In briefQuantum machine learning to detect hidden attacks on military quantum key distribution
SummaryThe paper studies implementation attacks on military quantum key distribution, where an adversary with a hidden backdoor in a generator hides attacked blocks within honest noise. Detection is shown to reduce to a discrete logarithm problem, which a quantum kernel using Shor's algorithm can solve. In simulations on the Ghillie decoy-state BB84 simulator, the quantum kernel scores 1.000 on camouflaged attacks while classical monitors score 0.458 to 0.516.
In briefThe Same Zero: Why Identical Attack Success Rates May Mean Different Guarantees for LLM-Agent Defenses
SummaryThe paper applies Verification Autonomy Levels (VAL, L0 to L5) to classify 22 LLM-agent security defenses by what guarantee they provide and where it comes from. Under equal budget, it compares a VAL-guided defense stack with a common intuition-based stack across 50 scenarios, 12 attack variants, and testbeds including AgentDojo and JADE. The authors conclude that a zero attack success rate is an outcome rather than a guarantee, since identical zeros can arise from very different sources.
In briefVerifying Audited Proprietary Software Without Revealing Its Code
SummaryThe paper proposes an architecture that combines two TEE-based workloads, attestable build and attestable audit, so a verifier can confirm that a running program was built from source code meeting audited properties. Audit verdicts are bound to the source code digest, so neither the source code nor the build artifact needs to be disclosed. A proof-of-concept on Intel SGX with Gramine runs the Bandit analyzer on Python code to demonstrate practicality.
In briefReactivating Alignment: Intention-Aware Input-Output Matching to Defend LLMs from Jailbreaks
SummaryThis paper presents SENTINEL, a plug-and-play defense that works during generation to block jailbreak attacks on large language models. It treats the problem as extracting the attacker's true intent, using the fact that instruction-tuned models' outputs tend to align semantically with that intent. SENTINEL matches aligned input-output regions, scores them with refusal-direction projections, and halts generation when needed. On HarmBench, it reduces jailbreak success rates to close to 5% while keeping over-refusal low.
In briefCHAMP: A Cayley Hash Built from 2×2 Matrix Products
SummaryCayley hash functions map binary strings to values by treating message bits as semigroup elements and multiplying them, which yields useful homomorphic properties. This paper proposes CHAMP, a Cayley hash function based on products of 2 by 2 matrices over a finite field. It discusses the scheme's security, implementation, and performance.
Alexander Demin, Alexey Ovchinnikov, Vladimir Shpilrain
In briefGuess My Weight: Recovering Exact Float32 Neural-Network Weights via Power Side Channels
SummaryThis paper studies whether floating-point neural-network weights on embedded devices can be recovered bit-for-bit from power side-channel leakage during inference. The authors propose a profiled template attack that targets the multiplication of a known input with a first-layer weight, using a hierarchical coarse-to-fine search over the 32-bit candidate space. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 report a 99% bit-exact success rate with 171 traces and 100% from 263 traces onward.
Timon Lum\'ir Fillo, J\'an Mikulec, Anubhab Baksi et al.
In briefLarge Language Models and Augmented Democracy: Studying LLM Digital Twins for Representing Citizen and Party Preferences and Their Vulnerability to Attacks
SummaryThis thesis examines large language model (LLM)-based digital twins as intermediaries in augmented democracy. Using Brazilian online experiment data, it tests whether personalized twins can predict citizens' preferences on unseen policy proposals. Using Swiss parliamentary records, it builds party-level twins from lawmaker agents and checks whether their deliberation captures more intra-party views than official communications. It also studies prompt-injection attacks on LLM-mediated deliberation using UK 2023 experiment data and evaluates a defensive pipeline.
In briefJASPER: Joint Reliability and Security Assessment for Split Computing at the Edge
SummaryThis paper presents a unified framework for jointly evaluating the reliability and security of Split Computing, where deep neural network inference is divided between edge devices and cloud servers. Reliability is measured with neuron-level fault injection using Mean Relative Accuracy Degradation, and security with feature-map-aware adversarial attacks using Attack Success Rate. Tests on ten ResNet-50 configurations show MRAD of 44.3% to 61.2% and attack success rates up to 98.8%, with joint metrics revealing vulnerabilities hidden by separate analysis.
Enrico Magliano, Giuseppe Esposito, Amir Hossein Shahdadian et al.
