In briefEfficient Secure Federated Learning Using Information-Theoretically Secure Key Distribution: A Medical Imaging Study
SummaryThis paper addresses secure aggregation in federated learning, where classical key exchange used for additive masking is only computationally secure. Physics-based information-theoretically secure key exchange, however, is limited by key generation rates and storage time. The authors combine frozen backbones, knowledge distillation, and quantization to cut communication payload and key consumption. Tested on a real physics-based key distribution testbed with chest X-ray classification, the framework reduces key usage by about 35 times while maintaining predictive accuracy.
Ivan Don\`a, Hans H. Brunner, \'Alvaro Troyano Olivas et al.
In briefRAISED: Self-Distillation Makes LLM Agents More Resistant to Prompt Injection
SummaryThis paper addresses the vulnerability of tool-using language-model agents to indirect prompt injection, where untrusted external content can steer the agent's actions. The authors show that existing training-based defenses reduce attack success but substantially shift the model's output distribution, often degrading general capabilities and sometimes causing the model to skip steps needed to finish authorized tasks. They propose RAISED, which combines self-generated tool-use scenarios with self-distillation so the student matches the teacher's clean-context behavior on both clean and injected trajectories. RAISED substantially lowers prompt injection attack success rates in tool responses while preserving utility on agentic and general-purpose benchmarks.
Mohamed Dhouib, Clement Elliker, Alexi Canesse et al.
In briefWhether the Fujisaki–Okamoto transform can be instantiated with concrete hash functions
SummaryThe Fujisaki–Okamoto (FO) transform turns weakly secure public-key encryption into chosen-ciphertext secure schemes and underlies ML-KEM. This paper focuses on the key-derivation hash G and shows that the message-only implicit-rejection KEM variant is uninstantiable in general. It then gives sufficient conditions on G, based on a new property called distributional injective extractability, under which the hybrid-encryption version achieves standard-model IND-CCA2 security.
WhyProves uninstantiability of an FO variant and proposes a new hash property with random-oracle evidence, a substantial theoretical contribution with high relevance to ML-KEM.
In briefComparing open-source Gröbner basis tools on small AES equation systems over GF(2)
SummaryThis paper benchmarks 20 open-source Gröbner basis implementations against the proprietary Magma system on polynomial systems derived from small-scale AES over GF(2). It measures runtime, peak memory, success rate, and CPU usage across Easy, Medium, and Hard experiments. In the Hard tests, msolve and Singular's slimgb succeeded on all ten runs, with mean runtimes of 164 and 269 seconds versus 319 seconds for Magma. The authors conclude that open-source tools can be competitive, with relative performance depending on the input systems.
In briefRight Answers, Flawed Logic: Structured Auditing of LLM Vulnerability Reasoning
SummaryThis paper finds that LLMs analyzing software vulnerabilities often give correct verdicts while their free-form chain-of-thought explanations contain fabricated or unverifiable claims. The authors propose VERA, which has models output machine-readable Structured Reasoning Records that a multi-stage judge audits against eight reasoning failure modes. Evaluation shows reasoning flaws appear equally often in correct and incorrect verdicts, and VERA catches 87% of reasoning errors that free-form LLM-as-judge systems miss.
Boyue Caroline Hu, Kaivalya Ahir, Ronghao Ni et al.
In briefExplicit nonlinear functions that beat the Fourier bound on agreement
SummaryThe paper studies constructing vectorial maps F from F_2^n to F_2^m that agree with any affine map on as few inputs as possible. Classical bent-function and Fourier methods give agreement bounds no smaller than 2^{n/2}. The authors construct, for any γ>0, functions with m=O_γ(n) whose agreement with affine maps is at most (1+γ)^n. They obtain the same behavior for agreement with m-tuples of degree-d polynomials, improving prior Gowers-norm-based bounds. The approach connects to algebraic counting of polynomial system solutions and to combinatorial graphs and hypergraphs.
WhyA new connection to polynomial equation counting breaks the Fourier bound, giving exponential-level agreement bounds with solid theoretical justification.
Swastik Kopparty, Rishabh Kothary, Shanthanu S. Rai
In briefWatermarking: From Impossibility to Auditable Compliance
SummaryThis paper addresses EU AI Act Article 50(2), which requires machine-readable, detectable labeling of synthetic outputs, and argues that strong watermarking of free-form text cannot withstand adaptive removal. The authors propose an auditable alternative with a description-length robustness profile and finite-sample bounds, plus label-conditional conformal prediction sets that report whether a watermark is supported, not supported, or inconclusive. A small reproducible tournament-watermark simulation is used to check the claims.
