In briefCollusion-resistant semi-quantum secret sharing using a quantum third party
SummaryThis paper proposes a semi-quantum secret sharing protocol in which participants have only classical capabilities and a quantum-capable third party helps distribute the secret. The authors note that existing protocols can be vulnerable to collusion between the quantum third party and a dishonest classical participant, and they design a scheme that removes this weakness. The paper states the protocol is secure against a broad class of external and internal attacks, and a comparison with prior work reports improvements in qubit efficiency, a classical dealer, and resistance to DCNA attacks.
In briefSimple Byzantine Lattice Agreement Deciding in O(log f / log log f) Rounds
SummaryLattice agreement is a relaxed form of consensus in which correct processes' decisions must be comparable rather than identical. The paper presents Join-IT, a synchronous Byzantine lattice agreement protocol tolerating f < n/3 faulty processes and deciding in O(log f / log log f) rounds, breaking the previously best known logarithmic bound. The protocol uses no cryptography, so its guarantees hold against computationally unbounded adversaries. It sequentially composes gradecast and approximate agreement, with a final local step producing comparable decisions.
WhyBreaks the logarithmic round barrier by composing gradecast and approximate agreement; the complexity analysis supports the result, with moderate subfield impact.
In briefA short note showing the Hair–Sahai witness encryption scheme is extractable in the generic group model
SummaryThis note shows that a recent witness encryption construction for NP by Hair and Sahai is unconditionally extractable in the generic group model. This avoids assuming subexponential soundness of SNARGs, which a related work by Jin requires. The result complements a concurrent paper by Chen and Vaikuntanathan, which shows public-coin extractability under a knowledge-style assumption.
In briefReliability of Benchmarks for LLM-Based Vulnerability Patching
SummaryThis paper argues that current benchmarks for evaluating large language models' automated vulnerability patching can substantially distort reported performance. The authors identify pitfalls across agent-level, framework-level, and dataset-level factors. They curate 112 historical bugs from 84 open-source C/C++, Go, and Rust projects, each with PoC, regression, and developer tests. They find high PoC pass rates under ideal conditions, but low developer-test pass rates that improve only marginally with newer models, and they offer guidelines for more rigorous evaluation.
In briefNote on whether PST polynomial commitments are extractable
SummaryThis paper examines the extractability of the PST multivariate polynomial commitment scheme. A prior work showed black-box extractability under falsifiable assumptions, using newer specialized assumptions. This note shows that these assumptions are equivalent to the original ARSDH assumption, and identifies a gap in the proof for canonical PST under GARSDH.
In briefBetweenCut: Private Detection of Heavy Tree Nodes with Doubly Logarithmic Error
SummaryThe paper addresses finding heavy nodes in a tree, meaning nodes whose counts exceed a threshold, a basic step for analyzing structured data. It introduces BetweenCut, an (ε,δ)-differentially private algorithm whose additive error is O(log log h) for tree height h, improving prior bounds for deep trees. The error bound holds simultaneously for all nodes and does not depend on the input database size.
In briefPrivTab: A Tabular Foundation Model for Provably Private Classification
SummaryThe paper introduces PrivTab, a tabular foundation model for differentially private classification that builds a privacy mechanism into its architecture. Pretrained on simulated datasets, it uses in-context learning to convert sensitive rows into compact, provably private summaries. According to the paper, it outperforms private linear and neural-network baselines under moderate-to-strong privacy, shows negligible membership leakage, and reduces dataset fitting time by 10,000 times.
WhyEmbeds differential privacy into a tabular foundation model with in-context learning, a novel single-pass approach; experiments against private baselines are reported but details are limited.
Talal Alrawajfeh, Cristiana Diaconu, Ossi R\"ais\"a et al.
In briefHash tables beat trees for oblivious dictionaries inside SGX enclaves
SummaryOblivious RAM hides both data contents and access patterns, but offers only an array interface, making efficient oblivious dictionaries hard to build. The paper argues that the current state-of-the-art oblivious AVL tree design is suboptimal inside trusted execution environments such as SGX. The authors implement and analyze oblivious probabilistic hash tables over Path ORAM and report up to 20 times faster lookups and 12 times faster inserts than oblivious trees in an SGX deployment.
In briefHide Now, Trace Later: Issuer-Hiding Credentials That Allow Retrospective Attribution
SummaryAttribute-based credentials let users prove attributes without revealing extra information, but verification normally exposes the issuer, which can leak details like nationality. This paper proposes an issuer-inspection mechanism in which an inspection authority releases keys that let verifiers locally identify presentations from one compromised issuer within a specific time period. Other issuers and earlier periods are unaffected. The authors give formal definitions, a generic construction, and a pairing-based instantiation, and they argue its computational and communication costs are practical.
