In briefFederated Bayesian Monitoring of Thrombectomy Adverse Events for Surgical Digital Twins
SummaryThe paper proposes population-scale adverse-event surveillance as a separate belief layer within surgical digital twins and tests a federated Bayesian method for learning it under formal privacy guarantees. It uses the complete FDA MAUDE cohort of 8,617 thrombus-retrieval catheter reports, with 6,491 classified into five complication classes and split across eight manufacturer sites. At a matched privacy budget, the method scores better on held-out data than FedAvg with differential privacy, and the non-private federated model beats centralized pooling. Because the data lack procedure denominators, the outputs are relative rate orderings rather than absolute risks.
In briefOne-shot differentially private confidence regions via resampling
SummaryThe paper proposes a simple method that adds noise only to the final resampling quantile to build differentially private confidence regions in one shot, instead of privatizing each resample's estimate. Under with-replacement (m-out-of-n) sampling the privacy cost grows only logarithmically with the number of resamples B, and under without-replacement subsampling it does not depend on B. The authors give nonasymptotic Gaussian Differential Privacy and utility guarantees for quantiles and degenerate U-statistics, among other estimators.
Shourya Pandey, Purnamrita Sarkar, Po-Ling Loh et al.
In briefLipDA: Detecting and Attributing LipSync Forgeries via Lip-Head Pose Inconsistency
SummaryThis paper proposes LipDA, a framework that jointly detects LipSync forged videos and attributes them to their source generator. It exploits the natural biological coupling between lip movements and head poses, contrasting these features between real and forged videos. The method also captures generator-specific temporal and audio-visual synchronization patterns to trace origins. Experiments on two LipSync datasets and the authors' LipSync-A dataset report over 97% detection AUC and 97.5% attribution accuracy.
WhyExploits lip-head pose coupling inconsistency for detection and attribution, a fresh angle; multi-dataset experiments with strong reported AUC and accuracy.
In briefDecoy and disclosure radii of invariant shape descriptors: how much shape rotation-invariant descriptors reveal or hide
SummaryThe paper studies how much shape information is lost when recognizers compare rotation-invariant descriptors. The fiber radius in orbit distance measures whether distant decoy shapes can pass matching (large radius) or whether the stored value discloses the enrolled shape (small radius). For star-shaped surfaces truncated at spherical harmonic degree L, the authors compute decoy family dimensions and verify two cases with exact and interval arithmetic. One case is the radar shape model of asteroid Bennu (101955), where the descriptors recover the volume but miss handedness and leave the keep-out radius uncertain by more than 7 m.
In briefCase-Level Verification for Scanner-LLM Cascades to Reduce False Positives Without Losing True Alerts
SummaryThe paper addresses high false positive rates in Dynamic Application Security Testing (DAST) scanners, which raise manual triage costs, and studies a two-stage setup where an LLM verifies scanner alerts. It argues that alert-level aggregation ties true and false cases into one decision, so removing false positives also removes true positives. The authors propose a case-level strategy that replays HTTP requests and judges each case independently, and evaluate it on DVWA and WebGoat. The case-level baseline improves the false-positive reduction rate by 4.7 percentage points over the best alert-level point, and the evidence verification prompt raises the true-positive rate from 55.2% to 62.1% at the same reduction rate.
In briefLearning from Failures: Improving LLM Vulnerability Analysis Prompts Through Recurring Error Patterns
SummaryThis paper proposes Failure-Driven Prompt Refinement (FDPR), a method that analyzes recurring errors of large language models in software vulnerability analysis, such as false positives, false negatives, unsupported reasoning, and CWE misclassification, to guide prompt improvements. The authors identify these failure modes using the Damn Vulnerable Java Application and evaluate the refined prompt on the Juliet Test Suite with cross-model validation. They report that the approach improves reliability and yields reusable prompt design principles.
In briefDifferential-neural cryptanalysis of ChaCha and related ARX stream ciphers
SummaryThis paper presents the first differential-neural cryptanalysis of the Latin Dances family: Salsa, ChaCha and Forró. The authors compare six neural architectures on a 3-round reduced ChaCha, using single-pair and multi-pair training. They report the first distinguishers for 4.5 rounds of Salsa and 1.25 rounds of Forró. They also run explainability experiments on the 3-round ChaCha distinguisher, finding it acts as a mixture of round-1 truncated differentials.
In briefMARCO: A radioactive watermark for protein generative models
SummaryProtein generative models can design complex 3D protein structures from sequence data, but they also create risks such as unauthorized model extraction and biosecurity misuse. The paper proposes MARCO, a watermarking framework that embeds watermarks during diffusion denoising through an auxiliary encoder-decoder while keeping the original model frozen. It uses losses on Cα distances and torsion angles, adversarial training, and attack simulations to preserve fidelity and robustness. The authors report that the watermark transfers to outputs of pirate models trained on watermarked data, and experiments show high fidelity and robustness.
In briefLattice Isomorphism Problem With Hints: A Cryptanalysis Study
SummaryThis paper studies the security of the Lattice Isomorphism Problem (LIP), the hard problem underlying the Hawk signature scheme, when partial information about the secret is available. The authors embed LIP into a shortest vector problem on a different lattice so that hints can be integrated, and they introduce techniques to convert linear leakages into such hints. Using the LeakyLWEEstimator tool, they estimate Hawk's key-recovery security and find about 11 bits of security loss for Hawk-1024. The framework is also applied to prior side-channel results on Hawk.
In briefZeppelin: On-Device BFV Encryption and Decryption for Helium Microcontrollers
SummaryThis paper presents Zeppelin, a homomorphic encryption library for microcontrollers that performs BFV encryption and decryption on the device while using ARM's Helium vector extension to speed up the number-theoretic transform. A server-side adapter makes its ciphertexts compatible with Microsoft SEAL, so the server can carry out the homomorphic computation. On an STM32N6 with an ARM Cortex-M55, the authors report encoding and encrypting 4096 packed values in 4.76 ms and decrypting and decoding in 5.38 ms, using under 500 KB of RAM.
Muhammad Saif ul Islam, Karar Haider, Manaal Malik et al.
In briefContextual Chain: A lightweight protocol for continuity authentication on intermittently connected devices
SummaryThis paper proposes Contextual Chain, a lightweight continuity protocol that authenticates intermittently connected devices sharing evolving physical or operational context. Honest devices follow one realized history, maintaining a compact accumulator and fixed hash-based readiness lanes, and pause or roll back on outages. In the random-oracle model, a causal counting theorem lower-bounds the retained state needed for a target success probability, while honest readiness memory stays fixed regardless of how many histories are plausible.