Fernando Delbianco, Fernando Tohm\'e, Hugo Acciarri
In briefBreaking an Ideal Secret Sharing Scheme Based on Polynomial-Ring CRT
SummaryThis paper analyzes a compartmented secret sharing scheme proposed by Yang, Zhu, Fu and Xia at ISIT 2026, which uses the Chinese Remainder Theorem over polynomial rings and claims to be ideal. The authors identify three families of unauthorized subsets that can reconstruct the secret, concluding the scheme is insecure except in a degenerate parameter case. The flaw lies in a security analysis that ignores some published polynomials. Similar flaws are said to exist in the same first author's hierarchical schemes.
In briefMiniSHAKE: A Keccak variant using a smaller permutation width
SummaryThis note defines MiniSHAKE, a family of Keccak instances built on the Keccak-p[800, n_r=12] permutation. Most standardized Keccak use today relies on Keccak-f[1600] or reduced-round versions of it. The authors note that a smaller permutation width would be beneficial for cases such as hashing many very short messages.
In briefToward a Unified Benchmark for Misuse Monitoring
SummaryThis paper examines two misuse threats to LLM agents in multi-actor settings: decomposition attacks, which split a harmful request into innocuous sub-requests, and prompt injection, where a compromised tool delivers a malicious instruction. The authors propose monitoring the agent's actions and checking whether the first point of detected harm falls within a labelled harm window, and build a benchmark of about 6,200 conversation transcripts. Across 17 monitor configurations, action-framed monitors achieve AUCs of 0.95 and 0.99 on the two threats, while content-framed monitors reach only 0.52 on injection attacks.
In briefSatBleed: Security Risks in Off-the-Shelf Communication Modules for Small Satellites
SummaryThis paper presents the first in-depth security evaluation of widely used commercial off-the-shelf communication modules in small satellites. The authors build a threat taxonomy for attacks on the communication subsystem and analyze representative systems from various vendors, finding serious vulnerabilities in firmware, protocols, and architectural design. By correlating their findings with open-source telemetry data, they infer that at least 28 missions in orbit may be vulnerable to hostile takeover.
Ulysse Planta, Julian Rederlechner, Martin Strohmeier et al.
In briefDP-ES: Differentially Private Evolution Strategies for Automatically Optimizing Prompts
SummaryThe paper shows that token-by-token differentially private prompt optimization (DP-OPT) becomes unstable under tight privacy budgets. It proposes DP-ES, which evolves a population of full prompts, mutates them with LLM calls that never touch the private data, and spends privacy only on noisy evaluation. Under a conservative privacy guarantee, DP-ES reports higher and more stable accuracy on several benchmarks and runs faster than DP-OPT. The authors note that end-to-end validation on genuinely sensitive deployment data remains future work.
In briefStructural Tradeoffs in Witness Updates for Additive Positive Accumulators
SummaryThis paper studies additive positive accumulators, which keep a short public digest of a growing set while each element holds a membership witness that may need refreshing as new elements are added. The authors characterize the structure of the full labeled witness-update pattern, reducing the tradeoff to optimization over bounded-right-depth ordered binary trees. They show the same tree family governs both security lower bounds and constructive Merkle-forest implementations, and that it applies to many maintenance objectives.
WhyReduces witness-update tradeoffs to bounded-depth tree optimization, unifying prior maximum and total update bounds with matching constructions.
In briefFinding Where AI Repair Agents First Lose Security: Locating the Source of Silent Failures
SummaryThe paper proposes SAGE, a trace-based method that examines the security reasoning at each turn of an LLM agent's repair along with the reconstructed code history. It identifies the earliest turn where the repair diverges from the task's security intent. Evaluated on 95 confirmed silent failures from 3,684 repair traces, SAGE assigned an origin in 93 cases.
Wenji Bai, Muhammad Waseem, Zeeshan Rasheed et al.
In briefSecurity features in code: more than library calls
SummaryThis paper mines nine popular, large open-source Java systems to study how security features appear in source code. The authors manually inspected about 2.1 million lines and annotated 561 security features, totaling 183,395 lines, mapped to a 54-item taxonomy. They analyze feature size, scattering, tangling, and implementation patterns. The findings show security features are more than calls to external libraries: they can grow large, spread across the codebase, and tangle with each other, and external libraries still require substantial integration code.
In briefCross-Lingual Transfer of Attacks That Extract Memorized Personal Data from LLMs
SummaryThis paper examines whether data extraction attacks on large language models can recover personally identifiable information when prompts are written in non-English languages. The authors built a multi-domain PII dataset of social media handles, email addresses, and phone numbers, and translated the attack prompts into Italian, Spanish, French, and German. The attacks succeeded on translated prompts, and leakage across languages grew with a model's multilingual ability, while translations were aligned in similar internal representations, especially in middle layers. The authors conclude that modern LLMs have a security gap and call for more robust, language-agnostic sanitization strategies.