In briefDefining Purpose-Limited Secrets: A Cryptographic Framework Separating Capability from Intended Use
SummaryThis paper proposes defining a cryptographic secret's intended purpose as a property of the secret itself. It distinguishes three regimes: confinement (out-of-scope operations are infeasible), mediation (a trusted component refuses them), and accountability (they are possible but attributed to the holder), with security games for each. A payment token example shows all three regimes applied to one secret, with reductions of its security properties to standard assumptions.
In briefThe Cost of Privacy: Randomness Needed to Share Multiple Secrets on Graphs
SummaryThis paper studies how much randomness is needed to share possibly correlated secret bits among parties connected by a graph. A dealer places shares on the edges so each party can recover its own secret while learning nothing about others beyond what its own secret reveals. Prior work fully determined the minimum randomness for three binary secrets. This paper extends the analysis to four secrets and to arbitrary numbers of secrets on general graphs.
In briefSensitive-Topic Leakage via LLM Routing Metadata: Measurement and Fixes
SummaryLLM routers choose cheap or expensive models per request based on content, and this choice can be logged even when content logging is off. The authors measure this privacy channel on 1.7 million real requests, survey eleven systems' logging practices, and test post-processing defenses. They find the direction of routing shifts varies by category and router, and that per-category length-matched parity can remove the gap on real traffic.
In briefCYBERFORT: A compliance-chain platform helping SMEs meet the EU Cyber Resilience Act
SummaryThis paper presents CYBERFORT, an open-source platform built around the EU Cyber Resilience Act (CRA) to help small and medium-sized enterprises, which often lack dedicated compliance staff, assess their scope and check their compliance. Its central idea is a compliance chain that links each product risk through controls and policies to the CRA obligations it satisfies, and then to evidence, technical documentation, and the EU declaration of conformity. The authors report an end-to-end case study on a SIEM/XDR product and deployment to a first cohort of 43 organisations, while the controlled effort study is still in progress.
Nikolaos Kekatos, Georgios Koutidis, Mihaela Curc\u{a} et al.
In briefAI-Assisted Security Response with Constrained Actions and a NeMo-Guardrails Proxy
SummaryThis paper addresses the risk that an LLM used to automatically remediate SOC alerts could be manipulated by adversarial alerts into recommending harmful actions. It proposes a two-layer design in which a SIEM/XDR control plane limits the LLM to a closed intent vocabulary, and a NeMo-Guardrails proxy filters inputs and outputs. On the released SOC-specific adversarial corpus, the proxy raised injection recall from 25.0% to 94.5% at a 0.1% false-positive rate. The authors note the architecture suits critical-infrastructure settings but has not been measured in an operational-technology deployment.
Georgios Koutidis, Nikolaos Kekatos, Tom Nianios et al.
In briefDefensive Sufficiency in AI Security: A Stackelberg Game Study of Discovery and Repair
SummaryThis paper studies how feedback from automated testing, human red teaming, and incident response can strengthen an AI system's defenses when discovered failures are effectively repaired. It shows that under stated conditions a finite attack surface is defended with probability 1, and derives completion-time bounds, extending the analysis to growing attack surfaces and multiple discovery mechanisms. It also formulates a defender-led Stackelberg game to identify the least-cost investment that deters attacks and the equilibrium regimes for funding discovery and repair.
In briefThe Price of Privacy: How Much Randomness Graph-Based Secret Sharing Needs
SummaryThis paper studies how much randomness is needed to share possibly correlated secret bits among parties connected by a graph. A dealer places shares on the edges so each party can recover its own secret from its incident shares and learn nothing else beyond its own secret. The authors extend earlier results for three binary secrets to four secrets and to arbitrary numbers of secrets on general graphs. They also determine when one random bit suffices on an arbitrary graph.
In briefHybrid Layered Runtime Verification for Edge-IoT Security Using MonPoly and RTLola
SummaryThis paper proposes a three-layer runtime verification framework for monitoring edge-IoT device fleets, with edge, gateway, and cloud layers. The cloud layer combines MonPoly, which detects coordinated attacks across devices, and RTLola, which uses time-triggered checks to catch silent nodes. In a 15-actor Docker testbed, the authors report that RTLola detects silent-bypass attempts that an event-triggered engine misses.
Nikolaos Kekatos, Marinelio Chintri, Panagiotis Katsaros et al.
In briefSafety Across Recurrent Depths: Aligning Looped Language Models
SummaryThis paper examines whether looped language models stay safe at every recurrent depth used during inference. The authors find that jailbreak attack success can rise at deeper depths, and that attacks built for one depth can transfer to others. They propose SafeBridge, which combines depth-specific control, selective state bridging, and joint safety supervision across depths. The method substantially reduces attack success while preserving general utility and comparable over-refusal behavior.
In briefLayered Security Monitoring for Edge IoT Using Formal Methods
SummaryThis paper proposes a lightweight hierarchical security monitoring framework for edge-IoT, built on formal runtime verification. Edge devices run TeSSLa stream specifications that emit a four-valued verdict per aggregation window, while a gateway runs a parametric first-order MonPoly monitor to detect coordinated multi-device attacks. The framework was evaluated on a container-host testbed against four attack classes, and it examines the cost-versus-coverage trade-off as monitor levels are added.