In briefCOPEX: Testing how well LLMs resist harmful context across MCP layers
SummaryThis paper presents COPEX, a benchmark that isolates the language model as the MCP client by fixing the surrounding agent stack and varying only the tool-selecting model. It covers 25 attack types across 125 scenarios spanning four entry surfaces: model/agent, client, server/tool, and transport. Across nine models and 3,375 trials, the mean attack success rate is 64.4%. Combined input and context scanning reduced mean attack success by 49.6% on an eight-attack defense subset compared with the undefended setting.}
WhyIsolates the model as MCP client to benchmark adversarial context attacks across 125 scenarios and 3,375 trials, a well-evidenced contribution mainly for MCP security.
Nahom Birhan, Mehrdad Rostamzadeh, Sidhant Narula et al.
In briefA cheat-sensitive routing method that hides destinations in quantum networks
SummaryIntermediate nodes in quantum networks distribute entanglement but may learn which users are connected. The paper proposes a minimal two-call routing primitive in which Alice links with one of several clients while testing whether the provider Bob has disturbed a coherently encoded request. The construction adapts the hidden-order mechanism of quantum private queries and uses a private matching qubit held by the selected client. It detects an explicit destination-reading attack with nonzero probability, but does not yet give a quantitative information-disturbance tradeoff or composable security.[]
In briefATLAS: A Compact Lattice-Based Signature Scheme Using Module-LWR
SummaryATLAS is a lattice-based digital signature scheme whose security rests on the hardness of the Module Learning with Rounding (MLWR) problem. Its public key is derived by deterministic rounding rather than adding an error term, which reduces key-generation cost and secret-key storage. The scheme targets 128, 256, and 512-bit classical security levels and uses power-of-two moduli, and it supports both SHAKE and KDF-SM3 as interchangeable symmetric back-ends.
Karthick Srivatsan, Debranjan Pal, Anindya Ganguly et al.
In briefGrayShield: Bit-Level Sanitization to Protect Transformer Models in the AI Supply Chain
SummaryThe paper notes that the least significant bits of 32-bit floating-point weights in Transformer models such as BERT and ViT can be misused as covert channels to hide malicious payloads. The authors propose GrayShield, a lightweight, post-training, data-free method that overwrites this mantissa-LSB channel with a Gray-code-guided low-transition sequence. Tested on four model presets and two real malware payloads, it keeps accuracy impact below 1% and reduces recovery by about 49.96 percentage points under five attacker variants.
Armstrong Foundjem, Tsung-Hsien Chuang, Foutse Khomh et al.
In briefRe-examining classic Sigma protocols through MPC-in-the-Head
SummaryThis paper reinterprets classical Sigma protocols through the MPC-in-the-head paradigm, without constructing new schemes. It maps commitment-challenge-response steps onto virtual parties' views, secret sharing, commitments, and MPC consistency checks. Covered protocols include algebraic schemes such as Schnorr and Chaum-Pedersen, and combinatorial schemes such as Stern and GMW for graph 3-coloring.
In briefModeling How Users' Deletion Requests Can Shape Machine Unlearning Outcomes
SummaryThis paper examines how users exercising the "right to erasure" might influence AI model behavior through machine unlearning. It defines two user behaviors when requesting data deletion, adaptivity and collectivity, and theoretically compares groups that do and do not display them using results from stochastic optimization. The authors also show how data valuation techniques can be used to design deletion requesters that significantly alter model behavior, and their computer vision experiments examine the differential effects of these behaviors.
In briefCyTReX: An Explainable AI Framework for Threat Reasoning in DER Networks
SummaryThis paper presents CyTReX, a framework that turns anomaly alerts from distributed energy resource networks into ranked threat hypotheses for security analysts. It constrains large language model reasoning with a structured evidence packet combining detection outputs, SHAP feature attributions, surrogate rules, and threat intelligence. Each hypothesis is meant to trace back to explicit evidence, and incomplete or conflicting evidence is reported. Evaluation across five configurations shows the complete pipeline gives the richest evidence-grounded reasoning context.
Damilola Popoola, Souradeep Bhattacharya, and Manimaran Govindarasu
In briefMachine-verified proofs of ORAM correctness, security, and failure bounds
SummaryThis paper uses the EasyCrypt proof assistant to give fully mechanized proofs of correctness and security for Simple ORAM and Path ORAM. The authors state these are the first machine-checked proofs covering an ORAM construction's correctness bound, meaning its failure probability. They also provide a general library for recursive composition of ORAM constructions to reduce client storage, applied to Path ORAM.