In briefHE-OFT: One-shot federated fine-tuning that keeps the trained model private
SummarySeveral organizations want to fine-tune a shared model on their private data without pooling it. HE-OFT lets each client train a low-rank adapter and classifier head on a frozen public backbone, then upload one encrypted head update that the server combines under multiparty CKKS without decrypting. No participant receives the trained model, and queries return only predicted labels. On four text tasks and one vision task, it reached 61 to 79 per cent accuracy versus 20 to 48 per cent for solo training, retaining 85 to 96 per cent of a disclosed model's accuracy.
Halil \.Ibrahim Kanpak, Sinem Sav, Alptekin K\"up\c{c}\"u
In briefNewer and Bigger, but Safer? Study of LLM Code Security Gaps
SummaryThis paper presents a longitudinal study of 32 LLMs from seven model families, measuring code that passes functional tests but fails security tests. Newer models are safer in absolute terms, but no family closes the functionality-security gap. Compact models usually generate less secure code than flagship models, and some CWE weaknesses persist across releases.
Thiago Santos de Moura, Fynn Matuschek, Flavio Toffalini et al.
In briefWhy latent-based watermarks for diffusion models are inherently fragile to distortions
SummaryThis paper argues that existing latent-based watermarking methods for diffusion models overstate their robustness to geometric distortions such as rotation, scaling, and translation. The authors give the first theoretical explanation for why these methods lack invariance to perturbations, deriving a maximum perturbation bound linking pixel-space changes to latent-space effects. They also present an analytical formulation covering practical detection components, and experiments support the finding that current designs have intrinsically limited robustness.
Cheng-Han Yeh, Kuan-chun Yu, Cheng-Chang Tsai et al.
In briefFBAN: A Homomorphic-Encryption-Friendly Attention Network for Private Behavioral Authentication
SummaryThis paper proposes FBAN, a TFHE-compatible bottleneck attention network within an end-to-end encrypted continuous authentication framework. It lets a server verify users from behavioral data such as touch dynamics without seeing the raw features, using integer-only models trained in two stages and compiled into TFHE circuits. The authors provide a security analysis against an honest-but-curious server and report experiments on two public touchscreen datasets showing good authentication utility at 128-bit or higher TFHE security.
In briefA new framework for post-quantum cryptographic protocols based on graded monoidal actions
SummaryThe paper proposes a new framework for building post-quantum protocols on graded monoidal actions. The authors state that the relevant problems have no known subexponential quantum attacks, while the structure is still rich enough to support protocols such as Diffie-Hellman key exchange. They note that the framework can be instantiated with the module action on oriented principally polarized abelian varieties (PPAVs), which generalizes the class group action on oriented elliptic curves.
In briefSettling Five Conjectures on Linear Structures of Inverse ChiChi Generalizations, With a Counterexample
SummaryThis paper addresses five conjectures about the linear height and component linear nullity of the inverses of ChiChi and its generalizations (SWAP and 4-cycle families). The authors prove the first four conjectures for every admissible branch length and show that the fifth is false by giving a counterexample. They also discuss consequences for the design of ChiLow and correct one value in the data of Andreoli et al.
In briefRethinking Visual Provenance: Detecting and Watermarking AI Images From Direct Generation and Code Rendering
SummaryThe paper compares detection and watermarking for AI-created visuals produced either by direct image or video generation models or by LLM-written code that is then rendered. It proposes a production-stage framework and separates passive inference, message recovery, and authenticated provenance as verification levels. The work is a conceptual research agenda with ten scoped questions and reports no experiments or new theorems.
In briefOptimizing malicious skill injections so they survive AI agent skill routing
SummaryThis paper studies prompt injection attacks hidden in third-party skills that AI agents select through a skill router. The authors argue that prior evaluations assume the malicious skill is already chosen, which overestimates attack success, and report that in multi-skill settings existing injections' success drops by 87-97%. They propose CORSA, a router-aware attack that optimizes injections for both retrieval and execution, and report improved results that transfer across router architectures and LLM backbones.
In briefWhen Tools Lie: Reliability of Math Agents Given Corrupted Tool Outputs
SummaryThis paper tests whether math-solving AI agents can detect and fix tool results that were secretly replaced with plausible but wrong values. Across 31 problems, it compares four verification designs: none, mandatory same-context reflection, optional fresh-context verification, and optional structural verification. Without verification, accuracy fell from 100% to 72.4%, while mandatory reflection restored it to 100%. Optional verification helped only when models chose to invoke it.
In briefExplainable rule mining of IPv6 extension-header presence patterns from paired-vantage captures
SummaryThis paper asks whether an explainable method can extract human-readable rules about IPv6 extension headers, such as fragmentation headers, from packet captures. The authors propose a negative-control protocol to tell whether a mined temporal rule reflects real cross-packet dynamics or only within-packet co-occurrence, and a sender-conditioned retention measurement per header family. On the JAMES paired-vantage dataset, the dominant Fragment-EH rule turns out to be within-packet co-occurrence rather than a temporal pattern, so the evaluated traces do not show network-temporal structure carrying that signal.
Priyanka Sinha, Nikolaos Kekatos, Stylianos Basagiannis et al.
In briefAsyncLS: An iUC Framework for Asynchronous Wallet-Based Ledger Services
SummaryThis paper defines an asynchronous ledger service, AsyncLS, in the IITM-based universal composability (iUC) framework, letting wallets register, read committed application state, submit authorized requests, and query immutable final results. The authors construct protocol Π_AsyncLS from four components (Wallet, Relay, Adapter, and Replay) and prove it realizes the ideal service under stated execution and trust assumptions. Two examples are given: an ORDI interactive payment and a parameterized execution layer above transaction ordering.
In briefMIKE: A Fast, Compact Post-Quantum Non-Interactive Key Exchange
SummaryThis paper introduces MIKE (Module Isogeny Key Exchange), a post-quantum non-interactive key exchange scheme whose security rests on the CDH problem for rank-2 Hermitian module actions on supersingular elliptic curves. At NIST level 1, the authors report public keys of only 80 bytes. Their constant-time C implementation reportedly takes 0.65 ms for key generation and 4.9 ms for shared-secret computation, including key validation, on a 3.3 GHz AMD CPU.