Nikolaos Kekatos, Marinelio Chintri, Panagiotis Katsaros et al.
In briefFormal runtime checks for AI agents that use tools, tested offline on two benchmarks
SummaryThe study replays recorded trajectories from AgentDojo, STAC and R-Judge through the MonPoly monitor, using metric first-order temporal logic, without running any agent. Five generic obligations flagged 71.8% of STAC attack chains and 70.1% of successful AgentDojo attacks, but also fired on 29.3% of benign runs. The authors attribute this imprecision mainly to the benchmarks, which rarely record approvals and never record timestamps. They also show that provenance information can be attacked, and that binding provenance to its lookup closes this evasion, and they propose a twelve-field trace schema.
Nikolaos Kekatos, Stylianos Basagiannis, Marinelio Chintri et al.
In briefPost-quantum secure aggregation for federated learning that tolerates dropouts and can be verified
SummaryThis paper proposes PQ-DVSA, a verifiable secure aggregation scheme for federated learning that aims to stay secure against quantum attacks. It can rebuild the aggregate mask for the active clients when some clients drop out, and it protects both local model updates and aggregation weights. Clients can check the server's result under bounded collusion. Experiments report learning performance comparable to exact weighted aggregation and up to 96% lower encrypted submission runtime per client than SWAS.
In briefFaster PMNS multiplication for large-number cryptography, using truncated Montgomery reduction
SummaryThis paper studies Polynomial Modular Number Systems (PMNS), which represent large-field elements as bounded polynomials to speed up cryptographic arithmetic. The authors first present a schoolbook PMNS software implementation that uses less memory and lower multiplication complexity than the prior Toeplitz approach. They then apply a truncated Montgomery-style reduction to the internal reduction step. With AVX512 and moduli up to 8192 bits, the method reports up to 15% faster modular multiplication than conventional approaches.
Laurent-St\'ephane Didier, Alexy Dutois-Ruiz, Jean-Marc Robert
In briefRound-optimal secure multiparty computation that provably identifies cheaters
SummaryThis paper studies secure multiparty computation with provable identifiable selective abort (PISA), where each honest party either gets the output or a certificate convincing an external auditor that a specific party cheated, without honest parties needing to agree. The authors determine the round complexity for nearly all thresholds: two rounds are impossible for t ≥ n/3, a three-round protocol works for any t < n/2 (round-optimal for n/3 ≤ t < n/2), and a two-round protocol is given for t < n/4. The two-round protocol introduces a new primitive, one-or-nothing secret sharing with omissions.</summary>
WhyProves two rounds impossible for t≥n/3 and gives three- and two-round protocols, improving the prior six-round construction.
In briefEfficient secure computation protocols that identify cheaters when aborts occur
SummaryThis paper proposes two helper-aided secure multi-party computation protocols, Alhena for synchronous networks and Wasat for asynchronous networks. They provide identifiable fairness: either all parties get the output, or, if an abort happens, no one does and honest parties identify at least one common cheater. Experiments report online-phase speedups of 4–12.5× (Alhena vs. Asterisk) and 2.5–5× (Wasat vs. Castor), and about 3× preprocessing speedup for Wasat over Castor.
In briefTrusting Only a Few: The Weakest Assumptions a Protocol Needs
SummaryThis paper studies the weakest trust assumptions about keys, values and channels that a security protocol must rely on to meet a security goal. The authors characterize these minimal assumptions as the minimal ways to block all minimal attacks and give an iterative method that queries a verifier. Across 18 goals over ten protocols and their variants, the method agrees with evaluating every trust set using the same verifier.
In briefPareto-optimal quantum kernel selection for unsupervised malware beaconing anomaly detection
SummaryThe paper proposes a fully unsupervised, multi-objective protocol that jointly optimises a label-free anomaly detection proxy (normalised pseudo discrepancy) and geometric difference from a tuned classical reference kernel, selecting models from the Pareto front. It evaluates one-class SVMs with fidelity and projected quantum kernels on real network traffic for malware beaconing detection, including runs on IQM's 20-qubit Garnet processor. The NPD-selected fidelity kernel reaches AUC 0.840, beating the tuned classical baseline (0.765), but its geometric difference is too small to certify a quantum advantage. The Pareto-selected projected kernel has a larger geometric difference yet only marginally exceeds the baseline (AUC 0.782).
In briefBlack-box adversarial patch attacks on robot VLAs using only their ancestor vision-language models
SummaryThis paper studies the adversarial robustness of Vision-Language-Action (VLA) models, which are often built by adapting public pretrained vision-language models (VLMs). The authors propose three adversarial patch attacks that target inherited visual perception and instruction grounding, optimized only on the ancestor VLM. Experiments on simulation and static real-world images show substantial drops in VLA task success, though the effect is strongest on instruction-grounded localization tasks and nearly vanishes for some policies.