WhyFirst machine-checked proofs of ORAM failure bounds, refining and slightly improving existing paper proofs for Simple and Path ORAM.
Manuel Barbosa, Gilles Barthe, Gustavo Delerue et al.
In briefSelf-Reflection Fine-Tuning: Teaching AI Agents to Resist Prompt Injection Attacks
SummaryThis paper proposes Self-Reflection Fine-Tuning (SRFT), a training method that helps language model agents learn from their own failures under adversarial conditions. Instead of only imitating expert behavior, agents are shown compromised trajectories created by injected attacks, and an expert model generates reasoning that contrasts unsafe and optimal actions. The authors implement this as SR-Agent on Llama-3.1-8B-Instruct and Qwen3-8B, and report reduced attack success rates on static and adaptive benchmarks while preserving task performance.
In briefAutonomous Active Directory Attacks via a Multi-Model Harness: A NeuroSploit Benchmark on GOAD
SummaryThis paper benchmarks NeuroSploit v4.2.0, an open-source Rust autonomous pentest harness, against GOAD, a deliberately vulnerable multi-forest Active Directory lab. The harness uses 22 AD-specific agents and 7 multi-stage attack-chain playbooks spanning enumeration through cross-forest trust abuse. It is compared with direct large-language-model invocation, and the authors report 96–100% technique coverage for the harness versus 21–54% for direct invocation.
In briefLearning to Watermark Speech Synthesis Against Reconstruction Attacks
SummaryThis paper proposes Thrive, a multi-bit generative watermarking framework for modern autoregressive text-to-speech systems, designed to trace synthesized speech back to the requesting user. The authors find that no single watermark carrier stays reliable across reconstruction models, so Thrive combines Rise, which injects watermarks into intermediate representations, with Care, which selects waveform or spectral experts per bit. Experiments report 87.6% average recovery accuracy under reconstruction attacks, with source attribution supported over candidate sets of up to 10,000 identities.
In briefExplicit nonlinear functions that beat the Fourier bound for low-agreement vectorial maps
SummaryThis paper studies how to build vectorial maps over F_2 that agree with every affine map on as few inputs as possible. The classical bent-function and Fourier method cannot give agreement below about 2^{n/2}. The authors construct functions that go beyond this bound, and extend the results to agreement with degree-d polynomial tuples and to all finite fields.
WhyBeats the Fourier bound by improving nonlinearity limits to (1+γ)^n, extended to degree-d polynomials via algebraic methods linked to graph combinatorics.
Swastik Kopparty, Rishabh Kothary, Shanthanu S. Rai
In briefAutomated search for periodic functions in quantum attacks on ciphers
SummaryThis paper studies automated search for periodic Boolean functions used in Simon's-algorithm-based quantum attacks, covering distinguishers and key-recovery attacks. It refines an existing symbolic search model by adding fixed input differences, differential propagation, and probability constraints. The authors extend periodic distinguishers for TWINE and LBlock to 12 rounds, and report a 12-round distinguisher for LBlock-S and a full-round distinguisher for ALLPC. For key recovery, the model is extended to key-dependent values and the MISTY L-FK attack is extended from 5 to 6 rounds.
In briefBeyond Mosca’s Heuristic: Supported Is Not Protected in Post-Quantum Migration
SummaryThis paper proposes assessing post-quantum migration per data path rather than per asset, tying verdicts to evidence. It models key lineage as an algebra on break dates and derives four ordered labels from two strong-Kleene evaluations. The authors validate their external probe on 22 configurations across five server stacks built on three TLS libraries, finding that the same nominal configuration behaves differently across implementations.
In briefRethinking watermark teachers for language model fingerprinting
SummaryThis paper examines LLM fingerprinting, which embeds a statistical watermark into model weights so owners can identify their models behind black-box APIs. The authors find that a recent protocol's utility evaluation understates text quality loss in open-ended generation. They propose near-tie restriction, which limits watermark bias to tokens close to the base model's top prediction, improving the trade-off between detectability and text quality.