In briefTuned Focal Loss for Imbalanced Intrusion Detection on NSL-KDD with a CNN-Transformer
SummaryThis paper proposes an explainable intrusion detection framework using a CNN-Transformer to better detect the rare R2L and U2R attacks in the imbalanced NSL-KDD dataset. It uses XGBoost for feature selection and Focal Loss to help learn minority classes, and its ablation studies show that tuned Focal Loss alone works better than adding SMOTE oversampling. The final model reaches 98.73% overall test accuracy, with F1-scores of 84.63% for R2L and 69.66% for U2R. SHAP analysis is used to explain predictions and the low U2R precision caused by overlapping features.
In briefASCENT: A First-Order Optimal Fine-Tuning Method That Boosts Both Safety and Utility
SummaryThis paper proposes ASCENT, a fine-tuning framework for large language models that aims to improve downstream task performance while preserving or enhancing safety. It models safety as a function of model parameters, uses a first-order approximation to select the top singular components of the safety gradient for periodic recalibration, and derives a safety-preserving task update. Experiments across multiple model families and tasks report utility gains of up to 20.3% and attack success rate reductions of up to 35.5%.
In briefTruffle: a three-party shuffle protocol secure against malicious attackers, for parsing secret-shared data
SummaryThis paper presents Truffle, a three-party secure shuffle protocol that remains secure against one actively malicious party. A secure shuffle applies a permutation to a list while keeping both the permutation and the data secret-shared. Truffle matches the amortised round complexity of the best semi-honest protocol and adds only sublinear communication overhead. The authors implement it and report benchmarks showing it can handle real application data.
WhyIntroduces a maliciously secure three-party shuffle matching semi-honest amortised round complexity with a novel distributed verifier ZK proof, implemented and benchmarked, benefiting the MPC subfield
Nidhish Bhimrajka, Yashvanth Kondi, Daniel Noble et al.
In briefMeasuring Privacy Risk in Operator-Side 5G/O-RAN Network Profiles
SummaryThis paper examines how much re-identification risk remains in operator-side 5G/O-RAN network profiles after standard anonymisation. The authors combine k-anonymity, l-diversity and t-closeness into a composite Privacy-Posture Index and test eight transformation configurations on internal PCAP captures and the public Idaho Labs 5GAD corpus. They find that pseudonymisation alone does not reduce re-identification risk, while generalisation of quasi-identifiers yields material gains, and suppression-heavy releases lose minority-class recall. The authors present the index as a regulator-facing summary rather than a security bound.
Nikolaos Kekatos, Apostolos Valiakos, Alexios Lekidis et al.
In briefWhere a Rust speedup comes from: language versus algorithm effects in a sliding window threat scorer
SummaryThis paper studies a sliding window threat scorer modelled on the SentinelSphere traffic light calculator, comparing three Python and two Rust implementations that produce bit-identical scores. Switching language alone gives about 4 to 29 times speedup, while replacing per-event window rescans with incremental updates contributes more than 11,000 times in the burst regime. The authors conclude that performance claims for security tooling should report language and algorithm contributions separately.
Nikolaos D. Tantaroudas, Ilias Karachalios, Andrew J. McCracken
In briefPoP! Goes the VOLE: Shorter Possession Proofs for KEM Certificates
SummaryThis paper examines how to prove possession of key pairs for KEM-based certificates, which is needed to adopt post-quantum cryptography. The authors propose and implement a non-interactive proof of possession for HQC, a code-based KEM selected by NIST, using the VOLE-in-the-Head paradigm. They benchmark it against approaches for Kyber and FrodoKEM within the ACME protocol. The HQC approach is reported to remain compliant and compatible while producing smaller proofs, with competitive performance under an unstable network simulation.
Slim Bettaieb, Alexandre Augusto Giron, Mukul Kulkarni et al.
In briefDefending Collaborative Driving Perception Against Selective Lies
SummaryThis paper addresses collaborative perception in connected vehicles, where a compromised collaborator may hide one safety-critical object or invent one while reporting many others correctly. The proposed method, SABER, is a two-tier Bayesian trust estimator that uses cumulative-sum screening to select suspicious agent-object pairs and assesses them separately against other agents' evidence. Its lowest pair score constrains agent trust so unrelated correct reports cannot dilute targeted attacks. On OPV2V, the authors report better attack detection and lower benign false-positive rates than state-of-the-art defenses such as MATE, ROBOSAC, and LUCIA.
In briefPreparing an AI-Augmented SIEM for the EU Cyber Resilience Act: A Practical Case Study
SummaryThis paper documents a pilot study preparing SEUXDR, an AI-augmented security monitoring product, for the EU Cyber Resilience Act (CRA) on the open-source CYBERFORT platform. It proposes a reproducible six-step recipe covering scoping, asset registration, evidence production, CRA mapping, gap analysis, and an audit pack, along with two end-to-end traceability threads. The study offers practitioners a replicable starting point for turning CRA legal requirements into operational readiness for incident response, vulnerability reporting, and conformity assessment.
Georgios Koutidis, Nikolaos Kekatos, Marina Korgiala-Karyda et al.
In briefQuantum-resistant Bluetooth pairing for implanted medical devices using NFC out-of-band channels
SummaryImplantable medical devices lack user interfaces, so standard man-in-the-middle-resistant Bluetooth pairing methods are hard to use. This paper proposes a lightweight pairing protocol that runs a post-quantum key encapsulation mechanism entirely over an NFC out-of-band channel, so no shared secret is sent over NFC, and no changes to the BLE stack are needed. A proof-of-concept evaluation reports that, under the stated usage model, projected battery life drops by less than 0.57% for Kyber-1024 and 0.56% for FireSABER compared with the vulnerable Just Works method.
Muhammad Asim Javaid, Muhammad Shafay Tanveer Hassan, Faaiz Umer et al.
In briefThe Amplifier Effect: Risks of AI-Linked Auto-Propagated Answers in Multi-Framework GRC Self-Assessments
SummaryThis paper examines how multi-framework GRC platforms that suggest linked questions with AI and automatically propagate answers can copy a single biased answer across many compliance obligations. The authors propose a six-dimension scoring framework and apply it to thirteen tools as a structured design assessment, not a measurement of user behaviour. They also outline a measurement protocol for consortia with access to production self-assessment data.