In briefUnderstanding and mitigating safety vulnerabilities caused by token pruning in vision-language models
SummaryThis paper presents the first comprehensive safety evaluation of token-pruning methods used to speed up vision-language models by removing redundant visual tokens. The authors find that most pruning strategies weaken safety as pruning ratios rise, while query-based compression unexpectedly improves safety even at extreme pruning levels. They identify a mechanism called Pruning-Induced Malicious Amplification and propose Safety-Aware Pruning, an inference-time, plug-and-play method. Across three safety and four utility benchmarks, it reportedly reduces attack success rate by up to 62% without sacrificing efficiency or utility.
In briefAutomotive Hardware Attacks: A Guide to TARA for Architects
SummaryThis paper argues that ISO/SAE 21434 threat analysis and risk assessment handles implementation-level hardware attacks inconsistently, with some methods rating physical-access attack paths as very low regardless of implementation. The authors propose a hardware-aware TARA extension covering side-channel analysis, fault-injection attacks, and abuse of debug and test interfaces, and apply it to a reference gateway architecture. Of ten published automotive component attacks examined, seven involved debug, programming, boot, diagnostic, or update mechanisms, while only four involved attacks on cryptographic computation.
In briefWhen AI Finds Hidden Messages, Does It Report?
SummaryThis paper examines whether AI assistants tell their users when they encounter a message intended for another AI during a task. Using four fixed model deployments, the authors ran 1,280 ordinary-note and 128 enhanced-note simulated sessions with plaintext and ROT13-encoded harmless and harmful messages, plus no-message controls. Requesting reports substantially increased notifications identifying another AI as the recipient, though some omissions remained, and interpretation, notification, and authorized task performance were found to be distinct outcomes.
William Guey, Rashik Jahangir, Pierrick Bougault et al.
In briefClosed-form noise calibration for DP-SGD with random allocation against membership inference
SummaryThis paper studies DP-SGD (differentially private stochastic gradient descent) with random allocation, where each record is used once per epoch at a random step. The authors give a one-line formula that bounds the accuracy of any membership inference attack on the trained model, and use it to compute the noise multiplier in about a microsecond. Where applicable, the formula needs about half the noise of the best prior closed-form bound, and models trained with it match a published accountant in test accuracy. The authors also report that membership inference attacks on the trained models stay below the bound.
WhyGives a closed-form bound on membership inference accuracy for random-allocation DP-SGD, with an exact expression, less noise than prior bounds, and supported by numerical and training experiments.
In briefChoosing Which Intermediate Values to Keep in Quantum CHAM Key Search
SummaryThe paper studies quantum key search against CHAM-128/128 for 80-round and revised 112-round versions under a fixed global logical-qubit budget. It jointly selects which round addends to retain, how many parallel search workers to allocate, and execution plans to minimize maximum logical depth. Compared with a baseline limited to no retention or full retention, mean depth reductions are 11.12% and 8.39% across 654 conditions. Results assume an ideal-cipher success model and logical-layer costs.
In briefA universal forgery attack on Origami signatures using only the public key
SummaryOrigami is a multivariate signature scheme submitted to NGCC's first-round public-key call. The paper argues that its bilinear construction is a Rainbow-type scheme with an exposed central map, so the public key yields an equivalent secret key. The authors report forgeries at about the cost of one verification, succeeding against the unmodified reference implementation and official test vectors, and state that the security proof's inversion assumption fails in a bilinear model.
WhyShows the scheme is a Rainbow-type construction with exposed central map, giving a universal forgery attack validated on all parameter sets and official vectors.
In briefMRCert: Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking
SummaryThis paper addresses how deep learning models can handle inputs that may contain adversarial patches after deployment. It proposes MRCert, a masking-based certified recovery defense that infers type-specific properties for benign and adversarially patched samples and verifies that the returned label is benign. On ImageNet with 16-pixel patches, MRCert reports 35.1% adversarial certified accuracy, while the state-of-the-art PatchCURE fails completely.
WhyProposes the first masking-based certified recovery with type-specific design achieving both accuracy and label verification, substantially beating SOTA on ImageNet.
In briefWhen Routing Reveals Membership: Privacy Leakage from MoE Router Telemetry
SummaryThis paper studies whether routing information produced by Mixture-of-Experts language models during inference can reveal if an example was used to fine-tune the model. The authors propose a membership inference attack that combines output signals with aggregated routing features, improving TPR at 1% FPR by 2.7 to 9.4 points across nine settings. The leakage persists even when the router is frozen, and perturbing the telemetry reduces it only as its fidelity degrades.
In briefRight answers, weak support: evidence binding in reconstructing LLM agent logs
SummaryThis paper examines forensic reconstruction of LLM-agent actions, arguing that identifying the correct value is not enough; one must also show which preserved record supports it. Using 64 mechanically checkable cases from saved AgentDojo Banking runs, the authors test two LLM readers under varied evidence visibility and identifier-to-record bindings. Without explicit bindings, the models often recovered correct answers but made unsupported citation-source claims, so factual agreement alone is insufficient for evaluation.