In briefEncrypted Statistical Modeling with Fully Homomorphic Encryption in R
SummaryThis paper shows how two R packages, openfhe.R and homomorpheR, enable statistical analyses on encrypted data so multiple parties can jointly model without sharing raw records. Validation studies cover distributed stratified Cox regression and federated Cox-lasso using consensus ADMM, where only the cross-site update is encrypted. The parties are assumed honest-but-curious, and threshold key generation is used.
In briefFrom Temporary Access to Persistent Surveillance: Matter Smart Home Security Risks
SummaryThis paper examines Matter, an open smart home standard that uses cryptography for device authentication and data confidentiality, and how its openness exposes protocol and implementation details. The authors show that an attacker with temporary physical access can exploit design and implementation flaws to extract credentials and impersonate devices, maintaining surveillance and control after leaving. A proof-of-concept on a simulated smart home with commercial devices and development boards validates the attack, and four mitigation strategies are proposed.
In briefSPIN: Fast Error-Correcting Codes for Cryptographic Correlation and Commitment Schemes
SummaryThis IACR ePrint preprint introduces SPIN (Single-Permutation INterleaved) binary codes for pseudorandom correlation generators and polynomial commitment schemes. The main structured family has rate 1/2 and O(N) bit operations for both ordinary and transposed encoding, with minimum distance above 0.11N with high probability. The authors report that their encoder is about 3.4 times faster than the original BAA codes, and that replacing Ligerito with SPIN in the Flock system improves prover throughput, at the cost of larger proofs and slower verification.
WhyProposes SPIN codes with linear-time encoding and distance guarantees, backed by Lean verification and finite-length certification, with practical impact on PCGs and polynomial commitments.
Stanislav Peceny, Rahul Rachuri, Srinivasan Raghuraman et al.
In briefHow gradients add to text leakage in split language models, counted per token and per document
SummaryThe paper shows that in split learning for language models, an observer can rebuild most of a client's text from the activations sent to the server and the gradients returned. On GPT-2, an attacker recovers 94.20% of tokens from activations alone and 97.38% with gradients, while exact recovery of 32-token documents rises from 13.71% to 37.77%. The authors recommend reporting leakage both per token and per document, and treating what a split model transmits as sensitive as the original text.
WhyShows gradients substantially increase text leakage in split LMs, measured per token and per document across GPT-2 and Qwen3 experiments.
In briefFast linear codes over large fields using addition-only or small-coefficient encoders
SummaryThe paper constructs fast linear codes over large fields with encoders that use only field additions or small integer coefficients. Encoding applies a local precode followed by rounds of a random permutation and a linear recurrence scan with a short feedback window. At dimension 2^20, rate 1/2, and p=2^128-159, the authors prove relative distance bounds with stated failure probabilities and report single-core encoding times.
WhyProposes addition-only linear codes over large fields with rigorous distance bounds and timing comparisons, novel and well-supported, though impact is confined to specific encoding settings.
In briefCodes Near the Gilbert–Varshamov Distance Bound
SummaryThe paper proves that Expand–Accumulate (EA) error-correcting codes approach the Gilbert–Varshamov distance bound as code length grows, over binary and fixed finite fields. It analyses the encoding cost and the probability of sampling a bad code at fixed rate. Finite-length results at specific parameters are certified with interval arithmetic. The work provides no decoder and no complete protocol-security proof.
WhyProves Expand-Accumulate codes approach the GV bound with certified finite-length results, improving constants and failure bounds; novel and rigorous, but limited practical impact.
In briefAn input-fed AES-round family for fixed-length hashing
SummaryThis paper proposes a hashing construction that injects the input after every AES round, aiming to avoid exposing a public permutation in secure computation. The base function H128 maps 128 bits to 128 bits using ten AESENC-style rounds without key expansion. The authors prove a three-round integral distinguisher and estimate a five-round meet-in-the-middle attack, with other results given as reduced-round evidence. Extensions include a tweakable variant H128tw and a 256-bit variant H256, along with analyses of related attack mechanisms.
In briefPrivacy audit of synthetic gene expression data using a unified weighted-distance attack framework
SummaryThis paper red-teams synthetic gene expression data derived from TCGA bulk RNA-seq, released by the ELSA Health 2026 Challenge, by testing membership inference attacks. The authors unify five no-box attacks in one weighted-distance framework that differs only in how genes are weighted. Against a conditional variational autoencoder, spectral residualization raised pan-cancer TCGA AUC from 0.8251 to 0.8951 and TPR at 1% FPR from 0.3842 to 0.5970. Biological pathway priors did not transfer across targets.