Nikolaos Kekatos, Michael Ioannou, Marina Korgiala-Karyda et al.
In briefChoosing When to Back Up Files in Real Time to Limit Ransomware Damage
SummaryRansomware keeps encrypting files between attack onset and detection, and real-time backups can preserve files before they are modified. The prior ROFBS system mainly triggers backups on file open, while this study examines open, read, write, and rename events across the file lifecycle. The authors implemented four trigger strategies in an ROFBS-style prototype on XFS and evaluated them with five ransomware samples. The results show how trigger timing affects both damage mitigation and the number of backups created.
In briefShorter few-time signatures using hash chains and blockwise pruning
SummaryThis paper addresses the large signature size of SLH-DSA, a standardized stateless hash-based signature scheme built on SPHINCS+. It proposes BPORS-C+BFP, which replaces leaf secrets with short hash chains and gives each coordinate block its own authentication budget. Replacing FORS while keeping the hypertree and one-time signature parameters fixed, it reduces complete signature sizes by 8.3% to 18.1% across six standard settings, versus 3.7% to 13.4% for BPORS+FP.
In briefPairSwitch: a faster key-switching method with fewer keys for Gentry–Lee matrix FHE
SummaryGentry–Lee matrix fully homomorphic encryption uses a BigSwitch step whose keys dominate the scheme's key material. The paper proposes a pair-merge BigSwitch and public key rebasing to reduce the keys clients must publish. On Park et al.'s parameters, the authors report BigSwitch runs 1.89–1.99× faster than TFB and 1.28–1.38× faster than the original, with lower noise.
In briefFast, attack-resistant post-quantum encryption for low-cost Cortex-M microcontrollers
SummaryThis paper implements RBLWE post-quantum encryption on an ARM Cortex-M33 microcontroller, packing four 8-bit coefficients into 32-bit registers to speed up key generation, encryption, and decryption. Compared with a scalar baseline, the accelerated version reports cold-start speedups of about 3.0 to 4.1 times. The authors add staged countermeasures against timing, fault-injection, and power analysis attacks, reporting each layer's cost, and verify them with timing tests, fault-injection campaigns, and TVLA.
Muhammad Asim Javaid, Muhammad Adeel Pasha, Muhammad Ali Siddiqi
In briefVerifying neural networks against bit flips in several weights at once
SummaryHardware faults can flip bits in a quantized neural network's stored weights, which may distort its predictions. The paper introduces mBFV, a verification framework that proves robustness to simultaneous bit flips across multiple parameters without enumerating every combination, using branch-and-bound to tighten bounds. On 625 instances it verified 293, versus 38 for a prior single-parameter verifier and 0 for an exact mixed-integer linear programming baseline. It scales to networks with up to 1.15M parameters against up to four simultaneous flips.
In briefSCSM: A Traffic-Native Foundation Model for Transferable Website Fingerprinting
SummaryWebsite fingerprinting infers which sites users visit from encrypted traffic metadata, but models often degrade when sites, collection times, networks, browsers, or defenses change. The paper proposes SCSM, which builds pretraining views from unlabeled traces using segmentation, combination, scaling, and masking, then contrastively pretrains a state-space encoder. The encoder is fine-tuned on a small labeled support set. Reported results show gains of 16.4% in average top-3 accuracy over six temporal-drift tasks on GTT23 and 13.8% in average macro-F1 over four cross-domain datasets.
WhyProposes traffic-native self-supervised pretraining with a state-space encoder, outperforming strong baselines on temporal-drift and cross-domain tasks.
In briefCredLeakBench: Testing Whether AI Agents Leak Login Details to Phishing
SummaryThis paper introduces CredLeak-Bench, a benchmark for checking whether language model agents can complete tasks safely when faced with phishing and identity verification. It measures leakage through actual information submissions in a sandboxed environment, including during autonomous inbox monitoring. The authors report that all tested models leaked sensitive information, and most mitigations that reduced leakage also hurt performance on legitimate tasks.
SummaryThis paper studies functional backdoor recovery, which seeks any trigger whose attack success rate meets a threshold, using only predicted labels as feedback. The authors build two families of victim models with identical attack success rates and label distributions per query, yet with optimal adaptive query complexities of Θ(log H) and Θ(H), where H is the number of possible victims. The separation disappears under binary feedback, and the authors verify predicted query budgets on CIFAR-10 ResNet-18 classifiers.
In briefK-LMS: Leighton–Micali signatures using Korean cryptographic primitives
SummaryThe paper presents K-LMS, an experimental variant of the hash-based post-quantum signature scheme LMS that replaces only the hash function with Korean primitives, namely LSH-256 and a Tandem-DM construction over CHAM, LEA and ARIA. It evaluates key generation, signing and verification latency, key and signature sizes, memory use and implementation complexity. Key and signature sizes are unchanged by the substitution, and against a fair software baseline LSH-256 signing is on par with SHA-256 LMS, while the authors also identify measurement pitfalls that can distort such comparisons.
In briefWhen can stateless recovery break Byzantine quorum safety? A tight normal form for single-step BFT
SummaryThis paper studies Byzantine fault-tolerant voting where a replica that recovers may lose protocol state while keeping its identity and signing key, potentially forgetting an earlier vote. It analyzes certificates formed from matching signed votes of at least q of n replicas and shows that the overlap of two conflicting certificates has slack that decomposes into four nonnegative counts. With n=3f+1, q=2f+1, and one correct recovery, any conflicting pair forces exactly f Byzantine replicas. The authors give a minimal protocol that attains this form and note that writing durable vote records before releasing signatures prevents the conflict.
In briefDynamic-programming selection of recursive F2[x] multiplication schedules across ISAs
SummaryThe paper frames recursive multiplication over F2[x] as a schedule-selection problem solved with dynamic programming over a per-ISA cost profile. The resulting schedules are materialized as dispatch tables or fixed-size kernels. The authors report a 1.04–1.18× geomean speedup over gf2x on x86-64, ARM64, RISC-V64, and RP2040, plus end-to-end gains in HQC and BIKE integrations.
In briefThe Model Plants Its Own Trigger: Answer-Side Backdoors in Multi-Turn LLMs
SummaryThis paper presents a new kind of backdoor attack on large language models in which the trigger is not placed in the user input. Instead, a benign first-turn prompt makes the model generate a seemingly innocuous word, which then acts as a trigger once it enters the dialogue history. The authors report near-100% attack success rates across four LLMs at a 5% poisoning rate, and state that the attack evades mainstream input-centric defenses.
