In briefWhose Interests Does a Proactive Agent Serve? Provider-Side Indirect Prompt Injection
SummaryThis paper studies how an external provider could exploit proactive personal agents that make recommendations and offer follow-up help to steer users toward the provider's own target. The authors describe three mechanisms, Target Control, Private Binding, and Prospective Support, and test them across three environments and six simulated user models. The full attack raised target authorization in every tested combination, with a macro gain of up to 77.4 percentage points. The work concludes that capabilities built to serve users can be redirected toward objectives outside the user-agent relationship.
WhyIntroduces a new provider-side injection attack surface, validated across three environments and six user models, with moderate experimental scale.
In briefWhat a policy gate can and cannot know: limits of cross-platform command adjudication
SummaryThe paper studies a policy gate that decides ALLOW, ASK or DENY from a typed, realised action without parsing shell syntax, replicating an earlier Windows benchmark on Linux. A frozen 61-case table passed fully with no false allows, and the mutation campaign killed 46 of 50 mutants (92.0%). When consulted by the executor, 25 escapes dropped to zero without blocking any benign payload. The authors also report that credential verification scans its entire ledger, incurring accumulating cost, and describe the fix they would make.
In briefWhich image property carries image-to-text jailbreaks? A controlled breakdown of attack factors
SummaryThe paper examines image-side factors in four published image-to-text jailbreak attack families, using a 313-prompt StrongREJECT slice and five multimodal models, plus an appendix evaluation of InternVL3.5-8B. Bare harmful text queries produce little attack success, while attack images substantially increase it. Per-tile entropy and JPEG size do not reliably separate attack tiles from size-matched benign distractors, and removing query-specific relatedness lowers attack success by about 0.12 on Qwen3-VL-8B. The conclusions remain conditional on an automated rubric judge.
Boyuan Chen, Yehia Dawoud, Hailemariam Mersha et al.
In briefTrapdoor permutations with full key and message domains from permutable PRPs
SummaryThis paper extends Shmueli and Zhandry's permutable pseudorandom permutation approach to build puncturable trapdoor permutations with full message and per-instance key domains in the common-reference-string model. The family supports master trapdoor derivation and two-level puncturing. In the random-oracle model, it yields deterministic identity-based encryption and identity-based signatures, and gives a direct construction of hard-on-average End-of-Line instances.
WhyExtends Shmueli-Zhandry to full-domain, two-level puncturable trapdoor permutations with three applications; novel, but relies on strong assumptions and theoretical proofs.
In briefBlocking Staged Prompt Injection Before Harmful Agent Actions
SummaryThis paper studies how long-horizon AI agents can be attacked by indirect prompt injection spread across multiple workflow stages. The authors built an automated attack pipeline and found confirmed attacks against Claude Code and Codex across several scenarios. They propose a pre-action auditing method, Path-Aligned Attribution (PAA), which is training-free and decides Pass or Block before a consequential action takes effect, reporting higher block recall and lower false-block rates than compared auditors.
WhyIntroduces staged prompt injection and a training-free pre-action auditor, outperforming baselines on a 479-pair benchmark with paired significance; impactful for long-horizon agent security.
In briefWhere the audio jailbreak lives: a controlled frequency and depth audit of AdvWave-P on Qwen2-Audio
SummaryThis paper audits claims about which frequency bands and decoder layers matter for AdvWave-P, an additive audio jailbreak attack on Qwen2-Audio. The authors mask frequency components of the perturbation in the STFT domain and measure attack success on 520 AdvBench prompts, with 76.7% of adversarial inputs judged as jailbreaks. They find the apparent frequency ranking depends on how bands are partitioned, and a finer-resolution result remains unresolved without a matched control. The authors conclude the results support partition-aware auditing of frequency claims, but the layer association is not a causal localization.
Boyuan Chen, Minseok Kim, Sohaila Abdulsattar et al.