In briefTellTail: Identifying the Hidden Embedding Model Behind Black-Box Search Systems Using Queries
SummaryThis paper presents TellTail, a method for identifying the retriever (embedding model) behind black-box retrieval systems using only queries. It is evaluated on 53 retrievers under three access levels: full ranked results, unordered top-3 results, and only generated answers. The method identifies the deployed retriever perfectly from full rankings, in 94.3% of top-3 attempts, and in 92.5% of cases from generated answers, and it also works against the OpenWebUI RAG system. The authors argue that retrieval-based systems leak their embedding model identity, which can expose intellectual property and enable reconnaissance for model-specific attacks.
WhyProposes a novel query-only fingerprinting attack exploiting poor transferability, evaluated across 53 retrievers with strong accuracy in multiple access settings.
In briefSERA-IDS: Intrusion detection using small language models that learn from structured past experience
SummaryThe paper proposes SERA-IDS, a framework in which a small language model learns structured rules from misclassified network flows. At test time, rules matching the query flow's numerical conditions are retrieved and supplied as evidence. Using three locally deployable small models without fine-tuning, the authors report large macro F1 gains on the NF-BoT-IoT and NF-ToN-IoT datasets.
In briefPower analysis attack on masked Falcon: masking the preimage isn't enough
SummaryThis paper presents a new power analysis attack against a Falcon implementation whose preimage computation is protected by masking. It shows that leakage during share recombination, examined through the ratio of real to imaginary parts of the public hash polynomial, can recover the secret key. Two variants are proposed: a chosen-message attack and a non-chosen-message attack. Experiments on the ELMO simulator for ARM Cortex-M0 report a 98.3% success rate with 4,000 traces, and a rejection-sampling-based countermeasure is suggested.
In briefSCRM: A Practical Framework for Managing Cyber Risks to Space Systems
SummaryThis paper introduces the first Space Cyber Risk Management (SCRM) framework for systematically analyzing and mitigating cyber risks to space infrastructure, such as satellite communications. The framework models space infrastructures, missions, and cyber attacks, and provides algorithms for mission risk analysis and hardening. A case study using real-world attacks on a satellite communications testbed found that cascading effects must be addressed, the framework can effectively harden missions, and NIST security controls can effectively mitigate risks.
In briefLocalize-and-Detect: Auditing Hidden Task-Level Poisoning in Fine-Tuned Language Models
SummaryThe paper studies task-level poisoning, where an attacker manipulates an instruction-tuned language model to produce biased content on a specific task without an explicit trigger. The authors propose Localize-and-Detect, a two-stage black-box auditing method that uses only outputs from the base and fine-tuned models. It first localizes the target task by finding where next-token distributions differ most, then searches those tasks for biased content that appears in the fine-tuned model but not the base model. Evaluated on 216 poisoned models from two model families, the method localizes target tasks and detects biased content effectively, with few false positives on clean models.
In briefAdaptive Co-Serving LLM Watermarking on Modern Inference Engines: a study co-designing LLM watermarks with inference infrastructure to balance quality, detectability, and serving efficiency.
SummaryThe paper notes that existing LLM watermarking methods focus on algorithms and often add auxiliary models or external tools, which increases latency and memory use. It proposes SWIFT, which integrates generation and watermark construction in a shared backend, runs watermarking concurrently through asynchronous co-serving and adaptive scheduling, and uses vLLM optimizations. Reported results include a utility score of 4.87, 99.65% detection accuracy versus 76.65% for SynthID, up to 97.7% detection under watermark removal attacks, and 5.9x lower latency than SafeSeal.
SummaryThe paper shows that if quantum commitments exist, then either unitary synthesis has no polynomial-time solution or BPP is not equal to NEXP. It proposes new definitions for the unitary complexity classes unitaryP and unitaryPSPACE. It also shows that unitaryPSPACE can generically erase garbage qubits.
WhyShows quantum commitments existence implies either no efficient unitary synthesis or BPP≠NEXP, with rigorous proofs and new unitary class definitions.