WhyProposes an answer-side multi-turn backdoor whose self-generated trigger evades input-side defenses; validated on four LLMs with representation analysis, though breadth of comparisons is limited.
In briefExtract-Amplify-Measure: Tighter O2H Theorems and Their Use in Proving CCA Security in the QROM
SummaryThis paper improves the One-Way-to-Hiding (O2H) theorem used to analyze reprogramming in the quantum random oracle model. It proposes a Single-Sided EAM-O2H theorem matching the best known O(√q·ε) bound while requiring access to only one random oracle, and a Double-Sided EAM-O2H theorem that removes the q-dependent loss for an O(ε) bound. The authors apply these results to several Fujisaki–Okamoto variants, improving the security reductions for IND-CCA.
WhyProposes single-sided and tight double-sided EAM-O2H theorems, removing q-dependent loss and improving QROM reductions for FO variants.
In briefPerSpectron: a perceptron-based hardware detector for microarchitectural attacks
SummaryThis paper presents PerSpectron, a hardware detector that uses perceptron learning on correlated microarchitectural statistics to identify and classify attacks such as Spectre, Meltdown, and Flush+Reload. The goal is to detect attacks before data is leaked, so countermeasures can be triggered in advance. The detector operates outside the processor's critical paths and is reported to have minimal performance overhead.
Samira Mirbagher-Ajorpaz, Gilles Pokam, Esmaeil Mohammadian-Koruyeh et al.
In briefAdaptive Model Inversion Attacks Reveal a Privacy-Robustness Tradeoff
SummaryThis paper shows that standard evaluations of high-resolution Model Inversion Attacks (MIAs) underestimate how much training data leaks. With simple adaptive changes to the attack on FaceScrub, leakage rates rose 1.16 to 6.59 times across defenses, standard training methods, and undefended models. The authors also find that measured leakage depends on the evaluator's feature basis, and that reconstruction leakage closely tracks adversarial robustness. They ask whether a practical defense can reduce reconstruction without reducing adversarial robustness.
In briefWhere Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security
SummaryThis paper studies security defenses for LLM-based multi-agent systems facing adversarial content. The authors propose DEFER1, which first applies 28 deterministic checks to block attacks it can identify and refers the rest to a panel of four judges. In independent tests across four domains, attack success rates fell from about 30.0% to about 3.0%, with 78% of blocked attacks handled by deterministic checks.
In briefSkillPoison: a method that gradually poisons agent skills using only successful experiences
SummarySelf-improving LLM agents distill successful experiences into reusable skills. This paper proposes SkillPoison, which shows that skills can be poisoned using only verified, task-correct successful experiences, without injecting malicious content. The method shapes how the skill extractor generalizes, so useful behavior becomes harmful when misapplied. Experiments on three benchmarks report a 95.71% attack success rate, with injected experiences passing verification and lexical inspection.
WhyNovel idea of poisoning skills via task-correct experiences without malicious content; reports 95.71% attack success across three benchmarks, a practical threat to self-improving agents.
In briefHarnessSecurity-Bench: Do Security Mechanisms Really Protect Coding Agent Harnesses?
SummaryThis paper presents the first systematic study and benchmark of security mechanisms in open- and closed-source coding agent harnesses. The authors derive a ten-mechanism taxonomy and find that about half of confirmed implementations are opt-in, with closed-source harnesses showing substantial evidence gaps. Across 23 tasks and six harnesses, they run 2,500 trials and report that enabling auto-approve raises attack success from 29.2% to 95.6%. The authors recommend that providers make security settings verifiable, test alternative execution paths, and assess attack effects alongside task utility and cost.
WhyFirst systematic evaluation of coding agent harness security with a 23-task benchmark and 2,500 trials, giving strong empirical evidence and practical impact.
In briefCovert data channels using visible light from unmodified smart bulbs
SummaryThis paper tests whether an ordinary smart LED bulb can carry digital data through color or brightness changes too small for people to notice easily. The researchers used an unmodified Philips WiZ A19 bulb and a camera as the receiver. The color method transmitted the short message 'hi' at a color difference of 0.5, and the brightness method decoded with 96.2% mean bit accuracy.
In briefA framework assessing whether machine learning intrusion detection for IoT can run on edge, fog, or cloud
SummaryThis paper examines machine learning-based intrusion detection for Internet of Things systems, focusing on whether different methods can practically run on edge, fog/gateway, and cloud architectures. It introduces a Deployment Feasibility Score (DFS) that maps techniques to architectural layers using computational demand, memory footprint, and latency sensitivity. The authors conclude that lightweight statistical and linear models suit edge devices, ensemble and clustering methods suit fog/gateway environments, and deep and optimization-driven models suit cloud infrastructure.
In briefCISB-Bench: An Auditable Source–IR Dataset of Compiler-Introduced Security Bugs
SummaryThe paper presents CISB-Bench, an auditable dataset of 429 exact C-program rows mined from GCC and LLVM, reflecting bugs where compiler optimizations introduce security problems. Each row includes a C reduction, standardized LLVM IR analysis from -O0 to -O3, public provenance, and a reviewed binary label with a mechanism annotation. Two reviewers agreed on 86.0% of rows (Cohen's kappa 0.662), with disagreements adjudicated, yielding 280 CISBs and 149 hard non-CISB cases. It serves as a reusable target for compiler-security mining and detection research.
Saatvik Pradhan, Anuroop Saini, Pranav Attrey et al.
In briefCheckerBench: Can long-horizon agents write static-analysis checkers?
SummaryThis paper introduces CheckerBench, an executable benchmark of 300 tasks drawn from 297 CVEs across 167 repositories, 85 CWEs, and five language ecosystems. Each task provides vulnerable and fixed revisions, a pinned analysis environment, and a checker scaffold. The authors also propose CheckerLab, an evaluation framework that rebuilds submitted checkers and measures diagnostic contrast, patch localization, false positives, and tool use. Across 21 model-harness configurations, mean Pass@1 is 32.30% and the best reaches 45.33%, indicating that developing reliable, reusable checkers remains hard for current coding agents.