In briefVulValidate: Checking Function-Level Vulnerability Labels with Executable Evidence
SummaryLearning-based vulnerability detectors need accurate labels, but datasets built from vulnerability-fixing commits can mark functions as vulnerable just because a security patch changed them. VulValidate uses LLM agents to coordinate dynamic analysis tools and build vulnerability-triggering experiments from runtime feedback. The authors audited 35,849 instances labeled vulnerable in BigVul, PrimeVul, and DiverseVul, confirming 20,510, correcting 6,819 labels, leaving 7,981 undecided, and failing to measure 539. Corrected labels lowered F1 for all five tested detectors under fixed parameters.
WhyUses LLM agents with dynamic analysis to audit tens of thousands of dataset labels, validated by blinded expert review and retraining experiments.
In briefPrivate component-by-component learning: a differentially private framework for realizable settings
SummaryThis paper studies differentially private learning where hypotheses are specified by k components in a realizable setting. It uses the LabelBoost procedure to restore exact realizability and recycles data through two alternating reservoirs, keeping overhead to roughly √k/ε. Applied to learning d-dimensional halfspaces on a finite grid, it improves the sample complexity bound, and it also yields proper private learners for Boolean compositions of classes.
In briefCooldown Landmines: Cross-tenant attacks that disrupt shared LLM model access
SummaryThis paper studies how shared cooldown records in LLM gateways can let one tenant's request failures restrict other tenants' access to working model deployments. The authors identify two attacks against LiteLLM and propose an origin check plus tenant-scoped cooldown as fixes. In their experiments, victim fallback after recovery dropped from 54/60 to 0/60 with tenant scoping.
In briefHow known open-source vulnerabilities affect security inside AI agent systems
SummarySoftware agents increasingly rely on open-source components when running tools and interacting with external systems, so flaws in those dependencies can spread through tool outputs, agent state, and information shown to the model. The paper studies how known OSS vulnerabilities behave when exercised in agent workflows, combining vulnerability-aware semantics, differential execution of vulnerable and fixed software, and multi-layer runtime provenance. The approach distinguishes realized vulnerability effects and identifies the furthest layer they reach across diverse scenarios. Applied to documented workflows in a real-world agent framework, it uncovers several security effects originating from known vulnerabilities in its open-source dependencies.
In briefTARE: Measuring a Never-Poisoned Twin to Assess Backdoor-Defense Costs
SummaryBackdoor-defense leaderboards report clean-accuracy drops as removal costs, but these drops mix in the defense's effect on any model and the victim's starting point. The paper proposes TARE, which runs each defense on a never-poisoned twin sharing the same recipe, schedule and seed, and treats the twin's loss as the "tare" to subtract. The authors also release a patch, a signed tare table, and TARE-Z, a twin-free estimator for seed-stable defenses.
WhyProposes a never-poisoned twin baseline to correct backdoor-defense cost, with scheduler swap experiments exposing benchmark flaws; evidence is fairly strong and relevant to the subfield.
In briefLightweight drone-mounted 5G base stations: a reproducible OAI testbed on common ARM hardware
SummaryThe paper studies a drone-carried 5G base station in which the core network and central unit stay on the ground, and only the backhaul endpoint, distributed unit, and radio are airborne. Tests with Raspberry Pi 5 and Jetson Orin Nano as distributed units show Jetson keeping 88.4% of x86 split-DU Ethernet downlink throughput. The authors also release an OAI patch that sends emergency PWS warnings from the central unit to the distributed unit over F1 for reproduction.
In briefRotate once, read many times: output noise of multi-value bootstrapping
SummaryThis paper studies programmable bootstrapping in FHEW/TFHE schemes, comparing single-value mode, which uses one rotation per function, with multi-value mode, which shares one function-independent rotation across all functions. It presents a unified noise analysis covering both modes and compares two factorization designs, the canonical cofactor and the pivot, by their noise costs. The results are measured on a publicly available complete implementation.
In briefRemoving query-depth losses from O2H theorems via amplitude amplification
SummaryThe one-way to hiding (O2H) theorems are widely used to prove security in the quantum random oracle model, especially for key encapsulation mechanisms. Existing bounds lose a factor depending on the adversary's query depth. This paper presents a generic amplitude-amplification technique that removes these depth-dependent factors for several O2H variants, including SC-O2H and MRE-O2H. It identifies conditions under which the enhanced theorems can replace the originals in existing proofs, such as IND-CCA proofs for Fujisaki-Okamoto U-transform variants.
