In briefReverse-Bleichenbacher: Bleichenbacher-Style Attacks Made Practical Again
SummaryThis paper presents Reverse-Bleichenbacher, a variant of the Bleichenbacher padding oracle attack on RSA PKCS#1 v1.5 that recovers the least significant bytes first and stops once the target secret is found. Against a standards-conforming 2048-bit oracle, the median query count drops from 11,428 to 1,801 with an 84.8% success rate, and 68.3% of runs finish within 30 seconds under realistic single-server conditions. The authors also identify 640 vulnerable domains in the Tranco Top 1 Million and demonstrate a man-in-the-middle attack that injects malicious software updates leading to remote code execution.
WhyRecovers least significant bytes first, cutting oracle queries sharply, and demonstrates end-to-end attacks on real domains and update channels.
Youheng Lü, Lorenz Hetterich, Riccardo Zanotto et al.
In briefProtecting AI models on edge CPUs with WebAssembly inside a TEE
SummaryThe paper addresses how to protect AI model intellectual property on edge devices from attackers with root access, using Arm TrustZone's OP-TEE trusted execution environment. It runs unaltered AI models compiled to WebAssembly on the WebAssembly Micro Runtime inside OP-TEE, and provides a distributor that encrypts the binary with a key stored in a device fuse. The evaluation reports a 22% overhead compared with a manually ported application and a 6% additional inference latency.
Friedrich Vandenberghe, Lachlan J. Gunn, Bruno Volckaert et al.
In briefHPQ-AKE: A Provably Secure Sign-Less Hybrid Key Exchange for Bandwidth-Constrained IoT and Edge Networks
SummaryThis paper proposes HPQ-AKE, a hybrid authenticated key exchange that replaces handshake signatures with dual KEMs to reduce post-quantum authentication overhead in IoT and edge networks. It combines ML-KEM-768 for session secrecy with RSA-OAEP for implicit mutual authentication, and analyzes security in an extended Bellare-Rogaway model. On an x86 testbed, the authors report a 56.4% reduction in modeled handshake transmission versus a Hybrid TLS 1.3 full handshake, and a 31.4% lower median latency on a simulated satellite-like link. Performance on ARM gateways and unaccelerated microcontrollers remains unvalidated.
In briefMoving Target Defense for SDN-Enabled EV Charging Networks
SummaryThis paper proposes CS-SHIELD, a moving target defense mechanism for EV charging networks that use software-defined networking. It detects malicious flow table rules through cross-layer identity verification and reassigns virtual IP addresses to all active chargers in response. Experiments on an emulated testbed with a real charging protocol show that the site stays fully available under attack, reacts quickly, and adds only negligible delay under normal conditions.
Roland Plaka, Mikael Asplund, and Simin Nadjm-Tehran
In briefOrganizational Context for the Enterprise Security Brain: Supplying Business Knowledge Held by People to Security Agents
SummaryThis paper argues that security agents judging an asset need organizational knowledge such as its owner, business function, governing policy, and accepted risks, much of which lives in policies, audit reports, diagrams, and tickets rather than machine state. The authors introduce an organizational context layer with a taxonomy and a context model. They evaluate extraction and agent reasoning on a production environment spanning AWS, Okta, Google Workspace, and GitHub.
In briefFrom Public Posts to AI-Search Citations: Measuring How Fragile AI Search Is
SummaryThis paper examines how AI-search platforms select and cite web sources before generating answers. Analyzing 17,211 citations across 10 platforms, the authors find that citations concentrate on platform-specific domains, many of which are easy to publish on. In controlled experiments, ordinary posts on preferred platforms were cited for a fabricated concept by 8 of 10 platforms within seven days, and a commercial service's posts were cited within one hour.
WhyIdentifies a low-barrier publication path into AI-search citations, validated by cross-platform mapping and marker experiments over 17,211 citations across 10 platforms.
In briefA security model mapping risks in retrieval-augmented AI systems
SummaryThis paper presents a security meta-model that maps causal links between RAG system components, attacks, weaknesses, risks, and impacts on confidentiality, integrity, and availability. The authors built a catalog from a structured analysis of 43 publications from 2023 to 2026, which can be filtered by deployment configuration to produce a risk profile. The analysis found more attack-focused than defense-focused research, threats concentrated at ingestion, and gaps in output integrity coverage.