In briefLADE: Defending LLMs with Model-Agnostic Safety Signals from Output Probabilities
SummaryThis paper proposes LADE, a decoding-stage defense against jailbreak attacks on large language models. It extracts latent safety signals by contrasting first-token probability distributions of harmful and benign queries, using information beyond the top prediction. The signals are mapped across tokenizers and used for kNN-based query classification, so the method works across different models. The authors report lower attack success rates across diverse LLMs and benchmarks while keeping a competitive safety-utility trade-off.
In briefFaster Parallel Digit Decomposition and Sign Evaluation in CKKS
SummaryThis paper addresses the difficulty of approximating sign, comparison, and ReLU in CKKS homomorphic encryption with polynomials, which needs deep circuits and growing modulus consumption. The authors instead represent inputs as radix-B digits, obtaining all digits in parallel with a single bootstrapping and correcting carries with carry look-ahead. Inputs separated by about 2^-p can then be distinguished with Θ(p) modulus bits. Benchmarks report a 2.04× speedup for ten radix-64 digit decomposition and a 7.83× speedup for sign evaluation on 1,024 real input pairs.
WhyParallel digit extraction with one bootstrapping and O(log u) carry correction speeds CKKS sign evaluation; benchmarks show clear speedups over prior methods.
In briefNot What a Child Expressed: Auditing the Sign-to-Text Safety Interface in Child-Facing AI
SummaryThe paper notes that sign language translation turns a signing child's messages into text that is then judged by child-account filters and grooming classifiers, yet no public system has jointly evaluated the two. The leading translation model was not trained or formally evaluated on signers under 18. It proposes a Deaf-informed pre-deployment audit with a failure taxonomy, sanitised scenarios, four comparison conditions and four outcome measures, using Auslan as the first case study.
Muhammad Rafiullah Memon, Viet Vo, Wanlun Ma et al.
In briefHarmful SFT Leaves Traceable Patterns in LLM Checkpoint Updates
SummaryThis paper asks whether the safety of a fine-tuned large language model can be audited from its weight updates alone, without running the model. The authors find that harmful-compliance supervised fine-tuning produces a continuous, objective-dependent ordering in checkpoint-update space. They introduce TRACE, a weights-only method that outputs a continuous harmful-objective score, and report that it remains stable across settings and is positively associated with measured attack success rates.
WhyProposes weights-only auditing of harmful SFT objectives, validated across four 7-8B backbones with controls reaching Spearman correlations of 0.986-0.992.
In briefBackdoor persistence in LLM agent post-training
SummaryThis paper studies a supply-chain threat in which an attacker provides a model with a hidden backdoor that produces malicious outputs for a specific input pattern. Focusing on software-engineering agents, it examines whether such backdoors survive benign supervised fine-tuning and subsequent task-level reinforcement learning. The authors find that fine-tuning reduces attack success, but RL often preserves residual behavior and sometimes increases it. They propose PersistBD, which raises attack success on Qwen2.5-Coder-7B from 20% to 74% after SFT and to 76% after SFT-RL, with comparable benign task performance.
In briefDual intrusion detection for in-vehicle CAN networks, running on one FPGA for real-time attack detection.
SummaryThis paper proposes a dual intrusion detection framework for in-vehicle CAN networks. A supervised quantised LSTM model (QLSTM-IDS) detects known attacks such as DoS, fuzzing and spoofing, while an unsupervised 8-bit quantised convolutional autoencoder (QCAE-IDS) targets previously unseen anomalies. Both models run on a single ZCU104 FPGA, with reported latencies of 0.25 ms and 0.42 ms and energy use of 0.8 mJ and 1.1 mJ per message and block respectively.
In briefCan Power Draw Limit Hidden AI Computation? Limits of Analogue Checks for AI Governance
SummaryThis paper examines whether off-chip power measurements can verify how much computation an AI system actually ran under an agreement. The authors derive a closed-form bound on the largest hidden computation a power trace cannot rule out, and test it on NVIDIA A100 GPUs. They find that power measurements alone constrain compute weakly, but adding a verifier's ability to re-execute the declared work at an observed operating point lowers the bound substantially.
WhyDerives a closed-form bound on hidden compute from power draw and quantifies verification limits for AI governance; experiments are limited to A100 GPUs.
In briefAdversarial RL Study of Port-Scan Evasion Against Edge-Deployed Intrusion Detection
SummaryThis paper examines how an adaptive attacker can evade machine learning intrusion detection systems running on a Raspberry Pi 3B+. The researchers trained XGBoost, an MLP, and a 1D-CNN on TON_IoT telemetry and used a Deep Q-Network adversary to learn evasive probe patterns under black-box, gray-box, and white-box feature visibility. Although conventional port scans were detected at 91.1–99.8%, evasion rates reached 61.9–98.3%, and greater feature visibility did not consistently increase evasion.
Logan Andrew North, Priya Sanjay Kaluskar, Shasi Kumar Ramachandran Prabhu et al.
In briefNetAgent: A practical agentic framework for multi-task network traffic analysis
SummaryThis paper introduces NetAgent, the first agentic framework for multi-task network traffic analysis, which handles task understanding, decomposition, and long-horizon analysis without task-specific training. It uses knowledge-augmented planning, over 150 verified tools, a unified code execution space, a three-tier memory, and sandboxed runtime repair. Across 9 benchmarks, it achieves 90.04% F1 on unseen traffic distributions and drops only 4.85 F1 points under realistic background shift, outperforming the baselines.
In briefA Simpler Extremely Lossy Function Built from Small-Exponent Hashing
SummaryThe paper introduces Extremely Lossy Trapdoor Hashing (ELTDH), a stronger primitive that implies all known variants of Extremely Lossy Functions. Its construction achieves ELTDH in one step rather than by bootstrapping from schemes secure only against fixed-size adversaries, making it simpler and more efficient than prior ELFs. It relies on exponential security of the small-exponent discrete logarithm and polynomial security of decisional composite residuosity.
In briefTesting whether behavioral context improves explainable IAM policy risk ranking in cloud environments
SummaryThis paper examines whether behavioral and environmental context adds measurable value to IAM policy risk prioritization beyond policy and effective-authorization information. The authors use AWS IAM Context Bench, a benchmark of 534 real AWS observations, and compare three Explainable Boosting Machine models: policy-only, policy plus environment, and a full-context model that includes CloudTrail telemetry. The full-context model substantially reduces prioritization prediction error and separates benign from suspicious behavior in matched same-policy pairs.