Alexandru Nazare, Agnese Profico, Nicol\`o Vania et al.
In briefOptimized LLL Algorithm: A Lattice Basis Reduction Method Without Orthogonalization, With Lower Complexity
SummaryThis paper improves the LLL lattice basis reduction algorithm, which has two drawbacks. Its standard size-reduction step does not guarantee that vector lengths do not grow, and its Lovász condition does not guarantee that adjacent vectors are ordered by length, so the first vector may not be the shortest, or some vectors may remain reducible. The authors present an optimized LLL algorithm that does not rely on Gram-Schmidt orthogonalization and reduces the complexity from O(n^4) to O(n^3). A probabilistic argument shows that the new algorithm runs in polynomial time.
In briefPRA-TLS: Remote attestation of client apps calling TEE enclaves
SummaryThis paper proposes PRA-TLS, an attestation protocol that verifies the client application invoking a Trusted Execution Environment (TEE) enclave. A trusted Attester Daemon measures the host environment and application code at runtime and sends these measurements as evidence to a remote Verifier. The enclave proceeds only when the software state is as expected and the application is verified as legitimate. The authors define attack models and security requirements, formally analyze security with the Tamarin Prover, and evaluate performance of a prototype built on Intel SGX.
Reina Sasaki, Yutaka Ishikawa, Atsuko Takefusa et al.
In briefOne-round threshold signing for XMSS and SPHINCS+ using fully homomorphic encryption
SummaryThis paper addresses the difficulty of splitting hash-based post-quantum signatures XMSS and SPHINCS+ among multiple parties. The signing algorithm is evaluated homomorphically under a threshold fully homomorphic encryption scheme, so any t-of-n parties can jointly produce signatures accepted by unmodified RFC 8391 and FIPS 205 verifiers. The authors report that online threshold XMSS signing takes 0.69 seconds, while threshold SPHINCS+ has about two orders of magnitude higher signing latency but over an order of magnitude lower setup latency.
In briefEfficient HQC on RISC-V: Mapping the Hardware-Software Design Space
SummaryThis paper explores how to implement HQC, a post-quantum key-encapsulation mechanism selected for standardization, on RISC-V processors. The authors introduce a parametrizable architecture framework and characterize 29,920 configurations across all three HQC security levels on FPGA. They report that the Pareto-optimal configurations outperform the prior state-of-the-art RISC-V HQC implementation, with trade-offs between LUT usage and latency and up to 10.6x fewer block RAMs.
Maximilian Sch\"offel, Johannes Feldmann, Elias Biehl et al.
In briefHidden backdoors in sparse autoencoders: a tampered add-on that can steer a language model
SummarySparse autoencoders (SAEs) are used to interpret and intervene on language models' internal representations. This paper shows that a maliciously modified SAE, inserted into an otherwise unchanged language model's forward pass, can induce attacker-chosen behavior. Using code generation as a case study, the authors report high rates of unsolicited code insertion across three models and many insertion layers, plus behavior triggered by a prompt cue. Evaluations with HumanEval and selected SAEBench metrics suggest strong backdoors can coexist with small changes in conventional quality measures, so SAEs should be treated as security-sensitive components.
WhyIntroduces a novel SAE backdoor threat, showing decoder-only edits induce code insertion across three models and layers.
Enrico Ahlers, Daniel Passon, Tobias Kiecker et al.
In briefArea-efficient hardware for post-quantum HQC with side-channel protection
SummaryThis paper presents a resource-efficient, constant-time hardware design for HQC, a post-quantum key encapsulation mechanism selected by NIST. It reuses idle KECCAK hardware during decoding to generate dynamic power that scrambles secret-dependent power correlations, with under 0.5% area overhead for the countermeasure. A prototype on an Artix-7 FPGA reaches 139 MHz and passes NIST Known Answer Tests, and TVLA assessment shows significant suppression of side-channel leakage.
In briefH-CRSPV: Preventing Missing Requirements in Late-Bound LLM Releases
SummaryThis paper proposes H-CRSPV, a replicated admission layer that checks whether a large language model release fully satisfies all its registered requirements before it is used. It identifies a failure mode called Semantic Omission under Valid Evidence (SOVE), where every submitted object is individually valid yet the release is incomplete or wrongly bound. In tests on 36 omission artifacts, object-only validation accepted all of them, while H-CRSPV rejected all 36 and accepted all six honest releases.