WhyUses amplitude amplification to remove depth-dependent losses in SC-O2H and MRE-O2H, with applications to KEM IND-CCA proofs and analysis of cost.
In briefHidden Risks of Jev: A Study of Its Security, Privacy, and Dual-Use Concerns
SummaryThis paper studies security and privacy risks when Jev, a system that turns natural-language questions into typed answers, is used as a decision layer in applications. Using the official Jev API and a local model, NanoJev, the authors test prompt injection, backdoors from training data poisoning, and attacks that recover sensitive information from constrained outputs. They also evaluate Jev's use in detection tasks and misuse scenarios, finding it remains vulnerable to these threats while its decision capability can serve both beneficial and malicious purposes.
In briefRuntime Authorization for Self-Generated Subgoals in Long-Horizon AI Agents
SummaryThis paper examines how long-horizon AI agents that create their own subgoals, replan, and delegate work can stay within the task a principal approved, which per-tool permission checks alone cannot ensure. The authors propose version-bound witnesses for each goal-graph change and recheck every protected effect at an atomic commit boundary. In 96 matched cases, the complete mechanism committed no forbidden states in 48 drifted cases and completed all 48 benign counterparts.
WhyProposes runtime authorization of goal-graph mutations with several formal proofs, validated by state exploration and matched-case experiments, advancing agent permission control.
In briefStatic bootstrap placement for encrypted language model decoding
SummaryThis paper presents AR-HE, a system that runs the full text-generation loop on a server under homomorphic encryption, selecting each token and writing its embedding back into the encrypted state. The client sends one prompt and waits for the output. A single rule without search places all bootstraps, and the schedule skips unneeded work, packs shared bootstraps, and caches encrypted keys and values. On one NVIDIA H100, the authors report GPT-2 small generating a token in 544 seconds, down from 4715 seconds without optimization.
In briefWLPA: A framework for allocating scarce quantum-safe link protection based on the weakest link
SummaryThe paper addresses how network operators can allocate limited quantum-safe protection, such as quantum key distribution, which is hardware-scarce and costly, across links in a network. It presents WLPA, an algorithm that assigns postures under hardware, latency, and compliance constraints, based on the idea that a distributed job's security is set by its weakest active link. The authors identify when common per-link heuristics match the optimum and when they fail, and report validation across 19 experiments.
In briefWhat drives lattice key generation cost on a Cortex-M4: a controlled attribution study
SummaryThis paper examines which implementation choices cause the cost of lattice key generation on a Cortex-M4 microcontroller, beyond total cycle counts. Using paired measurements on an STM32L476RG, it studies public data structure, when candidate acceptance is checked, and whether transformed secret state is retained, testing these across structured-LWR, ML-KEM and HAETAE-5. The authors conclude that public structure defines per-candidate computation, while admission checks and transform lifetime determine how many candidates run and how often transformed representations are rebuilt.
In briefBounded Reasoning: Comparing Humans and AI in Cyber Defense
SummaryThis paper studies a sequential cyber-defense game on an attack graph, where human or reinforcement-learning (DQN) defenders protect cloud assets against a DQN attacker. It compares four defender settings using 80 Mechanical Turk participants and matched automated simulations. Human defenders were more likely to reselect a node after a successful defense than after a failure, while automated defenders did not show this asymmetry. The authors argue that averaged task scores can hide these behavioral differences.
In briefInvisible Ink, Visible Lies: Why Watermarking Can Make AI Chatbots Invent Facts
SummaryThis paper studies how text watermarks, which help identify AI-generated content, can reduce factual accuracy. In a retrieval-augmented setting where the correct evidence is present, six watermarking methods still produced watermark-induced hallucinations. The authors attribute this to token-level perturbations and attention drift during decoding, and propose two plug-in interventions that reduce factual errors by about 90% relative to watermark-only decoding at a matched detection rate.
WhyFirst systematic study of watermark-induced hallucination across six methods, with two mechanisms and plug-in fixes validated in controlled RAG experiments; broad impact.