In briefFast polynomial arithmetic in group exponents, without roots of unity
SummaryThis paper presents algorithms for polynomial arithmetic on group elements' exponents, used in cryptographic protocols where discrete logarithms are assumed hard. Unlike NTT-based methods, the algorithms keep quasi-linear complexity without requiring roots of unity in the group order's field. The authors adapt a Schönhage-Strassen-inspired multiplication method, which runs about twice as slow as NTT. The approach is said to apply to batched KZG commitment proofs and the Bayer-Groth verifiable mixnet used in e-voting.
In briefSAEID: Identity-Based Authenticated Aggregate Encryption for Secure Multi-Vendor FPGA Cloud Deployment
SummaryThis paper presents SAEID, a framework for securely deploying FPGA bitstreams across multi-vendor cloud infrastructures. It combines aggregate authorization, certificate-free identity-based device authentication, and identity-bound bitstream verification within a pairing-based scheme, using AES-256-GCM for bitstream protection. The framework extends AgEID to support multiple FPGA vendors, capability-aware authorization, and dynamic device membership. Experiments report device authentication in about 4.35 ms and a complete software decryption path of 191.126 ms on a ZC702 platform.
Mukta Debnath (University of Calcutta, India), Krishnendu Guha (University College Cork et al.
In briefLocal Sensitivity in Exponential Selection: Failure Modes and Valid Calibrations
SummaryThe paper studies when dataset-dependent local sensitivity can safely replace global sensitivity in differentially private selection, where one candidate is chosen to maximize a data-dependent score. It proposes three approaches: a private high-probability bound on local sensitivity, a Propose-Test-Release variant that privately searches a public grid for a temperature scale, and several designs based on smooth sensitivity. For each proposed mechanism, a high-probability regret bound is derived under its stated conditions.
In briefSemField: A Simple, Linear, Continuous, and Robust Semantic Watermark for LLM Text
SummaryThis paper introduces SemField, a training-free semantic watermark that embeds a continuous linear signal into sentence embeddings to identify LLM-generated text. A shared secret key defines a Gaussian direction, and candidate sentences are chosen to align the document's cumulative embedding with it. A polarity-locked variant, SemField-PL, is also proposed. Both variants achieve a mean True Positive Rate of 88.2% to 90.4% at 1% False Positive Rate across clean detection and four paraphrasing attacks, with perplexity and naturalness comparable to human text.
In briefAnytime-valid detection of data theft from LLM weights
SummaryThis paper addresses how a compromised LLM inference server could leak model weights by hiding payload bits in plausible token choices. It proposes a prompt-level e-process that calibrates whole-response mismatches on trusted benign traffic and accumulates evidence sequentially across responses. Under a calibration-transfer assumption, it controls the probability of false alarms over an unbounded monitoring horizon. The method is evaluated on four models against seed-blind and seed-aware attacks, analyzing the trade-off between channel capacity and detectability.
In briefHost attack graph model for how botnets spread across networks
SummaryThe paper introduces a Host Attack Graph model and proposes two botnet propagation strategies. It studies how these strategies perform over time across different network topologies, target selection methods, and attack strategies. Simulations indicate that network topology and target selection matter for propagation alongside strategy and botnet size.
In briefLTBD: Learnable Trust-Boundary Delimiters Against Prompt Injection
SummaryThis paper introduces LTBD, a lightweight defense against prompt injection, where malicious instructions in external data can override user intent in large language models. It inserts a small number of learnable delimiters that separate trusted user instructions from untrusted external data, leaving model parameters unchanged. The authors report 0.00% attack success rate on AlpacaFarm and 0.11-0.19% on TaskTracker, and state that the method remains effective under adaptive attacks.
In briefWhere do LLM agent tokens go in vulnerability hunting, and how to cut them
SummaryThe paper analyzes 200 CyberGym traces to find why LLM agents spend many tokens on vulnerability discovery without producing a working proof of concept. It finds that code localization and understanding, plus vulnerability reasoning and trigger design, consume 60.4% of tokens and are the main bottlenecks in failed runs. The authors propose AVRI, an interface built around a persistent Bidirectional Evidence Trace, which cuts total cost by 18.0% for Codex and 23.7% for OpenCode on 20 tasks while preserving success rates.
In briefNear-sublinear RAM fully homomorphic encryption from plain LWE
SummaryThis paper constructs a RAM fully homomorphic encryption scheme based on the plain LWE assumption, evaluating each step of a RAM program in o(N/log N) time. This is barely sublinear, a slight saving over the linear cost of standard FHE. The authors remove the common reference string from the only prior plain-LWE doubly-efficient PIR scheme, which allows it to be extended to RAM-FHE.
WhyFirst RAM-FHE from plain LWE with barely sublinear cost, removing DEPIR's CRS; impact mainly theoretical cryptography.