In briefVisualizing How Deep Learning Finds Side-Channel Leakage Using a Stochastic Model
SummaryDeep learning is now the leading method for profiled side-channel analysis, but its neural networks are largely black boxes that hide which leakage they use. This paper introduces GlimpseDNN, a model-agnostic framework that uses a stochastic leakage model to show, layer by layer, how a network processes physical leakage traces to recover secret keys. The framework is validated on simulated traces and public datasets including ASCADf, ASCADr, ASCADf_desync50 and ASCADf_desync100. The authors show that leakage missed in the original traces can still be found in the deeper layers of a well-trained network.
In briefRare-event decorrelation shows linear tests fail against low-complexity pseudorandom functions
SummaryThis paper studies whether pseudorandom functions built from low-depth circuits and secret linear or affine maps can resist linear tests, resolving two previously open questions. The authors use a correlation argument based on rare local events, applying repeated Cauchy–Schwarz to reduce the original correlation to a parity correlation of much rarer event indicators. For the Ball et al. candidate, they show resistance to arbitrary polynomially many non-adaptive queries, and for the Sipser-based family of Boyle et al., they show linear-attack resistance in a quasipolynomial sample regime.</summary>
WhyRepeated Cauchy-Schwarz on rare local events resolves two open linear-attack questions with explicit bias bounds.
In briefRunaway Reaction: How Individually Safe Skills Can Combine into Malicious Behavior
SummaryThe paper shows that benign agent skills, each passing standalone security vetting, can induce malicious behavior when composed. It presents CRIME, a method with three modules: Malicious Plot Casting to select compositions, Runaway Reaction Steering to refine them via execution feedback, and a Skill Reaction Chamber sandbox to check outcomes. The authors also build a benchmark of 4,000 public skills across eight cybersecurity behaviors for evaluating composition-induced vulnerabilities.
WhyShows benign skills passing individual vetting can compose into malicious behavior, proposes CRIME and a 4,000-skill benchmark; novel, with moderate evidence detail in the abstract.
In briefBOLT-FHE: A GPU framework that speeds up TFHE bootstrapping using on-chip tiling
SummaryThis paper presents BOLT-FHE, a GPU framework for TFHE bootstrapping, the main bottleneck in bitwise fully homomorphic encryption. It keeps the accumulator update chain within a single thread block and fuses NTT/INTT, external products and accumulator updates into a unified kernel. On an NVIDIA RTX 4090 at 128-bit security it reaches 40,166 bootstrappings per second. The authors report 1.85×–2.92× speedups over VeloFHE with gadget decomposition, and larger gains for modulus raising depending on whether CM packing is used.
In briefCompromise Is Not Consequence: Testing Task-Limited Permissions for AI Agents
SummaryThis paper studies whether limiting an AI tool-using agent's permissions to a specific task can contain harm when a malicious instruction hijacks the model but its credentials remain valid. Using paired replay, the same model request is submitted under broad bearer tokens, scoped JWTs, sender-constrained tokens, and Open Policy Agent policies. Scoped conditions recorded zero harmful executions for the tested cross-action and cross-resource cases, but the authors state this does not prevent prompt injection itself.
In briefAdaptive-shot quantum anomaly detection for Tactile Internet security under resource limits
SummaryThe paper studies how to balance reliable threshold decisions against limited computing and measurement resources in Tactile Internet security analytics. It proposes an Adaptive-Shot Variational Quantum Circuit (AS-VQC) that starts at 128 shots and escalates to 256, 512, and 1024 only when the anomaly score is near a validation-selected threshold. On a 4,875-record CESNET-TimeSeries24-derived benchmark, the primary policy saves 73% to 87% of the uniform 1024-shot shots, with lower decision disagreement than the fixed 128-shot and shuffled-allocation baselines. However, the fixed 1024-shot baseline remains more decision-stable, so the results show a reliability-resource trade-off.
Mubassir Serneabat Sudipto, Shakil Ahmed, Ashfaq Khokhar et al.
In briefBounded Provisional Visibility: Limiting Poisoned Content in Continuously Updated RAG Databases
SummaryThe paper addresses the risk that newly ingested content in retrieval-augmented generation systems becomes searchable before it is vetted. It proposes a fail-closed protocol that admits new content under a deadline, hides items not verified in time, and supports lineage-scoped containment. In experiments under verifier backlog, the deadline reduced median poisoned retrievals from 34 to 7 compared with asynchronous admission without a deadline.
In briefEvaluating Adversarial Training Defenses Against Poisoning Attacks in Online AutoML for IoT Networks
SummaryThis paper evaluates whether adversarial training can defend streaming machine learning models in IoT networks against label-flip and noise-injection poisoning attacks, using an online AutoML pipeline. Several streaming-capable learners were tested under poisoning attacks. At the strongest poisoning rate (PR = 1.0), AT-SRP achieved the highest F1-score against label-flip attacks (0.904), and AT-LB achieved the highest F1-score against noise-injection attacks (0.933).