In briefNTT Variant That Makes Galois Automorphisms Simple for Homomorphic Encryption
SummaryThe paper presents in-place butterfly algorithms for the negacyclic NTT and its inverse that output evaluations in an automorphism-compatible order. The algorithms share the structure of Cooley-Tukey and Gentleman-Sande and differ only in their precomputed twiddle factors. This ordering lets Galois automorphisms on double-CRT ciphertexts be applied via a cyclic shift or adjacent-pair swap, targeting CKKS and BGV/BFV schemes. The authors note this removes the need for a dedicated automorphism functional unit in FHE hardware accelerators.
Charanjit S. Jutla, Nathan Manohar, Guy Moshkowich
In briefDiscriminant-36 Humbert Form and Its Implications for Splitting Detection
SummaryThe paper computes explicit equations for genus-two curves with a maximal degree-n elliptic subcover, using a degree formula to fix the structure of the Humbert modular form for discriminant 36. It also computes the associated Siegel generators. The authors discuss consequences for isogeny-based cryptography, including deciding optimal (n,n)-splitting and bounding the cost of known detection routes.
WhyGives closed-form degree formula and explicit factorisation of chi10 for discriminant 36, substantially advancing splitting detection theory, though applicability is narrow.
In briefHardware-accelerated function secret sharing secure against malicious parties (VIGOR-DFA)
SummaryThis paper presents VIGOR-DFA, a trusted hardware accelerator for function secret sharing (FSS), a primitive used in two-party private inference and private information retrieval. It adds mechanisms, including a fresh authentication step, a freeze-before-challenge output check, and a one-time resource ledger with a release guard, to resist tampering and replay by a malicious host or GPU. The authors prove static malicious security with abort in a protected-module model and compare against a dealer-based malicious FSS, reporting latency and energy gains along with the cost of malicious security.
In briefPredicting cyberattacks using news and podcast data analyzed by AI language models
SummaryThis paper forecasts cybersecurity incidents by using geopolitical information from news articles and transcribed podcasts, which large language models convert into representations. A classifier trained on past incidents then predicts future ones. On a dataset of over 15,700 records, geopolitical data alone reached 71.4% ROC AUC. Combined with network measurements, it reached 81.3%, above the 77.5% of the prior network-only method.
In briefTracing AI-generated synthetic DNA with a hidden, position-independent watermark
SummaryGenomic language models can generate synthetic DNA with no record of its origin. The authors embed the SynthID tournament watermark in two such models, Carbon and GENERator-v2, and the detector searches both strands, all start positions and four window lengths, correcting for this multiple search. On a held-out cohort of 1,544 prompts, all 3,088 marked sequences per model were detected, including unedited sequences and those with one substituted, inserted or deleted base. The results show statistical detection only, not biological function, secret-key security, or robustness against an editor who knows the detector.
In brief"It Takes Two": Proof-of-Work Needs for Fiat–Shamir in the Random Oracle Model
SummaryThe paper studies two roles proof of work (PoW) plays in the Fiat–Shamir transformation in the random oracle model: challenge grinding, which needs non-amortizing PoW, and preventing diagonalization attacks, which needs strong PoW. It proves that a single PoW cannot be both strong and non-amortizing when the verifier is much cheaper than the prover. To address this, the authors propose an XFS-with-grinding transformation that composes a strong PoW with a non-amortizing one, yielding a non-interactive argument.
WhyProves a single PoW cannot be both strong and non-amortizing, and composes two PoWs for a new XFS-with-grinding transformation, a substantive theoretical advance.
In briefNot Self-Decidable: Why LLMs Cannot Set the Limits of What an Agent Verifier Can Check
SummaryThe paper studies how an agent verifier should separate rules that a fixed check can settle from rules that need a judge. Across six corpora, about 22,000 labels from four models show near-perfect agreement on obvious cases but divergent, opposite-direction errors on regulatory text, and shared over-claiming on a deployed credit agent's rules. The authors propose CoVer, which admits a predicate only if its synthesized check survives intervention, reads fields the agent cannot write, and holds under deterministic rewording. They argue self-decidability is a boundary the verifier must construct, not a capability to elicit from a model.