In briefBeyond FAIR: A Fitness Function Framework for Sustainable Research Software
SummaryThis paper argues that the FAIR principles (findability, accessibility, interoperability, reusability) do not cover all aspects of research software sustainability. The authors extend a previously proposed fitness function framework with environmental functions for resource efficiency and execution footprint, and security functions for dependency health, vulnerability exposure and secure configuration. The framework treats sustainability as a multidimensional property that includes FAIR compliance, environmental responsibility and long-term security.
In briefPrivacy-preserving in-vehicle CAN anomaly detection using a temporal transformer and federated lightweight heads
SummaryThis paper proposes a framework for detecting subtle timing and content anomalies on in-vehicle CAN buses while preserving privacy. A lightweight Transformer encoder models how CAN signals evolve over time, and federated learning lets multiple vehicles or ECUs jointly improve a shared model without sharing raw CAN data. According to experiments on open-source datasets, the approach achieves robust detection while remaining efficient and privacy-preserving.
Konstantinos Gyftodimos, Kyriakos Chiotis, Elena Politi et al.
In briefPyCache Trap: Gap Between Inspection and Execution in Agent Skill Scanners
SummaryThe paper shows that agent skill scanners inspect documentation and visible source code, while Python may execute a bundled bytecode cache with different behavior. It introduces PyCache Trap, which pairs benign source with a substituted cache, reaching 94-100% attack success across 100 skills and seven scanners. The authors propose execution-aware validation (EAV), which detects all 100 cache substitutions and reaches 92.8% recall at 10.0% false positive rate on 200 benign skills.
WhyExposes a gap between scanned source and executed bytecode caches, proposing execution-aware validation; 94-100% attack success across seven scanners, with 92.8% recall detection.
In briefMARS: Using Rule-Scored Model Claims to Classify Malware
SummaryThis paper presents MARS, a malware triage framework that compares direct LLM classification with scoring of behavioral claims by an external policy. Evaluated on 1,195 PE and ELF binaries and six language models, direct classification was more accurate for all models and achieved higher malicious alert recall in most configurations. Retained claims allow policy revision without another model call, which the authors demonstrate by reproducing archived verdicts.
In briefConstitution-Guided Watermarking: Per-Request Text Watermark Configuration from Natural-Language Rules
SummaryThe paper addresses the EU AI Act's requirement that providers mark generated text in a machine-readable way. It proposes constitution-guided watermarking, where providers write natural-language rules, and a reasoning agent offline tunes each rule's watermark configuration using measured detection, quality and paraphrase robustness, then a monitor routes each request to its configuration at deployment. With the KGW watermark, the authors report more detected paraphrased text than fixed configurations and random search on misuse-prone requests, and exemption of all editing requests.
In briefUpgrading Bounded-Collusion to Full Security in Pairing-Based Encryption
SummaryThe paper presents a general method for upgrading pairing-based encryption schemes from bounded-collusion security to full security. It applies the method to batched identity-based encryption, removing tag restrictions, and to multi-authority attribute-based encryption supporting conjunction policies. Both constructions are given in the generic bilinear group model.
WhyGives a general method lifting bounded-collusion pairing schemes to full security, yielding first tag-free batched IBE and black-box multi-authority ABE.
In briefSecure-CUA: Limiting Untrusted Content's Influence on Computer-Use Agents
SummaryThis paper addresses computer-use agents that perform tasks by observing graphical interfaces and issuing clicks and keystrokes, noting that untrusted content on these interfaces can embed instructions or misleading cues. The authors propose Secure-CUA, which commits to an explicit per-action transaction before accessing untrusted content, masks untrusted regions, and uses an isolated query model to answer queries. On 400 WebArena tasks, Secure-CUA achieves a 53.55% average success rate, close to Vanilla-CUA's 55.12% and well above CaMeL-CUA's 13.17%.
Sarthak Choudhary, Mihai Christodorescu, Ashish Hooda et al.
In briefFaster provably correct lattice sieving using spherical codes
SummaryThis paper studies the μ-SVP problem, which asks for a μ-approximate shortest nonzero vector in a lattice for constant approximation factors μ > 1. The authors combine fast nearest-neighbor subroutines from heuristic sieving with a perturbation argument from provably correct sieving to build a new sieving algorithm and prove its correctness. Its running time depends on the maximal size of certain spherical codes; under a reasonable assumption about that size, it runs in roughly 2^{0.3066n} time for large constant μ.
WhyCombines fast heuristic nearest-neighbor subroutines with a provable perturbation argument, greatly speeding proven sieving, though relying on a spherical-code size assumption.
In briefImproving AI Agents for Security Alert Triage: Testing Methods and a Multi-Agent Review Framework
SummarySecurity operations centers must sort through many alerts, mostly benign, where missed attacks can go uninvestigated. The authors studied five tool-using LLM agent approaches on ALERT-BENCH, an interactive benchmark replaying enterprise telemetry through a live SIEM, and found every approach missed at least 40.4% of attack alerts. They propose AIDA, a multi-agent framework requiring a proposed decision, independent challenge, and a Judge that adjudicates against evidence, achieving an F1 of 0.958 and reducing the false-negative rate to 3.1%.