Chukwunonso Henry Nwokoye, Khalil El-Khatib, Li Yang
In briefAgentic-ZTA: multi-agent AI for autonomous zero trust access control
SummaryThis paper proposes Agentic-ZTA, an AI-agent-based zero trust architecture that implements the NIST SP 800-207 control loop through coordinated agents. Relevant policies are retrieved with retrieval-augmented generation, and a policy engine routes access requests to specialized agents whose trust scores are aggregated into a final decision. Tested in a testbed on access-control scenarios, the framework reports 95.0% accuracy, 93.9% precision, and 96.3% recall, which the authors present as evidence that AI agents can enforce zero trust.
Shovan Roy, Lopamudra Praharaj, Maanak Gupta et al.
In briefGPU-accelerated FAEST v3 signing: challenge search and CPU–GPU pipelining
SummaryThis paper studies how a GPU can speed up FAEST v3 signing. The GPU filters candidate counters in parallel, while the CPU performs final acceptance checks in increasing order so the minimum accepting counter matches the original procedure. For multiple independent signatures, the authors build a two-slot CPU–GPU pipeline. The results show the GPU's benefit varies by parameter set and by whether single-signature latency or multi-signature throughput is the target.
In briefEffects of Processing Time on PQC Over-the-Air Rekeying over CCSDS Links
SummaryThis paper examines how ignoring endpoint processing time affects evaluations of post-quantum cryptography-based over-the-air rekeying over CCSDS telecommand and telemetry links. The authors model a space data link security key update exchange and compare a zero-processing baseline with a model using measured processing times. They find that differences appear in final transport outcomes, event paths, timing, and contact-time conditions, so the effect cannot be judged from success or failure alone.}
In briefA Post-Quantum Cryptography Migration Framework for National and Public Institution Data Based on N2SF
SummaryThis paper proposes criteria for deciding how national and public institutions should migrate their data to post-quantum cryptography, based on N2SF protection requirements and the cryptographic dependencies of the data. The criteria distinguish actions such as payload retention, key rewrapping, re-encryption, communication migration, and signature renewal, and separate required actions from decisions to allow, defer, or deny them. A reference implementation tested these decisions under supported conditions and found the criteria feasible in that local environment. Institutional approval, production key management, and long-term preservation continuity remain unvalidated.
In briefX-Wing on Cortex-M85: Optimized Hybrid Key Exchange for an Embedded Processor
SummaryThis paper implements X-Wing, a hybrid key establishment scheme combining ML-KEM-768 and X25519, on the Cortex-M85 processor. The authors tailored the NTT, data-format transformations and X25519 arithmetic to this platform and compared cycle counts with a baseline in the same executable. They also report increased nonvolatile storage and a corrected variant whose remaining timing signals in some tests mean no whole-program constant-time property is claimed.
In briefBatched LSH on ARMv8 NEON for Faster K-SPHINCS+ Signing
SummaryThis paper reimplements three published LSH optimizations in hand-written AArch64 NEON assembly on ARMv8-A to speed up hash-based post-quantum signatures. Single-message NEON versions do not beat the KISA C code compiled with clang -O3, while batching two or four messages across NEON lanes improves LSH-256 throughput. The authors integrate a four-message LSH batch core into K-SPHINCS+, which produces byte-identical signatures across all backends and signs about 2.5 to 3.2 times faster than the reference implementations for the 128-bit parameter sets.
WhyIntegrates four-message LSH NEON batching into K-SPHINCS+, a substantive combination of prior optimizations. Verified by 2,063 KATs and differential tests across six parameter sets, with 2.5–3.2× spee
In briefOptimized NEON implementation of MAYO for Apple M1
SummaryMAYO is a third-round candidate in NIST's process for additional post-quantum signatures. The paper presents an optimized NEON implementation of MAYO Round 3 for Apple M1 and compares it with the upstream NEON code on the same machine. Reported median signing is 1.99 to 2.12 times faster and verification 2.11 to 2.62 times faster than upstream. All measurements were taken on one M1 Pro.
In briefOutput policies for homomorphically encrypted anomaly detection that limit threshold leakage
SummaryThis paper examines whether output policies for homomorphically encrypted anomaly detection can limit numerical threshold information while preserving existing decisions. Experiments across three intrusion-detection datasets and three scoring models found that threshold protection and decision-prediction protection need separate goals. The authors recommend assessing decision preservation and response rate alongside policy selection and data splitting.
In briefVerifier-aligned canonical source binding for checking homomorphic encryption computations
SummaryHomomorphic encryption preprocessing and computation checks can each pass without showing that their results come from the same canonical source. The paper proposes a verifier-aligned public-input transfer procedure that links these authenticated artifacts to one source relation, implemented at full input scale of 524,288 coefficients. Sharing duplicate computations cut constraints by 33.53% and proving time by 31.10%, while three upstream proof artifacts make up 88.44% of the public data.