In briefSoK: Can LLMs Reliably Recover Source Code? A Taxonomy and Evaluation
SummaryThis paper is the first systematization of knowledge on using large language models to recover source code from binaries. It proposes a design-centric taxonomy of existing methods and evaluates them across six dimensions using seven metrics. The evaluation uses 45,000 test samples spanning multiple standard and embedded architectures, and tests recovery within and across programming languages.
Varun Kohli, Lee Bing Cheng, Nur Hazim Ghazali et al.
In briefProving Hidden Routes: Scalable Topology Assurance for QKD Networks
SummaryQuantum Key Distribution (QKD) networks rely on trusted repeaters, so the security of the chosen communication path matters for end-to-end assurance, yet operators may not want to reveal their internal topology. The paper proposes a topology-certification mechanism that lets a provider prove in zero knowledge that policy-compliant routes between two endpoints exist, without disclosing the routes. It certifies nodes and edges independently with multi-message signatures, and provides a formal security model with conditional proofs for a generic construction. For a BBS-based construction, presentation-size estimates stay below 300 KiB at 50, and measured generation and verification times stay below 400 ms at the stated parameters.
Alessandro Colombo, Margherita Cozzolino, Stephan Krenn et al.
In briefEIFL: Protecting Global Model Privacy and Integrity in Federated Learning Against an Untrusted Server
SummaryIn federated learning, a server aggregates clients' models and returns a global model, which an untrusted server could tamper with. Existing integrity verification methods rely on auxiliary information that clients must keep secret from the server, and if it leaks, verification can be circumvented, while privacy-preserving alternatives incur high overhead. This paper proposes EIFL, which combines two-stage aggregation with symmetric encryption to protect output privacy, and uses a vector inner product verification method with random vector generation. The authors report that EIFL outperforms state-of-the-art schemes in computation and communication overhead.
In briefAverage-case hardness of lattice problems in fixed-rank special genera
SummaryThe paper studies lattice-based schemes whose security proofs rely on the distinguishing variant of the Lattice Isomorphism Problem. Under GRH, it gives a worst-case to average-case reduction, within any special genus of fixed-rank Hermitian lattices, for problems including SVP, CVP, BDD and DGS. The reduction is a random walk on a Kneser neighbour graph. It yields a direct, tight security proof for a minimal LIP-based KEM.
WhyGives a worst-case to average-case reduction within special genera via Kneser neighbour walks and Hecke spectral bounds, yielding a tighter security proof for an LIP-based KEM.
In briefA zero-knowledge signature method for efficient, quantum-resistant message authentication in connected cars
SummaryThis paper presents ZKS-PQC, which replaces full post-quantum public keys and signatures with a compact zero-knowledge proof to reduce V2X message authentication overhead. It remains compatible with existing certificate-based trust systems and supports backward compatibility with ECDSA and incremental migration. Experiments on Linux and a commercial On-Board Unit show message size reductions exceeding 95% for all algorithms, with processing overhead in the millisecond range for many algorithms.
Takahito Yoshizawa, Aysajan Abidin, Edoardo Pena-Gonzalez et al.
In briefMARC: Multi-bit watermarking for autoregressive audio generation that resists codec attacks
SummaryThis paper proposes MARC, a multi-bit generative watermarking method for autoregressive audio generation. It combines intrinsic token representations with confusion patterns from retokenization and multiple codecs to form a codec-aware token-cluster space, where payload-driven cluster scheduling embeds the watermark. Experiments on speech, dialogue, and music report an average of 97.3% bit extraction accuracy on unmodified watermarked audio, extraction under diverse codec attacks, and robustness to overwriting attacks.
In briefA survey of research on operating system security, covering virtualization, OS verification, and access control.
SummaryThis paper is a survey of operating system security research. It reviews work on virtualization, operating system verification, and access control technologies in relation to the design requirements of the reference monitor. The authors also outline the prospects and challenges for each of these technologies.
Masaki Hashimoto, Ruo Ando, Toshiyuki Maeda et al.