Saimon Amanuel Tsegai, Alex Kantchelian, Danfeng (Daphne) Yao et al.
In briefAsk the Expert: LLM-guided reinforcement learning for autonomous cyber defense, with the LLM used only during training
SummaryThis paper proposes a training-time guidance framework for autonomous cyber defense. It summarizes hard defense states, intermittently queries an LLM for host-level recommendations through a constrained action interface, and converts them into tiered reward shaping for PPO. The LLM is discarded after training, so deployment is a pure RL policy. Across TTCP CAGE CC1 and CC2 with both attacker types, it improves sample efficiency over PPO and outperforms the evaluated PBRS baselines.
In briefAttacks on coding agents that trick them into installing malicious packages via poisoned rule files
SummaryThe paper examines the security risks of coding agents that rely on community-shared rule files such as AGENTS.md or .cursorrules. It introduces the package hallucination attack, in which malicious prompts are injected into benign rule files to make agents replace legitimate dependencies with attacker-controlled packages. The authors propose PackHallu, an evolutionary framework that iteratively rewrites injected prompts using trajectory-level feedback and LLM-guided mutations. Evaluations across multiple benchmarks, LLMs, and agent frameworks report high attack success rates and transferability across models and agent combinations.
In briefAdversarial Images That Take Over Web Agents, From Visual Grounding to Browser Actions
SummaryThis paper studies attacks on web agents built on vision-language models, which read webpages and perform browser actions. It introduces WebMirage, a framework that adds localized visual perturbations so the agent selects attacker-controlled content and executes the matching browser action across different page renderings. Tested on 2,250 tasks across 13 public websites and a sandbox benchmark, it reaches a 91.9% average attack success rate versus 17.4% for the strongest baseline, and remains effective against three agent-level defenses.
WhyExtends visual adversarial attacks end-to-end from grounding to browser execution via role-slot modeling and dataflow analysis. Achieves 91.9% average success on 2,250 tasks versus 17.4% for the stron
In briefBlack-box detection of swarm-style reconnaissance by individually benign-looking agents
SummaryThis paper defines Distributed Collective Reconnaissance (DCR), where autonomous agents spread probing across many identities so each request looks valid and low-rate while the group gathers broad system knowledge. It introduces SwarmReconGuard, a reproducible black-box benchmark in which defenders see only service-boundary telemetry. Tested detectors show Gaussian likelihood-ratio detection reaching 100% on known attacks but only 3% on unseen policies, revealing a major generalization gap.
Vahid Tavakkoli, Kabeh Mohsenzadegan, and Kyandoghere Kyamakya
In briefCertified corruption budgets: leaderboard rankings that stay valid even under adaptive vote rigging
SummaryPublic AI model leaderboards are read continuously, and attackers can see every published ranking, so vote rigging and selective disclosure of private variants can shift standings. The paper introduces a certified corruption budget published with each pairwise claim, guaranteeing with probability at least 1−α that the claim is correct or more than the budgeted number of records were corrupted. In replays on 1.8 million Chatbot Arena votes, standard confidence intervals certify false orderings after a few hundred rigged votes, while the proposed method stays valid.
WhyIntroduces anytime-valid corruption certificates against adaptive attackers, with near-optimal growth rates and substantive advances over prior guarantees.
In briefQuantum time-lock puzzles in the quantum random oracle model
SummaryTime-lock puzzles hide a message so that recovering it requires far more sequential computation than creating the puzzle, even with parallel computing. Such puzzles are known to be impossible in the classical random oracle model. This paper introduces quantum time-lock puzzles, where the puzzle is a quantum state, and gives a construction in the quantum random oracle model that needs one oracle round to generate and at most T rounds to solve. It resolves an open problem posed by Mahmoody, Moran, and Vadhan (2011).
In briefTesting how open AI language models handle unusual text formats for safety
SummaryThis paper introduces ASRD, a dataset of 2,100 prompts covering seven unusual text formats such as emojis, altered spellings, and encoded strings. Five open-weight language models produced 10,500 responses, which were sorted into harmful compliance, safe response, comprehension failure, or indeterminate using a four-outcome rubric. Emoji and invisible Unicode variations caused almost no comprehension failures, while encoded wrappers caused comprehension failure to rise sharply. The authors also describe behaviors seen in raw outputs, including hallucinated benignity, structural collapse, and language drift.
In briefPost-quantum migration delay cost: ranking classical and harvest-now-decrypt-later risks together
SummaryThe paper proposes a common unit, a cost of delay in currency per year, to compare classical risk with post-quantum migration risk, so organisations can order asset migrations. The quantum term measures the rate at which postponing migration commits irreversible harvest-now-decrypt-later loss, and a competing-risks factor avoids double counting. The method is illustrated on four public systems using parameters assumed from public documentation, with checks by simulation and quadrature; the case studies are illustrative and not validated against outcomes.