In briefHyBind: Structural Analysis of Hybrid Post-Quantum and Traditional Cryptography Usage
SummaryThis paper presents HyBind, a source-analysis framework for Python that uses registered API contracts to check whether post-quantum and traditional cryptographic outputs jointly determine a key or signature verification result. It traces component secrets to returned keys and checks whether signature acceptance requires both verifiers to succeed. The authors report that HyBind distinguishes joint from omitted contributions and AND from OR verification, and that it provides the call and outcome evidence needed to review individual traditional invocations.
In briefSimpleMark: A Fast Multi-Bit Text Watermark with Divergence-Based Security Limits
SummaryThis paper presents a multi-bit text watermarking framework whose security is defined directly by the f-divergence between the watermarked and base language model distributions, covering measures such as total variation and KL divergence. It uses a coding-based scheme that biases next-token distributions within a set divergence budget, and it characterizes the tradeoff among embedding rate, decoding reliability, and statistical security. Experiments against prior multi-bit methods across modern language models report substantially lower detectability while keeping message recovery and generation quality competitive.
Benjamin D. Kim, Wanrong Zhang, Weitong Ruan et al.
In briefPublic-coin differing-input obfuscation built from KOALA and iO
SummaryThe paper shows that a recent witness encryption construction by Hair and Sahai is a public-coin extractable witness encryption scheme under the Knowledge of Orthogonality Assumption (KOALA). As an immediate consequence, the authors obtain public-coin differing-input obfuscation (diO) from KOALA and indistinguishability obfuscation (iO).
In briefRuntime Detection of Cryptographic Operations on Linux Using Randomness-Anchored eBPF Probes
SummaryThe paper presents a Linux runtime system that uses eBPF user-space probes to detect classical and post-quantum cryptographic operations as they execute. It treats randomness observations as temporal anchors and correlates them with subsequent cryptographic calls to produce confidence-scored events. Experiments show API detection achieves perfect precision and recall on classical and ML-KEM workloads, with the randomness anchor raising confidence without adding false positives. Median detection latency is 28 μs.
In briefRole-Specific Signature Placement in TLS 1.3: How Assignment Affects Cost and PQC Migration
SummaryThis paper examines how assigning 13 signature parameter sets to Root, Intermediate, and Leaf certificate roles changes authentication cost in TLS 1.3. The authors evaluate all 13³ role placements while keeping the algorithm composition fixed and varying only the role order. Reported results include median maximum/minimum ratios of about 2.1 for TLS latency and over 4 for certificate size and path validation cost. The findings suggest PQC chain design should account for role-specific computation and transmission costs.
In briefPost-quantum authentication for drone and robot commands: a KpqC feasibility study under real-time and bandwidth limits
SummaryThis paper examines how to move the command and authentication channels of unmanned aerial and ground vehicles to post-quantum cryptography. It applies Korean PQC candidates (HAETAE, AIMer, SMAUG-T, NTRU+) to the authentication and key-establishment path of ROS2/DDS-Security and compares them with NIST standards and classical ECDSA/ECDH on one testbed. Authentication handshakes were measured over emulated constrained links, yielding a guideline on which KpqC candidate fits which command-channel budget.
In briefDeploying a native Rust KpqC: pluggable post-quantum KEMs and signatures for TLS, satellite links, and OQS
SummaryThis paper presents a memory-safe, native Rust implementation of the Korean KpqC post-quantum schemes, exposed through one pluggable provider. It is evaluated in three deployment settings: a rustls TLS 1.3 key-exchange group, an OQS-compatible C ABI, and an analytical CCSDS/SDLS satellite link model. The authors also present a memory-optimized NTRU+ build that reduces peak stack usage by up to 25% with no measurable time cost.
In briefMeasuring whether running classical and post-quantum key parts in parallel speeds up TLS 1.3 handshakes
SummaryThis paper measures whether computing the classical and post-quantum components of hybrid TLS 1.3 key exchange and Composite ML-DSA signatures on two threads is faster than running them one after another. Across six test conditions on ARM and x86, parallel execution was faster, with speedups of about 1.04 to 1.28 times. In a low-power x86 environment, however, the same code was slower in all six conditions because thread wake-up and waiting overhead exceeded the time saved.
In briefFaster RSA Montgomery Arithmetic on Cortex-M0+ and Cortex-M3 Chips
SummaryThis paper optimizes Montgomery multiplication and squaring for RSA private-key operations on small processors. It uses 15-bit limbs and integrates the kernels into RSA-2048 and RSA-3072 computations based on the Chinese remainder theorem. On both Cortex-M0+ and Cortex-M3, the authors report fewer cycles than their comparison baselines at certain operand widths, and lower warm CRT cycle counts when only the kernels are replaced.