In briefGROB: A Multi-Agent System for Probing Suspected Autonomous-Agent Activity Using Public Internet Traces
SummaryThe paper presents GROB, a multi-agent system that investigates suspected autonomous-agent activity using public Internet traces when privileged telemetry is unavailable. It collects public traces in a controlled, read-only way and keeps selected observations for later analysis. In a frozen September 2026 corpus, several traces became more informative as later public evidence appeared, most notably Census-labelled identifiers from 9 September that were later tied to specific Census requests from 16 to 17 June. The authors note that public traces alone do not establish organizational attribution, and that continuity of execution identity remains an open research question.</summary>
In briefKIFA: Kernel-Based Integral Fault Analysis on GIFT-Family Ciphers
SummaryThis paper presents KIFA, an integral fault attack framework that uses a kernel-based miner instead of MILP to find balanced properties. For DEFAULT, it reports attacks at fault penetration 9 (random nibble fault) and 10 (random byte fault), beyond the prior best of 8. For GIFT-128, it gives the first integral fault attacks at depths 7 and 8, versus the prior best of 5. Results for GIFT-64 and BAKSHEESH also extend earlier attacks.
In briefAdversarial cues in models used as answer judges: how request presentation matters
SummaryThe paper studies whether a model that grades answers can be fooled by a small edit to a candidate answer. On 200 DROP and GSM8K source clusters, adding one colon raised the false acceptance rate of one judge from 1.0% to 26.0% under one grading setup, and from 3.0% to 26.5% under another. The effect depended on how the judging request was presented, and most accepted errors had larger numerical mistakes. The authors did not measure the internal cause of this vulnerability.
In briefMORDOR: Reducing DRAM Read-Disturbance Prevention Overheads with Elastic Refresh Scheduling
SummaryModern DRAM can suffer RowHammer-style bitflips when a row is repeatedly accessed, so systems preventively refresh nearby victim rows. These refreshes are urgent and are prioritized over regular memory requests, causing delays, performance loss, and energy overhead. The authors propose MORDOR, a memory-controller scheduling policy that delays preventive refreshes so latency-critical requests run first while data integrity is preserved. Integrated with six existing mitigation techniques, MORDOR is reported to improve system performance and energy efficiency at low area cost.
WhyProposes delaying preventive refreshes off the critical path, integrated into six existing mitigations and evaluated, with broad performance and energy impact on RowHammer defenses.
Maria Makeenkova, Ataberk Olgun, F. Nisa Bostanc{\i} et al.
In briefMercury: fuzzy private set intersection with logarithmic cost in the threshold
SummaryThis paper presents Mercury, a fuzzy private set intersection (FPSI) protocol that finds approximate matches under a public distance threshold δ. It combines homomorphic encryption with secure two-party computation using a mask-then-compare technique to identify neighboring point pairs efficiently. Its computation and communication costs are logarithmic in δ. In LAN experiments on balanced two-dimensional inputs, the sender-private variant achieves 9.0 to 63.9 times runtime speedups and 8.7 to 26.1 times communication reduction compared with Dang et al. (CCS'25).
In briefProxyEraseAgent: A Method for Removing Hidden Image Watermarks Without Decoder Access
SummaryThis paper studies removing invisible watermarks from a single image when the hidden watermark decoder is inaccessible. The authors propose ProxyEraseAgent, which ranks publicly available watermark decoders by their calibrated response to the image and uses the top ones as proxy boundary estimators. These responses guide a progressive search over removal operations such as geometric distortion, JPEG compression, reconstruction, and gradient perturbation, under perceptual-quality constraints. Across 11 watermarking systems, the method reports a 94.8% attack success rate.
In briefSoft Voting for Privacy-Policy-Aware Private Data Synthesis
SummaryThis paper studies private data synthesis under Blowfish privacy, which protects only the attribute substitutions specified as edges of a policy graph. The authors show that the hard voting used by nearest-neighbor synthesizers such as Private Evolution and Tab-PE has full worst-case sensitivity whenever a protected substitution crosses a decision boundary, so sparser policies yield no noise reduction. They propose BF-Soft, a temperature-smoothed soft vote with a closed-form sensitivity bound depending on the policy's reach and the temperature. Under narrow numeric policies, BF-Soft reduces error relative to hard voting at strong privacy budgets, while the advantage reverses at weaker budgets.
In briefProvable subexponential attacks on NIST third-round lattice cryptography parameter families
SummaryThe paper presents provable classical subexponential algorithms that recover secret components in parameter families tied to NIST third-round lattice candidates. For several families, the short secret is recovered in expected time and space 2^((1/2+o(1))n/ln ln n). For NTRU-type quotient relations, the authors introduce an affine slice search. The authors state that the results cover problem families for all seven candidates, but they do not reduce the concrete security of the currently specified parameter sets.
WhyGives provable subexponential secret-recovery algorithms for NIST third-round lattice families, a notable advance, though evidence is largely theoretical without experiments.