In briefImage-based backdoor attacks that persist in the model's KV cache after removal
SummaryThis paper studies whether an adversarial image can keep influencing a language model after it is removed from the context. The authors introduce Persistent Visual Memory Injection (P-VMI), which optimizes images to preserve attack behavior once they are masked from attention. On Qwen3-VL-8B-Instruct it reaches up to about 90% target success, and a cache-swap ablation localizes the persistence to the KV cache. The attacks also survive compaction that keeps the KV cache of a model-generated summary.
In briefTwinGuard-Lite: A Rule-Based Gateway Controlling Updates to Generative Patient Digital Twins
SummaryThis paper presents TwinGuard-Lite, a rule-based gateway that admits an update into a patient digital twin's persistent state only if it passes provenance, contradiction, and namespace checks. The authors test three attack families on a semi-synthetic stream built from the openly licensed eICU database demo. The full gateway reports 99.1% precision and 90.5% recall. The authors describe it as a mechanism-level proof of concept, not a clinical safeguard.
In briefSigma-Hunter: A Domain-Specific Language Model for Detecting Threats
SummaryThis paper introduces Sigma-Hunter, a language model adapted to help analysts write Sigma detection rules and hunt for threats. The authors built an instruction-tuning dataset from 3,635 validated open-source Sigma rules and fine-tuned 7B Mistral and Phi-4 models with LoRA. The fine-tuned Sigma-Hunter-Mistral scored higher overall than the strongest general-purpose baseline, and the authors note that syntactically valid rules can still have weak detection logic.
In briefRemoving Information Does Not Prove Tamper Resistance in Open-Weight Models
SummaryThe paper asks whether removing harmful information makes open-weight models resistant to fine-tuning attacks. The authors show that mutual information at release alone cannot universally certify slow recovery, because function-preserving reparameterizations change gradient-descent behavior while leaving information unchanged. They give an explicit construction where both information quantities are zero yet recovery takes a single gradient step. Controlled experiments show that recovery speed depends on training order and parameterization.
WhyProves mutual information alone cannot certify tamper resistance, with a zero-information construction recovering in one step; experiments are only controlled illustrations.
In briefHow Fragile Is On-Device Language Model Safety? Locating Key Parameters for Sparse Fault Analysis
SummaryThis paper studies whether the safety behavior of a small language model (LLaMA-2-7B-Chat) is concentrated in a sparse set of parameters. The authors use two localization methods and find that the MLP down_proj component is especially safety-sensitive. Modifying only 0.19% of its weights raises Basic ASR to 53% and GCG ASR to 56%, while tinyBenchmarks accuracy drops only slightly from 52.2% to 51.6%. The authors argue this motivates targeted fault analysis and selective integrity protection for on-device and agentic deployments.
Muhammad Zeeshan Karamat, Christiana Chamon Garcia
In briefASPIRE: A Red-Teaming Engine for Finding Safety Flaws in AI Agents
SummaryThis paper presents ASPIRE, an automated tool that searches for security weaknesses in AI agents, which can be tricked by malicious content they retrieve and tools they use. It builds an evolving graph of agent behaviors and uses two complementary components to find, verify, and generalize tests focused on real consequences. Results on several benchmarks report broader coverage across consequences, injection methods, environments, and behavior paths, while keeping a high attack success rate.
In briefMulti-aspect runtime checks for testing LLM-based autonomous agents in simulation
SummaryThe paper presents a runtime verification framework that splits a natural-language policy clause into spatial, temporal and semantic checks, then fuses their verdicts. In simulated experiments across two defence mission domains and one civil domain, the combined precautionary policy reduced attack success to zero with no observed false positives. Single aspects and pairs of aspects left a substantial share of attacks succeeding.
Nikolaos Kekatos, Dimitrios Nikou, Anastasios Temperekidis et al.
In briefMission-aware attestation envelopes for time-critical autonomous action: a hardware-in-the-loop vehicle-to-infrastructure study
SummaryThe paper proposes a runtime assurance contract that combines integrity attestation, evidence freshness, and a decision deadline to decide whether an autonomous system may take a privileged physical action. It is evaluated on a hardware-in-the-loop vehicle-to-infrastructure platform, where a driving simulator supplies physical state and the authorisation deadline, and TPM-backed roadside hardware supplies attestation evidence. The authors conclude that the attestation interval and freshness bound cannot be chosen from security requirements alone.
Dimitrios Nikou, Nikolaos Kekatos, Sophia Petridou et al.
In briefBARE-AI: Hardware Monitors That Detect and Repair Bit-Flip Attacks on AI Models
SummaryThis paper proposes BARE-AI, a runtime framework that detects, localizes, and mitigates bit-flip attacks on deep neural networks during inference. It adds lightweight hardware monitors to the accelerator that collect per-layer activation statistics, which a compact detector trained offline analyzes. A z-score based repair resets anomalous weights toward clean layer statistics. The authors report up to 98% detection accuracy on vision models and 74% to 95% on language models, with low energy, area, and latency overhead at 28nm.