In briefPseudorandom codes built from the LWE problem
SummaryA pseudorandom code is an error-correcting code whose codewords look uniformly random to anyone without the secret key. This paper constructs such codes from Learning with Errors (LWE): a codeword is the one-bit rounding of an LWE sample, masked by a random string. It is an LWE analogue of the Christ and Gunn construction, relying on standard LWE with the planted t-SUM assumption or on subexponential LWE. Because rounding is non-linear, the authors prove robustness using Fourier analysis.
In briefVisual Grounding Safety: Whether Vision-Language Models Refuse Harmful Requests That Ask for Coordinates
SummaryThis paper examines whether vision-language models keep their safety alignment when asked to output structured grounding results such as points and bounding boxes. The authors repurpose three safety benchmarks into 15,401 matched pairs that differ only in whether the requested output is a text answer or a grounding. Across five models, refusal rates drop substantially for grounding requests compared with question-answering requests, and safety system prompts do not close the gap. The authors propose a fine-tuning method using grounding-form refusals and benign data, which improves grounding refusal while preserving grounding capability.
In briefAgentDoxx: Agentic Re-identification of Anonymized Text Using Web Search
SummaryThis paper introduces AgentDOXX, an evaluation suite of 822 synthetic interview transcripts built from public information about real people with known identities. It tests fifteen configurations of open-weight and proprietary models to measure how web search affects re-identification of anonymized text. Some open-weight models identify 15-28% of transcripts without search, and privacy instructions suppress naming but not retrieval of the subject.
In briefPlotkin Attacks: Why Raptor Codes Are Unsafe in Asynchronous Data Dispersal
SummaryThis paper examines asynchronous verifiable information dispersal protocols that encode data with Raptor codes (R10 and RaptorQ) and reconstruct it only later. The authors show that a Byzantine disperser can choose encoding symbols so that some subsets of honest fragments fail to determine the message, using the Plotkin bound to build such subsets. Experiments and benchmarks indicate that Reed-Solomon codes perform comparably to Raptor codes in the studied parameter regime.
WhyUses the Plotkin bound to construct bad subsets breaking Raptor-code reconstruct-later AVID, with explicit R10 certificates and RaptorQ experiments supporting it.
In briefBeyond One-Size-Fits-All Noise: Mixed-Mechanism Privacy for Multi-Attribute Records
SummaryThis paper addresses privacy protection for multi-attribute user records that mix continuous, categorical, and binary fields with strong cross-attribute dependencies. It proposes DepHDP, a metric differential privacy framework that groups dependent attributes and assigns each group either a predefined mechanism such as Laplace or Exponential, or an optimization-based design. Across three case studies, DepHDP reportedly improves the privacy-utility trade-off over uniform baselines while costing less computation than full-record optimization on the evaluated domains.
In briefLoad-balanced reliable broadcast for stake-weighted validator networks
SummaryThe paper addresses how stake-proportional fragment assignment in erasure-coded reliable broadcast makes high-stake validators relay much more data. It proposes Balanced CT and Balanced MiniCast, which assign one fragment per validator so every honest validator has the same relay-upload bound. It also introduces a Capped Swiper heuristic that reduces total relay-upload cost while keeping maximum cost near the balanced bound.
In briefFinding Hidden Safety Features in LLMs Through Suppression Analysis
SummaryThis paper argues that inactive components of large language models contain safety-critical features that causally support refusal of harmful prompts, and that current interpretability tools miss them. It introduces Counterfactual Activation Potential (CAP), a metric combining encoder alignment, suppression strength, and safety criticality, and a two-stage algorithm, CSFD, to find such features at scale. Experiments across five Gemma, Qwen, and Llama models show that ablating candidate features can turn refusals into compliance, and that jailbreaks may work partly by suppressing these features.
WhyProposes the CAP metric and a two-stage discovery method for suppressed safety features, validated by ablation and amplification experiments showing jailbreaks may work by suppressing them.
In briefQuery-limited RAM programs: stateful, controlled one-time quantum computation
SummaryThe paper introduces query-limited RAM programs (QLPs), a generalization of quantum one-time programs that supports stateful computation under bounded or policy-driven access. QLPs prevent adversarial forking or rollback of computational state. The authors construct QLPs from one-shot programs, which unify one-shot signatures with the single effective query paradigm, and show that one-shot programs generically imply QLPs.
In briefThe Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models explains how hidden image watermarks can leak sensitive chat information.
