions.
WhyProves general oracle-aided computation cannot be verified zero-knowledge in the random oracle model, and gives a signed-oracle positive construction.
In briefSystem-Level Optimization Beyond Cryptographic Kernels: ML-KEM on Arm Cortex-M7
SummaryThis paper studies how to speed up ML-KEM, a post-quantum key-encapsulation method, on an Arm Cortex-M7 microcontroller, beyond instruction-level tuning. It examines memory hierarchy use, tightly coupled memory placement, peripheral integration, clock settings, and reuse of public data. Without changing the algorithm or standard wire formats, some profiles cut cycles by up to 2.5%, while a public-data-reuse profile reduces encapsulation and decapsulation cycles by up to 74.6% and 58.8%.
In briefAnalysis of ITU-T X.509 Multiple Algorithm Extensions for Post-Quantum Migration
SummaryThis paper examines the Catalyst extensions in the 2019 ITU-T X.509 standard, which let one certificate carry both a traditional and an alternative public key and signature to ease migration to post-quantum cryptography. It shows that a quantum attacker who recovers one traditional CA key can substitute traditional-only certificates that relying parties may still accept. The authors also report EUF-CMA violations, undefined specification details, and cases where certificates valid under the extension are invalid under RFC 5280.
In briefVerifying Supersingularity and Superspeciality of Abelian Surfaces
SummaryThis paper studies how to check whether an abelian surface over a finite field is supersingular, a property important in isogeny-based cryptography. The authors give a Monte Carlo algorithm running in O(log p) time with negligible failure probability, and a conclusive algorithm when the order is smooth. They also provide efficient methods for checking whether abelian varieties of any dimension are minimal or maximal, and whether Jacobians of any dimension are superspecial.
Maria Corte-Real Santos, Gioella Lorenzon, Krijn Reijnders
In briefFixing Periodic Errors in OpenDP's Discrete Laplace Noise Sampler
SummaryThis paper reports systematic periodic distortions in the output of OpenDP's discrete Laplace sampler, used for differential privacy noise. The authors trace the artifacts to a faulty rational arithmetic library used by the bernoulli_exp1 function. They propose an alternative implementation based on exact rational arithmetic, and statistical tests with 10^6 samples show the corrected sampler matches the theoretical distribution at the tested precision.
Cesare Gerolimetto Fabrello, Valeria Rossi, Alberto Trombetta et al.
In briefA structured state space sequence model for classifying malware into multiple categories
SummaryThis paper addresses the security risks posed by the rapid growth of IoT devices, which often lack strong built-in protections. It proposes a malware detection and classification approach based on the Structured State Space Sequence (S4) model, which processes malware sample sequences and captures long-range dependencies in execution flow. The paper claims two contributions: the first empirical use of the S4 model for malware analysis, and a comparison of its performance against other deep learning architectures.
Emmanuela Andam, Rana Shaaban, Emanuel Grant et al.
In briefWalking the Embedding Space: Datastore Extraction from Multimodal RAG
SummaryThis paper presents MRAG, a black-box data extraction attack against multimodal retrieval-augmented generation systems that return images as responses. The attacker mixes a self-held shadow image with an image already retrieved from the system, and uses relevance-weighted resampling to steer queries toward embedding regions that still yield new results. Tested on medical, document, and general-purpose scenarios with several CLIP-family retrievers, a single 2,500-query run recovered up to 611 radiology images, 566 document scans, and 416 general images. The authors call for safeguards designed specifically for multimodal data.
WhyProposes an adaptive black-box extraction attack on image-returning multimodal RAG, hiding instructions in input images. Evaluated across three scenarios and multiple retrievers, recovering hundreds o
Maria Carmen Jica, Ali Satvaty, Suzan Verberne et al.
In briefTrapdoored Clifford Operators: Faster Random Quantum Gates via a Hidden Shortcut
SummaryThe paper introduces trapdoored distributions of Clifford operators, whose samples are computationally indistinguishable from uniformly random Cliffords but can be implemented much faster given a secret trapdoor. Under a variant of the learning parity with noise assumption, the authors build such distributions that can be sampled and implemented in near-linear time. They also construct trapdoored matrices over finite fields and study applications, including worst-case to average-case reductions for matrix multiplication and Clifford circuit synthesis.
WhyConstructs computationally indistinguishable trapdoored Clifford distributions with near-linear implementation, resolves an open problem, and proves batching Clifford circuit hardness via worst-case r