Habibur Rahaman, Swastik Bhattacharya, Sanjay Das et al.
In briefProvable Subexponential Attacks on NIST Third-Round Lattice Cryptosystems
SummaryThe paper gives provable classical subexponential algorithms for recovering secrets in parameter families tied to NIST third-round lattice candidates, including Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, and Dilithium/ML-DSA. It builds on Gaussian sampling and low-error decision-LWE techniques, and uses an affine slice search for NTRU-type quotient relations. The authors state that, despite the subexponential complexity, the results do not reduce the concrete security of the currently specified parameter sets.
WhyProposes provable subexponential attacks on several NIST lattice schemes, a notable advance, but offers no experimental validation and relies on theoretical bounds.
In briefSecurity risks of faster LLM inference via speculative decoding, and a safer variant
SummarySpeculative decoding speeds up large language models by having a smaller draft model propose tokens that the target model then accepts or rejects. This paper is the first systematic study of its security implications, finding that efficiency gains come with a disproportionately large rise in jailbreak and prompt injection success rates. The authors propose SecureSD, which applies stricter verification to early draft-model tokens, and report that it improves security while preserving efficiency and utility.
WhyFirst systematic security study of speculative decoding, with a theory-guided SecureSD method backed by large-scale measurements and broad experiments.
In briefSemantic Behavioral Watermarking for LLM Agents: Robust, Forgery-Resistant Provenance
SummaryThis paper proposes Semantic Behavioral Watermarking (SBW), which embeds an owner identifier in an LLM agent's high-level action choices without altering output tokens. It ties the watermark to semantic action clusters rather than exact action symbols and uses keyed collision-resistant binning to resist forgery. Experiments across five agent models and two benchmarks show higher detection under rewriting than prior methods, while chained replay of the victim's steps remains an acknowledged open limitation.
WhyExtends agent watermarks to semantic action clusters with provably unpredictable keyed binning against forgery; evaluated across five models and two benchmarks, but chained replay remains unresolved.
In briefSkrrtPIR: Stateless Batch Private Retrieval Using One Key
SummaryThe paper studies doubly-stateless Batch PIR, where the server keeps no per-client state and the client keeps no database-dependent hint. The authors present a scheme that substantially reduces communication compared with a natural baseline that sends fresh evaluation keys with every batch query. The key ingredient is a single-key RLWE unpacking procedure that walks a cyclic Galois subgroup and needs only one Galois key instead of logarithmically many.
In briefRe-grading third-party cloud security findings using real environment context
SummaryThe paper argues that third-party cloud security findings carry static severity scores that ignore the specific environment where a resource lives. The authors propose contextualization, in which a deep research agent uses resource state, graph neighborhood, and other products' signals to re-derive each finding's severity with an evidence trace. In a field study of 9,967 HIGH findings across eight production environments, about three in four findings were re-graded, mostly downward. About half of the decisive evidence lay beyond the flagged resource.
In briefTwinViT-DeepJSCC: Attack-Resistant Semantic Image Transmission
SummaryThis paper proposes TwinViT-DeepJSCC, a semantic image transceiver that defends against adversarial perturbations before encoding or over wireless channels, under a fixed channel-use budget. It uses two Vision Transformer branches with sensitivity-aware masking on the transmitter side, and confidence-aware fusion plus DDIM-based purification on the receiver side. Experiments on CIFAR-100 show PSNR gains of about 9.5 dB under 20-step PGD and improved Top-1 accuracy of up to about 38 percentage points over the undefended baseline.
Maedeh Fallahreyhani, Paeiz Azmi, Nader Mokari et al.
In briefRAG-PIBench: A Leakage-Aware Benchmark for Detecting Prompt Injection in RAG Systems
SummaryThis paper introduces RAG-PIBench, a benchmark of 4,876 contextual examples for detecting prompt-injection attacks hidden in retrieved content in RAG systems. Its splits are built to prevent data leakage, and several detectors are compared, including keyword, semantic, TF-IDF, and transformer-based methods. DistilBERT performs best on the protected test set (F1 = 0.896, PR-AUC = 0.968), while TF-IDF SVM and logistic regression remain competitive.
In briefA benchmarking framework for post-quantum cryptography on dual-core chips that considers security
SummaryThis paper examines whether memory-heavy post-quantum cryptography can run on smart grid edge devices without breaking the real-time timing needed for substation protection. It proposes a hardware-in-the-loop benchmark on an ESP32-S3 dual-core chip running FreeRTOS, pinning cryptographic work to one core and auditing heap allocation. It also presents an analytical model of latency caused by external PSRAM access, to help utility engineers plan migration.
Gertrude Nabasirye, Hristina Mihajloska Trpcheska, E. Fatih Yetkin