In briefBRACE: Differentially Private Retrieval for Dense Associative Memory
SummaryThis paper develops a differential privacy framework for log-sum-ReLU (LSR) dense associative memory, whose retrieval dynamics have finite support. It proposes BRACE, a private retrieval algorithm that adaptively corrects boundary-sensitive perturbations to limit their cumulative effect along the retrieval trajectory. The authors prove minimax optimal dimension-independent retrieval error rates and establish central limit theorems for uncertainty quantification. Numerical experiments compare BRACE with baseline differential privacy approaches on retrieval accuracy.
In briefSeparating Verifiable Delay Functions from One-Way Functions
SummaryThis paper asks whether verifiable delay functions (VDFs), which require substantial sequential time to evaluate but have unique, publicly verifiable outputs, imply one-way functions (OWFs). The authors show that VDFs do not imply OWFs through fully black-box, relativizing reductions. Combined with prior results that VDFs cannot be built in the random oracle model, there is no black-box implication between VDFs and OWFs in either direction. The proof introduces a new oracle separation technique that combines a random oracle with a complexity-theoretic oracle inspired by Kolmogorov complexity.
WhyShows VDFs cannot imply one-way functions via black-box reductions, using a new oracle separation combining random oracles with Kolmogorov-inspired oracles.
In briefSkill Constellations: tracing how AI agent skills are copied across GitHub
SummaryThe paper studies SKILL.md files used by AI coding agents, which developers share by copying between repositories, forming a supply chain without a registry or versioning. Using the git history of every SKILL.md in GitSkills, the authors build a dated copy network covering 2,193,119 skill adoptions. A few repositories source almost all copies, GitHub stars do not reveal them, and fixes at the source rarely reach copies. Auditing the top 100 repositories ranked by their model prevents 14.9% of later high-risk adoptions, versus 0.5% for the 100 most-starred.
WhyFirst dated copy network of agent skills across about 2.19M adoptions; history-based audit ranking clearly beats star counts, with fairly solid evidence.
In briefStatistical Separability in TP-CRIV for Probabilistic AI Models
SummaryThis paper studies whether third-party challenge-response identity verification can distinguish a matching model from a non-matching one when the model's outputs are probabilistic. It links challenge-wise behavior of provers to verification-level separability and describes how the number of independent challenges and repeated responses affects detection performance. Experiments on LLMs with open-ended challenges show clear separation, close agreement between theoretical and empirical AUCs, and consistent estimates of the minimum verification budget.
Teruki Sano, Minoru Kuribayashi, Masao Sakai et al.
In briefFalse Claims, Credible Images: A Red-Teaming Benchmark for Commercial Image Generators
SummaryThis paper shows that commercial image generators can readily produce realistic visual misinformation, such as fake news or textbook-style pages, even though they recognize the claims as false when asked. The authors introduce EpiReal-Bench, a benchmark of 10k false-claim prompts and generated images, and EpiReal-Attack, a black-box optimization method for bypassing safeguards. Experiments on four commercial models found over 70% of false-claim prompts produced faithful misinformation images, rising to 95% under the attack.
In briefStudy of prompt injection attacks that leak data and spread between single and multi-agent AI systems
SummaryThis paper examines how prompt injection attacks can exploit direct user inputs and communication between agents to leak sensitive information and trigger cross-agent infections. The tests mainly reveal key vulnerabilities in single-agent systems, and the attacks are also extended to multi-agent frameworks to study how weaknesses propagate across agents. The authors emphasize the need for more robust defenses as AI agents are increasingly embedded in real-world workflows.
Cathleen Qiao, Layah Vigneaud, Chloe Brandon et al.
In briefSpeeding Up HQC for Post-Quantum TLS 1.3 on x86 IoT Gateways
SummaryThis paper optimizes HQC, a code-based post-quantum key exchange scheme, for x86 processors using AVX2, AVX-512, and GFNI instructions, and integrates it into TLS 1.3. On an Intel Core i5-1135G7, the AVX-512 implementation reduces key generation, encapsulation, and decapsulation costs compared with prior work by 24.9–29.5%, 10.4–11.1%, and 20.6–26.1%. On a constrained 1 Mbit/s link with 50 ms RTT, the HQC-5 handshake takes 243 ms versus 87 ms for ML-KEM-1024, and the authors conclude that HQC's key and ciphertext sizes, not implementation speed, drive the remaining cost.