In briefWeight Oracles: Using Language Models to Read Neural Network Weights
SummaryThis paper proposes Weight Oracles, fine-tuned language models that diagnose a neural network by reading its raw weights directly, without behavioural testing. In the first phase, an explainer LLM learns to simulate small transformers' forward passes from their weights, reaching 99% holdout accuracy on unseen targets. In the second phase, it is trained only on benign anomalies and tested zero-shot on backdoors absent from training, achieving AUROC 0.93 on attention-routed backdoors and 0.81 across a diversified threat distribution. The authors note that scaling to realistic model sizes remains the principal open challenge.
Krishna Kabra, Constantin Venhoff, Christian Schroeder de Witt
In briefATLAS-AL: Adaptive trust regions for finding sets of adversarial inputs via active learning
SummaryThis paper introduces ATLAS, a query-based framework that finds sets of adversarial inputs against black-box learning systems. It frames attack generation as level set estimation in active learning, combining local and global sampling to locate adversarial regions. The authors report that under limited query budgets, ATLAS recovers more adversarial regions and produces more representative attacks than NES, SignHunter, and BayesOpt on MNIST, CIFAR, and ImageNet models.
In briefFrom Sandbox to Enforcement: Confidence-Qualified Threat Intelligence for Critical Infrastructure
SummaryThis paper presents CG-CTI, a pipeline that converts live malware sandbox output (CAPEv2) into STIX 2.1 and links it in a knowledge graph with other critical-infrastructure sensor data. Each intelligence object receives a confidence status based on provenance, cross-source corroboration, and observation durability, and only corroborated intelligence may trigger automated enforcement. A grounded language-model stage narrates the findings and removes statements that lack supporting evidence. The system is implemented within the CYBERGUARD project and evaluated on a labelled malware corpus.
Nikolaos Kekatos, Mihaela Curc\u{a}, Georgios Koutidis et al.
In briefPolar: LLM-based synthesis of real-world cyber evidence to rank threats and guide mitigation
SummaryThis paper presents POLAR, a large language model framework that combines scattered cyber evidence from vendor advisories, vulnerability databases, and threat intelligence into threat-centric assessments. It separates overlapping incidents, links each threat to its source evidence, and estimates near-term exploitation likelihood from time-ordered exploitation signals. It also connects threats to authoritative remediation knowledge. Evaluated on real-world vulnerability evidence from public sources, POLAR reportedly improves threat ranking and mitigation retrieval over multiple baselines.
In briefA resilient runtime-verification system that keeps security monitoring reliable for edge IoT infrastructure
SummaryThis paper presents RV-Fabric, a resilient delivery layer for runtime verification of critical edge-IoT infrastructure, using MQTT for device ingest and a durable stream broker for backend delivery. It aims to keep events complete and correctly ordered despite crashes, clock skew, network silence, and slow consumers. Each verdict carries an evidence status (sound, degraded, incomplete, or unavailable). In controlled fault-injection tests, the shared-log baseline missed six of seven incidents while RV-Fabric preserved all seven, and two public datasets, water-SCADA and IoT/IIoT, were replayed.
Nikolaos Kekatos, Marinelio Chintri, Panagiotis Katsaros et al.
In briefSAFESHIELD: A framework for organizing safety decisions in small language models at deployment
SummaryThe paper frames deployment-time safety of language models as a problem of organizing safety decisions, by splitting them into responsibilities and coordinating how they relate. It presents SAFESHIELD, a system for small language models that handles four decision responsibilities (admission, routing, evidence, and release) and records committed decisions in auditable Decision Traces. Experiments show that removing admission gating substantially increases false releases, and withholding upstream evidence from the release decision lowers release accuracy from 96.0% to 69.5%.
In briefLineage-Aware Memory Governance: Column-Level Access Control for Shared Enterprise AI Agent Memory
SummaryThis paper addresses risks in enterprise AI agents that share a memory store, where sensitive data can leak through legitimately computed results and departments can compute same-named KPIs with conflicting logic. The authors propose the Analytical Memory Unit (AMU), which attaches a full derivation (lineage) graph to each cached result and serves a hit only when the requester is authorised for every column it touches. They state that, given complete lineage recording, this design blocks retrieval of unauthorised derived results by construction. Experiments report removal of cross-department leakage while retaining about 81.5% to 82.6% of memory reuse.
In briefEfficient auditing of harmful AI agent actions from execution traces
SummaryThis paper proposes a two-stage framework for auditing LLM-powered AI agents. A first stage uses rules to select pending actions for inspection, and a second stage uses an LLM audit agent to check each selected action against the agent's preceding trace before execution. The gate rules and audit instructions are jointly refined using training data. On the OpenAgentSafety benchmark, average LLM audits per run fall from 8.15 to 2.33, with a 72.8% detection rate versus 81.5% when every action is audited.
In briefHow Pauli error makeup sets the multiparty edge in conference key agreement
SummaryThis paper compares GHZ-based conference key agreement with pairwise BB84 for distributing keys among multiple parties. Exact simulations for three, four, and five parties under dephasing, amplitude damping, and depolarizing noise show that the crossover point depends on the channel's Pauli error composition rather than its specific type. The authors also derive a closed-form rate for arbitrary per-party Pauli noise.
Ryder Carlson, Lochlan Fitzgerald, Kidus Peter et al.
In briefReinforcement learning with rewards that protects training prompts' privacy
SummaryThis paper studies reinforcement learning with verifiable rewards (RLVR) under prompt-level differential privacy, requiring released model weights to be private with respect to the presence of any single training problem. The method aggregates gradients of each prompt's group of responses, clips once, adds Gaussian noise, and composes privacy loss across updates. Training Qwen2.5-1.5B-Instruct at epsilon=8, the private model outperforms two private supervised fine-tuning recipes on MATH and GSM8K and retains 85–90% of non-private GRPO's gain.
In briefSimpler Extremely Lossy Functions via Small-Exponent Hashing
SummaryExtremely Lossy Functions (ELFs) are a standard model primitive that captures useful properties of random oracles. Earlier constructions bootstrapped from ELFs secure only against fixed-size adversaries and relied solely on the exponential hardness of DDH or k-Lin. This paper introduces Extremely Lossy Trapdoor Hashing (ELTDH), a stronger notion implying all known ELF variants, and constructs it in one step without bootstrapping. The construction assumes exponential security of small-exponent discrete logarithm and polynomial security of DCR, making it simpler and more efficient than prior ELFs.