In briefPoCoFL: A policy-compliant federated learning framework that verifies client and aggregator behavior
SummaryFederated learning keeps training data local, but it does not ensure that client contributions follow policy or that aggregators process admitted contributions correctly. The paper presents PoCoFL, which separates FL type, policy semantics, and cryptographic realisation. Clients prove compliance using commitments and non-interactive zero-knowledge proofs, and aggregators prove they applied the chosen aggregation policy. The framework is demonstrated through vanilla, continual, personalised, and threshold-encrypted FL, with proof-of-concept implementations and evaluation of policy enforcement effects.
In briefBeware EviLLM: A study of attacks that inject vulnerabilities into AI-generated code
SummaryThis paper examines a realistic threat in which a third-party attacker compromises an AI code generation pipeline to deliberately introduce software vulnerabilities, which the authors call the EviLLM attack. The authors implemented two attack instances that need only access to the underlying large language model through a compromised account or browser, and can inject vulnerabilities from 13 CWE classes. In a user study, most participants did not notice the injected vulnerabilities.
WhyIntroduces a new third-party threat model for deliberate vulnerability injection via compromised LLM pipelines, validated by a user study with broad implications.
Zeezoo Ryu, Simon Chung, Muhammad Faraz Karim et al.
In briefQuantum Fire with Delegated Cloning: A cryptographic primitive where copying quantum states needs a separate key
SummaryThis paper studies quantum fire, quantum states that can be cloned efficiently but resist reconstruction from classical communication alone. The authors introduce delegatable quantum fire, in which cloning requires a separate key, and give two constructions in the classical-oracle model. The first uses a classical secret key, while the second, called torch-fire, uses quantum cloning keys (torches) that enable cloning without being splittable or delegable. The authors claim that an efficient adversary with m torches cannot, except with negligible probability, let more than m non-communicating parties each clone a fresh challenge flame.
Rohit Chatterjee, Ananta Mukherjee, Vir Pathak et al.
In briefConstant-Rate Certified Deletion: a framework for verifiably deleting encrypted quantum data at a fixed cost per bit
SummaryThis paper presents a unified framework that upgrades many cryptographic primitives to support constant-rate certified deletion. Earlier constructions needed a linear number of qubits per encrypted bit, whereas this work gives the first constant-rate constructions in the plain model that preserve everlasting security. The framework covers BB84-style all-or-nothing primitives and primitives built from subspace coset states, and under the hardness of SIS it adds public verifiability.
WhyGives first constant-rate certified deletion in the plain model with everlasting security, generalized across many primitives.
Kai-Min Chung, Tzu-Hsiang Huang, Wei-Hsiang Hung et al.
In briefThreat-Preserving Representation Sensitivity in Agent-Security Benchmarks
SummaryThis paper examines whether the attack success rate used to score LLM-based agent security also depends on how the agent-visible representation, such as tool names, is written. The authors introduce threat-preserving representation sensitivity (TPRS), which measures ASR changes when the task, harmful action, policy, and evaluation remain fixed. Experiments on Agent Security Bench, MCPTox, and AgentDojo show that representation changes can shift ASR by several to over ten percentage points, so the authors argue robustness claims should rest on multiple threat-preserving representations rather than one score.
Neeraj Karamchandani, Piyush Nagasubramaniam, Xinhong Xie et al.
In briefA secure dToF LiDAR chip that resists spoofing attacks at the sensor level
SummaryMany commercial direct time-of-flight LiDARs can be spoofed by injecting high-frequency laser pulses, which can erase pedestrians from the point cloud. This paper proposes Dual-Domain Fingerprinting, which randomizes pulse time intervals and amplitude ratios to reject spoofed echoes, along with an event-driven analog front end and a time-modulated laser driver. A 16-channel 65-nm CMOS prototype achieves up to 120 m ranging and 3.1 mW AFE power per channel. In a proof-of-concept test on measured data, 73% of the point cloud was protected under spoofing attack, compared with 0% without DDF.
In briefECLIPSE: A Working Implementation of a Prime-Degree Isogeny Signature Scheme
SummaryThis paper implements ECLIPSE, a prime-degree isogeny signature construction described by the PRISM authors, using the SQIsign round-3 primes. It provides a verifier, a canonical wire format with a strict decoder, randomisable keys, and two independent implementations that accept each other's signatures. The authors also show that a MIKE key pair can serve as an ECLIPSE key pair. Signatures are 206 bytes at NIST level I, and the formal strong-unforgeability argument is left to future work.