In briefLanguage Modeling Is Monotone Compression: A Theoretical Equivalence Between LLMs and Order-Preserving Compressors
SummaryThis paper theoretically studies the link between large language models and data compression. The authors show that LLMs, modeled as next-token predictors, are equivalent to monotone (order-preserving) compression algorithms, with the two constructible from each other up to an additive error gap of 2. They further show that monotonicity is needed for this equivalence if and only if cryptographic (infinitely-often) one-way functions exist, and derive a related cryptographic result linking next-bit pseudoentropy to monotone incompressibility.
WhyProves LLMs are equivalent to monotone compressors, with a cryptographic result on pseudoentropy; novel and rigorous theory, but no experiments and impact is mostly within theory.
In briefLanguage modeling as monotone compression: a theoretical link between LLMs and order-preserving compressors
SummaryThis paper theoretically examines the connection between large language models, modeled as next-token predictors, and data compression. It shows that LLMs are equivalent to monotone (order-preserving) compression algorithms, with constructions possible in both directions up to an additive error gap of 2. The authors also show that monotonicity is necessary for this equivalence if and only if cryptographic (infinitely-often) one-way functions exist.
WhyProves LLMs equivalent to monotone compressors and links this to cryptographic one-way functions, a new theoretical connection with limited direct impact.
In briefNOMOS: Turning Written Rules into Verified Gates for LLM Agent Tool Calls
SummaryThis paper presents NOMOS, a four-pass compiler that converts natural-language policies into deterministic gates that check tool calls made by LLM agents. On τ²-bench, the gate sharply reduces violations of encoded clauses among state-changing calls, and on AgentDojo's banking suite it reaches a zero attack success rate. Decisions run in microseconds without an LLM call, and compilation can run on-premise with an open-weight model.
In briefTime-space tradeoffs in probabilistic proofs: whether the proofs themselves face a time-versus-memory trade-off
SummaryMany recent probabilistic proof constructions are fast but need far more space than the computation they prove. This paper establishes time-space tradeoffs for probabilistically checkable proofs (PCPs) and their multi-round extension, interactive oracle proofs (IOPs), for machines with sequential input access. The authors also give an IOP for R1CS that avoids the tradeoff but requires random access to the witness. The results assume collision-resistant hash functions exist.
WhyEstablishes time-space tradeoffs for PCPs and IOPs, a new result that handles the missing distance notion via collision-resistant hashes and information-flow arguments.
In briefML-DSA Hint Weight Depends on the Signing Key: An Empirical Study of FIPS 204
SummaryThis paper studies the Hamming weight of the public hint vector in ML-DSA (FIPS 204) signatures and finds it depends on the signing key, mainly through the Euclidean norm of the low-order part t0 omitted from the public key. Experiments on the reference C implementation across all three parameter sets show the key-dependence is statistically detectable but weak. The authors conclude it does not endanger the signing key, but it can serve as a weak statistical fingerprint.
In briefA random-walk coin toss that stays fair even when all but one party is corrupted
SummaryThis paper studies fair multi-party coin tossing when up to n-1 parties may be corrupted, using cooperative-strategy-proof (CSP) fairness, which means corrupted parties cannot gain expected joint utility by deviating. The authors propose a construction based on a public random walk whose steps are jointly randomized via commit-and-reveal and whose transition probabilities are adjusted when a party aborts. They also identify utility matrix conditions where CSP-fair coin tossing is achievable or impossible, with a full characterization for three parties.
WhyA public random walk construction achieves CSP-fairness against n-1 corruptions for any full-row-rank utility matrix, with a complete three-party characterization.
In briefSpeedbumps: attacks that slow speculative decoding in LLMs by making draft and target models disagree
SummarySpeculative decoding speeds up large language model inference by having a drafter propose tokens that a target model verifies in one pass. This paper introduces Speculative Rejection Attacks, which append an adversarial suffix to attacker-controlled content so that drafts are rejected more often. The attacks can make inference slower than autoregressive decoding and raise costs for the victim. The authors also report that the suffixes can transfer across drafters or across target models sharing a drafter.
In briefPower side-channel attack that infers training-data membership in embedded ML models without model outputs
SummaryThis paper presents PSCMIA, a membership inference attack that uses power traces from embedded machine learning devices to determine whether a sample was used in training. It does not require prediction probabilities or even predicted labels. The attack was evaluated on MNIST, FMNIST, CIFAR10 and CINIC10 with fully connected and CNN models on STM32F3 and XMEGA platforms, reaching ROC-AUC up to 0.907 on FC models. PSCMIA outperformed label-only attacks in 11 of 16 configurations.