In briefTranScope: Hardware Traces Reveal Whether an LLM Was Trained on Given Data
SummaryThis paper is the first cycle-level study of how large language and vision transformers interact with modern microarchitecture, including integrated accelerators. It finds that training data leaves a trace in execution behavior even without input-dependent branches, because tokenization changes TLB and page-table access patterns. The authors introduce TranScope, a low-cost tool for membership inference that needs no surrogate model and reports an AUC of 0.9, versus 0.6 for the best prior method, PETAL.
Joshua Kalyanapu, Darsh Asher, Kaushal Mhapsekar et al.
In briefPrivate online learning versus private prediction: a separation for Littlestone classes
SummaryThe paper studies mistake bounds for differentially private online learning and online prediction against oblivious realisable adversaries. It shows that private online learning must release a hypothesis at each step, while prediction does not, and that their sample complexities separate by a factor growing with the time horizon for classes of finite Littlestone dimension. The authors give a new lower bound for private online learning and an upper bound for private prediction that is independent of the time horizon.
WhyProves a new lower bound for private online learning and an upper bound for private prediction, showing a horizon-dependent separation between them.
In briefJailbreaking Open-Weight LLMs via Random Embedding Noise
SummaryThis paper shows that six common open-weight LLMs of various sizes can be made to give harmful responses on the JailbreakBench benchmark. The proposed Perturbed Embedding Vector (PEV) attack adds independent Gaussian noise to prompt embeddings and repeatedly samples it, without gradient computation or changes to model weights. The authors report that the average compute cost to the first successful attack is up to an order of magnitude lower than prior methods, and PEV produced unsafe responses for all prompts across all tested models.
Abhinav Sudhakar Dubey (University of California Santa Cruz), Scott Sirri (University of California Santa Cruz), Vaggos Chatziafratis (University of California Santa Cruz) et al.
In briefBlack hole radiation decoding: optimal query bounds in the Haar random oracle model
SummaryThe paper proves optimal query bounds for recovering a single qubit from black-hole radiation in the Haar random oracle model, when the remaining black hole holds at most one sixteenth of the system's qubits. Achieving any constant Haar-averaged advantage over trivial decoding requires queries proportional to the remaining black hole's Hilbert-space dimension. The authors also apply a path recording oracle to obtain an EFI pair and quantum commitments relative to a public Haar oracle.
WhyProves tight query lower bounds for black-hole radiation decoding in the Haar oracle model, matching an existing decoder; rigorous proof with consequences for quantum cryptography and complexity.
In briefTight query lower bounds for quantum sampling and certified randomness
SummaryThis paper examines what a high linear cross-entropy benchmark (XEB) score in random circuit sampling certifies about an untrusted quantum device. In the quantum query model, the authors show the honest sampler's ideal score acts as a Tsirelson bound for efficient devices and certified randomness. They prove that exceeding the ideal score by a constant requires Ω(N^{1/3}) queries, and that this bound is tight. They also show that the output retains nearly optimal smooth min-entropy.
WhyProves tight query lower bounds showing high XEB scores certify near-optimal smooth min-entropy, resolving a conjecture and extending it to Fourier sampling.
In briefPrivate mixing of public datasets to improve differentially private learning
SummaryThe paper introduces the first pipeline that privately learns the best mixture of several public datasets for pretraining, tailored to a given sensitive downstream task, by privately fitting a low-dimensional linear model. On the NIH ChestX-ray14 X-ray classification task, it improved macro AUC by up to 0.037 across privacy budgets over baselines. On ENRON email language modeling, pretraining on its mixture of The Common Pile reduced test perplexity by 16% relative to baseline mixtures.
In briefDoes AI Help Attackers or Defenders? A Study of Unpublished Software Flaws and Follow-Up Attacks
SummaryThe study tests open-weight and proprietary AI models on generating exploits, repairing vulnerabilities, and carrying out follow-up attacks in five nonpublic software environments, including flaws the authors privately reported that remain unpatched. Scores come from researcher-built deterministic graders rather than LLM judges. Results vary widely across systems and vulnerability types, with repair scores higher than attack scores in two environments and lower in three. Passing an initial security test was not enough, as another exploit succeeded in 92 of 524 non-independent defender test intervals after the first exploit was stopped.
In briefFaster Mid-Size Integer Multiplication with FFTs on Large ARM CPUs
SummaryThis paper examines when FFT-based multiplication becomes faster than conventional methods on large modern ARM processors. The first implementation on Cortex-A76 and Neoverse-N1 places the crossover around 10k bits. A second version removes extra reduction steps and lowers the crossover to below 5.6k bits. The multipliers are integrated into OpenSSL RSA, yielding end-to-end speedups for public-key operations.
Cesare Huang, Daisy Meng-Wei Liu, David Shu-Yu Wu et al.
In briefGCTAuto-encoder: A Cross-Modal Framework for Detecting Security Flaws in IoT Networks
SummaryThis paper proposes GCTAuto-encoder, a cross-modal deep learning framework for detecting intrusions and security flaws at the edge of IoT networks, supported by a cloud-based IoT framework. It is compared against baseline models. On an IoT network intrusion dataset covering multiple attack scenarios, the authors report 0.908 accuracy and a learning loss of 0.00156, and claim it outperforms existing approaches.
In briefEvaluating How Well Large Language Models Understand Web Attack Payloads
SummaryThe paper notes that existing studies treat web attack payload analysis as a single-layer classification task and lack a systematic measure of semantic understanding depth. The authors build PayloadSemBench, a four-layer benchmark of 240 payloads, and re-evaluate on an independent 180-record dataset. Type identification and intent understanding are generally strong, severity assessment is the main weakness, and semantic understanding is only partially linked to detection decisions.
In briefTerracotta: A flexible DRAM interface and controller to ease adoption of new DRAM techniques
SummaryThis paper proposes Terracotta, a framework that combines custom DRAM command extensions within a standard interface and a programmable memory controller. The goal is to let new DRAM techniques be deployed by reconfiguring the controller instead of repeatedly modifying the interface and controller. Evaluated on a DDR5-based system with four DRAM techniques, Terracotta retains over 96% of the performance benefits of custom implementations, with low energy, area, and power overheads.
WhyProposes a unified programmable controller and command-extension framework, validated on four DRAM techniques retaining over 96% of custom performance.
Harsh Songara, Konstantinos Kanellopoulos, F. Nisa Bostanc{\i} et al.