In briefReasoning models are accurate but unreliable at causal identification
SummaryThe paper examines whether reasoning models can tell if a causal effect is recoverable from observational data. The authors build CERTID, which uses the sound and complete identification algorithm ID to certify identifiability and checks returned formulas against structural causal models with exactly known interventional distributions. Evaluating three frontier models on 1,200 certified instances, they find accuracy is a poor proxy for soundness, with the false-claim rate on non-identifiable queries varying seventeen-fold across models.
WhyBuilds provably non-identifiable benchmarks certified by the complete ID algorithm, revealing accuracy-soundness gaps across models.
In briefPrivDev: a study linking static-analysis data types to the DPV privacy vocabulary
SummaryStatic-analysis scanners can find personal-data types in source code but lack links to standard privacy vocabularies. The paper maps 122 Bearer CLI data types to DPV-PD categories and to potentially relevant GDPR provisions, using exact-label matching for 43 types and a retrieval-grounded LLM for the remaining 79. The output is an RDF knowledge graph with 118 ODRL policy resources, validated through several gates and human annotation, with agreement scores between 0.68 and 0.88.
Simon Bernbeck, Ricardo Ramalho, Matheus Amendoeira et al.
In briefCertified Mechanistic Edits: Guaranteed Skill Removal and Preservation
SummaryThis paper proposes a way to formally certify mechanistic edits to neural networks, such as ablations, weight edits, and activation steering. It proves that disabling a circuit removes one skill and preserves another for every input in a continuous region, demonstrated on networks from small ReLU models to a standard softmax and LayerNorm transformer. The authors use sound bound propagation to handle about nine times the input-perturbation dimension an exact solver can manage, and prove that no finite deterministic black-box test can certify removal.
Md Sazid Uddin, Md. Khairul Alam Mazumder, M. F. Mridha
In briefA symmetric cipher built on Dirichlet convolution over finite fields
SummaryThis paper proposes a new symmetric-key cipher for encrypting digital data, claiming fast operation, low memory use, and resistance to classical, AI-assisted, and quantum attacks. The scheme is based on generalized Dirichlet convolution over finite fields and is analyzed for security against plaintext attacks from an information-theoretic view. Its nonlocal structure permits plaintext salting, allowing controlled key reuse. The authors state that over F_p with p>2 the cipher achieves information-theoretic security under key reuse, while over F_2 some information leakage remains, giving a finite key-reuse budget.
Artur Sowa, Elias Hassani Sangani, Francis Bui et al.
In briefCorrectGuard: Estimating Correctness of Black-Box Security Guardrails Without Viewing Inputs
SummaryThis paper introduces CorrectGuard, a framework that estimates whether black-box security guardrail decisions are correct when neither humans nor models can inspect user inputs. An independent evaluator is trained only on labeled data that can be viewed, without access to the guardrail's internals. Tested across 13 safety and security datasets, in-context learning and finetuning approaches improve error identification, and the correctness scores can also rank decisions and support abstention.
Adam Faulkner, Nil-Jana Akpinar, and Matthew Dressman
In briefPassing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents
SummaryThis paper examines whether public benchmark scores for small prompt-injection detectors that screen LLM agent tool outputs predict their behavior inside an agent. The authors replay ground-truth tool calls from AgentDojo and tau-bench, then evaluate fifteen detectors and two LLM judges. Detection rankings transfer poorly between benchmarks, while false-positive rates on tool outputs transfer between the two agent benchmarks.
WhyShows public benchmark detector rankings fail to transfer to agent tool outputs, backed by differential-replay labels and fifteen-detector comparisons.
In briefPersona Guardrail: A Production Defense Framework for AI Agents
SummaryThis paper presents Persona Guardrail, a runtime defense framework that checks the inputs and outputs of customer-facing AI agents against semantic allowlists and blocklists, keeping them within their intended functions. It also introduces PAGE, a benchmark for testing function-specific guardrails on benign, adversarial, and out-of-domain interactions. Compared with a generic LLM-based guardrail, the authors report overall accuracy rising from 85.7% to 95.9%, out-of-domain detection from 57.3% to 93.5%, and false-approved rate falling from 25.0% to 4.7%. The framework is reported as currently deployed in production.
Bijeeta Pal, Sridhar Reddy Maddireddy, Muhaimin Bin Munir et al.