In briefGeometry of collusion leakage in inner-product functional encryption
SummaryThe paper studies information leakage when multiple parties collude in inner-product functional encryption (IPFE), where each party holds keys for a span of vectors. It shows that a colluding coalition determines the plaintext modulo the orthogonal complement of the sum of their key spans. Under bounds on the dimension of each authorization space and pairwise intersections, it gives an exact characterization of the minimum leakage and a construction achieving it.
WhyCharacterizes collusion leakage via orthogonal complements of subspace sums, giving an exact dimension tradeoff linked to Reed–Solomon secret sharing; theoretically novel, with impact mostly within th
In briefWhen Flaws Cascade: A Study of Vulnerabilities and Exploit Chains in JavaScript Engines
SummaryThis paper presents the first comprehensive empirical study of vulnerabilities in JavaScript engines. The authors built a dataset of 241 vulnerabilities across four mainstream engines from 2017 to 2024 and classified their symptoms and root causes. They also examined exploitability, extracting trigger chains that show how logical errors propagate into memory safety violations, and analyzed mitigation strategies and implications for developers and researchers.
In briefPractical, efficient FHE-based MPC that drops zero-knowledge proofs of knowledge
SummaryThis paper studies multi-party computation built on fully homomorphic encryption, secure against static malicious corruption. It extends an idea from the full version of Smart's FHE-based MPC protocol to completely remove the need for zero-knowledge proofs of knowledge. The new protocol uses an FHE scheme with an encrypted PRF functionality, and the authors formalize the security of such encrypted PRFs. They also prove that the construction by Deo et al. is secure in this model.
Kelong Cong, Nigel P. Smart, Titouan Tanguy et al.
In briefCPU-Auth: a paper on authenticating devices by fingerprinting CPU behavior via DVFS side channels
SummaryThis paper proposes CPU-Auth, an authentication mechanism that relies on physical variations among the CPUs of computing devices. By measuring the behavior of the Dynamic Voltage and Frequency Scaling (DVFS) governor remotely from within a browser, the authors build a hardware-based device fingerprint. Performance is evaluated on over 50,000 data traces using distance-based and deep learning methods.
In briefAdaptive diffusion-based purification guided by detector scores for robust audio deepfake detection
SummaryAudio deepfake detectors are vulnerable to adversarial perturbations that hide the acoustic cues they rely on. The paper proposes DGAP, a diffusion-based defense that adjusts purification strength per input, using how much light purification shifts the detector score as a reference-free signal. Inputs with small shifts pass unchanged, while flagged inputs receive stronger purification. Across three detectors and three attack settings, DGAP outperforms nine existing defenses and barely affects benign inputs.
SummaryThis paper presents an attack on a lattice-based blind signature scheme proposed at Crypto 2020. The authors found a bug in the scheme's blindness security proof that had gone unnoticed for several years. Under an honest-key, honest-but-curious signer setting, they exploit correlations between tree leaves to break the scheme's blindness, and they also discuss how the scheme could be repaired.
In briefBRANCH: A Method for Bypassing Multi-Scanner AI Guardrails
SummaryThis paper proposes BRANCH, a method for bypassing guardrail systems made of several scanners that detect malicious prompts in large language models. It uses a branching tree search that applies adversarial perturbations to individual scanners and selects them based on overall improvement across all scanners. The authors report a 100% attack success rate across 6 guardrail systems in 120 scenarios, and say the bypasses transfer to 29 unseen guardrails, including 8 commercial black-box ones.
WhyProposes branching tree search bypassing multi-scanner guardrails, reaching 100% success across 120 scenarios and transferring to 29 unseen guardrails.
In briefDITTO: A context-aware scanner that checks pickle-based AI models for security risks
SummaryThe paper notes that pre-trained models are often shared in the unsafe Pickle format, and that 9.3% of over 10,000 popular Hugging Face repositories rely on it, exposing supply chains to deserialization attacks. The authors present DITTO, the first stack-based, context-aware scanner for Pickle-based models, and PickleBench, a benchmark of 959 benign and 92 malicious real-world models. Reported results include 100% scanning coverage, a 0% false-negative rate, a 0.7% false-positive rate, and an F1 score of 0.966, outperforming existing scanners.
WhyA stack-based, context-aware Pickle scanner improving coverage and false alerts over existing tools; evaluated on a 1,051-model benchmark with solid evidence and practical supply-chain security impact
In briefApplying Security by Design at Execution: Effects of Governed Security Requirements on AI-Generated Code
SummaryThe paper tests whether giving a code generator governed security requirements from the SbD-ToE knowledge base, delivered via an MCP server, makes AI-generated code more secure. On DualGauge (59 Python tasks) and BaxBench (28 backend scenarios), the share of tasks passing all security tests and the share of functionally correct solutions with no successful exploit both rose. The pre-specified joint secure-and-functional metric did not improve significantly. The authors argue current benchmarks only detect specific weaknesses, so they propose measuring conformance with the applicable requirements.