WhyArgues LLMs cannot self-determine their verifiable boundary, proposing CoVer gating; novel framing backed by about 22,000 labels across six corpora, though validation scope is limited.
In briefAttacks on Construction A lattices via hull dimension
SummaryThis paper presents an algorithm for solving the Lattice Isomorphism Problem between input lattices isometric to the Construction A lattice of a code C. It directly extends a method by Ducas and Gibbons (PKC 2023). The authors prove the run time is 2^{O(n)} with success probability 1+o(1) over a random choice of C. Unlike the earlier method, which is restricted to trivial hulls, this approach works for hulls of arbitrary dimension.
Jean-François Biasse, Alexandra V. Hostetler, Anuvrat Jaindungarwal
In briefPenumbra: Efficient adversarial search for finding where regulatory rules flip
SummaryThe paper introduces Penumbra, an adversarial search method for regulatory red-teaming that starts from a verified compliant response and expands edits until a two-evaluator committee changes its verdict. It outputs pairs of adjacent responses on opposite sides of the compliance boundary. Tested on a financial advisory constitution and a clinical triage constitution, it returned 144 and 49 pairs respectively, often differing by only a few words.
In briefLifting indistinguishability to keyed oracles, with compressed ideal ciphers and other applications
SummaryThe paper proves a generic lifting theorem: if two base oracles are indistinguishable under quantum queries, their keyed oracle versions are too, losing at most an O(q^2) factor in advantage. The authors use this to extend Carolan's compressed permutation oracle into an efficient compressed ideal cipher and prove preimage resistance of the Davies-Meyer compression function in the quantum ideal cipher model. They also give a modular construction that doubles the message length of any quantum-secure strong pseudorandom permutation.
WhyGives a generic quantum indistinguishability lifting theorem with optimal O(q^2) loss, applied to a compressed ideal cipher with full proofs.
In briefAPEX: Active Defense at LLM Agent Execution Boundaries (Paper)
SummaryThis paper addresses indirect prompt injection, where hidden instructions in content read by LLM agents at runtime can trigger harmful actions. It proposes defending at the execution boundary, where an agent turns internal state into external actions or outputs, using an authorization contract compiled before untrusted execution. APEX admits effects only when the contract justifies them and exposes unendorsed use before the effect commits. The authors report 0% attack success on five of six benchmarks and 0.56% on the sixth, compared against 13 baselines.
WhyShifts defense to execution boundaries using one authorization contract with evidence gating and deception exposure; achieves near-zero attack success across 13 baselines and under adaptive attacks.
In briefIndistinguishability lifting for keyed oracles and compressed ideal ciphers
SummaryThis paper proves a general lifting theorem: if two base oracles are indistinguishable under quantum queries, their keyed versions are too, losing only an O(q^2) factor in distinguishing advantage, where q is the number of queries. The authors use this to extend Carolan's compressed permutation oracle into an efficiently implementable compressed ideal cipher, proving preimage resistance of the Davies-Meyer compression function in the quantum ideal cipher model. They also present a modular construction that doubles the message length of any quantum-secure strong pseudorandom permutation.
WhyGives a tight generic quantum indistinguishability lifting theorem, yielding a compressed ideal cipher and preimage resistance proof for Davies-Meyer.
In briefWhen Talk Isn't Code: Comparing LLM Agents That Simulate and Develop Software
SummaryThis paper compares two ways large language models are used with network protocols: simulating an implementation in conversation and writing the actual program. The authors test 15 models on four protocol implementations using one attack suite. They find that simulation can serve as a first filter but cannot replace testing the generated code.
In briefStegoMemory: Agent Memory as a Hidden Covert Channel
SummaryThis paper red-teams AI agents to test whether their memory can secretly carry attacker-chosen strings from one session to another. Across 14,000 attack trials using seven steganographic encoding schemes, about 20.1% of trials recovered the exact hidden payload. Many of these covert transmissions also passed task-completion scoring and safety oversight. The authors conclude that memory integrity and information-flow control should be explicit security requirements for agentic systems.