SummaryThe paper introduces Privacy-Leaking Watermarks (PLWs), invisible watermarks that a malicious model provider can embed in later generated images based on earlier chat history. Sensitive keywords mentioned in a conversation can thus be revealed through images, even when the model runs locally on a user's device. Tested across 13 sensitive-attribute triggers and two model families, PLWs achieved up to 100.0% true positive rate at 1% false positive rate.
Tobias Braun, Jonas Henry Grebe, Emil Sivic et al.
In briefBitwise-optimal cryptography: one-wayness to pseudorandomness and collision resistance
SummaryThis paper studies cryptographic primitives that are both locally computable (in NC^0) and exponentially secure, focusing on pseudorandom generators and universal one-way hash functions. It shows that any exponentially secure one-way function in NC^0 can yield such bitwise-optimal generators and hash functions, establishing their equivalence in this setting. The authors introduce sparsification and input-locality results, which remove the regularity assumption needed by earlier constructions.
WhyConstructs bitwise-optimal PRGs and UOWHFs from any exponentially secure NC^0 one-way function, removing regularity assumptions with complete proofs; impact remains largely theoretical.
In briefAutoDP-LLM: Using Large Language Models to Automate Data Pre-processing for Intrusion Detection
SummaryThis paper proposes AutoDP-LLM, a framework that uses Large Language Models to automatically generate and validate executable data pre-processing pipelines for intrusion detection systems. It selects retained features adaptively using semantic reasoning and training-derived statistics, without a predefined feature budget. Experiments on the UNSW-NB15 and NSL-KDD datasets show competitive detection performance compared with conventional feature-selection methods. The authors also note that the candidate pipeline generation and evaluation steps can run in parallel on high-performance computing systems.
Bao-Phong Nguyen, Gia-Khanh Pham, Thai-Duong Do et al.
In briefReflections and Fragments: Defending LLMs Against Multi-Turn Mosaic Attacks
SummaryThis paper studies mosaic attacks, where individually harmless prompts across several conversation turns combine into a harmful payload. The authors propose a watchman, an online state mechanism that carries safety-relevant information forward, and show that under explicit assumptions it can achieve zero-failure defense with positive benign helpfulness. In experiments, role-specific attacker and defender LoRA adapters trained via multi-turn self-play over frozen LLMs both improved, with gains also observed on unseen attack objectives.
Emanuele La Malfa, Saar Cohen, Gabriele La Malfa et al.
In briefTrapdoor Projective Sampling for Identity-Based Anonymous Broadcast
SummaryThis paper studies anonymous broadcast encryption in a bounded identity universe, where ciphertexts hide both the message and the recipient set. The authors introduce trapdoor projective sampling, which fixes projected keys as hashes of identities first and then preimage-samples private keys using a trapdoor. The construction is based on k-LWE and avoids publishing per-recipient public keys. It also extends to an unbounded identity universe under static corruption.
WhyIntroduces trapdoor projective sampling, narrowing the projection space to m×2n while preserving k-LWE security, yielding identity-based anonymous broadcast with formal security proofs.
In briefMachine-Checked Soundness Proof of the GKR Protocol for Sparse-Merkle Updates
SummaryThis paper machine-checks in Isabelle/HOL the soundness of the GKR protocol for sparse-Merkle membership, non-membership and update proofs, together with arithmetization exactness and leaf-commitment binding. It proves that for a false output claim, the probability that a layered sumcheck accepts a false result is at most (s_out + Σ(2 s_i d_i + 1))/|F|. The bound is instantiated over a quartic extension of the 31-bit KoalaBear field, giving a denominator of about 2^124. The model covers only the interactive public-coin protocol and excludes Fiat-Shamir, knowledge soundness and zero knowledge.
In briefGrammar-guided code watermarking with green temperature (GTCW), a method to tag AI-generated code while keeping it syntactically valid
SummaryThis paper proposes GTCW, a method that embeds a detectable watermark in code generated by large language models. At each decoding step it limits candidates to grammar-valid tokens, splits them into keyed green and red sets, and reweights green tokens at high-entropy positions. Across five models and five benchmarks in four programming languages, it reaches a mean AUROC of 73.61%, above the strongest baseline's 67.83%. Its mean Pass@1 is 59.18%, slightly below the 59.58% of unwatermarked generation.
In briefRed-TTT: Test-time training to automatically jailbreak large language models
SummaryThis paper proposes Red-TTT, a method for automated jailbreaking of large language models that updates the attacker's parameters during each attack. Each round, the attacker samples candidates, scores them against the victim's replies, and takes a policy-gradient step, and the training objective is adapted to judge success by the best sample. At a budget of 120 samples, average attack success rate rises from 55.9% for the Best-of-N baseline to 72.4%.
WhyApplies test-time training to jailbreak attacks, raising average success from 55.9% to 72.4% over Best-of-N at 120 samples.