In briefBehavior-Based Weighting to Defend UAV Federated GPS Spoofing Detection Against Backdoor Attacks
SummaryThe paper studies federated learning for detecting GPS spoofing across a UAV fleet. It shows that compromised clients can inflate their self-reported validation accuracy to gain extra weight and raise backdoor attack success. The authors propose receiver-domain behavioral probing, where the coordinator tests each model on counterfactual spoofed samples and weights clients by observed behavior. Under independent and identically distributed clients, the attack's effect falls to near the honest baseline.</summary>
Will Jedrzejczak, Cole Walther, Dilpreet Gill et al.
In briefNullify: training-free null-space activation steering to make LLMs forget specific information
SummaryThis paper proposes Nullify, a training-free method for removing specific sensitive knowledge from large language models without changing their weights. At inference time, it uses steering vectors to move privacy-related activations away from their memorized answers, while a null-space constraint keeps activations for retained queries essentially unchanged. The authors report that on the TOFU and MUSE benchmarks, Nullify matches or exceeds established baselines in forget quality and nearly preserves model utility.
In briefSLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing
SummaryThis paper addresses how malicious fine-tuning can weaken the refusal behavior of aligned large language models while keeping task performance. It proposes SLDR, a post-fine-tuning defense that trains a LoRA recovery adapter only on the layers with the highest and lowest signed safety sensitivity scores. Representation-based dynamic routing activates the adapter only for malicious queries. Across four architectures, five downstream tasks, and four harmful benchmarks, SLDR substantially reduces harmful outputs while preserving downstream utility.
WhyProposes signed layer-sensitivity selective recovery with dynamic routing, validated across four architectures, five tasks, and four benchmarks.
In briefPatchBench: Measuring Collateral Damage in Activation Patching
SummaryThis paper introduces PatchBench, a benchmark of 400 high-confidence jailbreak failures observed across 8 open-source instruction-tuned models, for testing LLM safety patches. It also proposes PatchBench-Local, a protocol that checks whether a patch is precise by evaluating both correction of harmful neighbour prompts and preservation of benign neighbour prompts. Experiments with four activation steering methods show global capability can stay nearly unchanged while local benign regressions are severe, indicating aggregate metrics miss important collateral damage.
Alexi Canesse, Mathis Le Bail, Ma\"el Jenny et al.
In briefPairAudit: Using Graph Tokens to Guide Human Review Under Distribution Shift
SummaryIntrusion detectors can confidently misclassify attacks not seen during training, and human review can correct these errors but only for a limited number of cases. PairAudit uses graph tokens that capture prediction patterns across connected nodes to find overlooked errors and improve review priorities under a fixed budget. Human feedback helps decide whether these findings justify changing the review plan. Experiments show that PairAudit corrects more errors on average than uncertainty-based review, including on unseen attacks, even when all review costs are counted and without retraining the detector.
In briefNew infinite APN function families built by switching in even dimension
SummaryThis paper presents a new infinite family of APN functions obtained by applying the switching construction to a known family, the first such result since 2009. It also studies APN families derived from the Budaghyan-Helleseth-Kaleyski family by adding perturbation terms, giving four constructions arranged in two switching pairs. One switched family is proven APN in every dimension where its base family is defined and is shown to be CCZ-inequivalent to previous constructions. Two other families are conjectured to be APN for infinitely many dimensions, with conditions given for characterizing this property.
WhyGives the first new infinite APN family via switching since 2009, with a proof of APN-ness in all defined dimensions and CCZ-inequivalence to known constructions.
In briefSoK: Failure Modes in Common Criteria Product Evaluation - Taxonomy and Design-for-Evaluability Guidance
SummaryThis paper systematizes recurring failures in Common Criteria (ISO/IEC 15408) product evaluations, drawing on the standard, the evaluation methodology, NIAP Protection Profiles, and published Security Targets and Certification Reports. The failures are organized into a lifecycle taxonomy covering scoping, conformance, assurance evidence, cryptography, testing, vulnerability analysis, guidance, and post-certification configuration drift. The authors analyze root causes and propose a design-for-evaluability framework that product teams can apply before evaluation begins. The paper also identifies open problems for cloud, continuous-delivery, and AI-enabled systems.
