In briefToFu: Fuzzing the Trust Boundary Between LLMs, Orchestrators, and Tools
SummaryThis paper presents ToFu, a framework that automatically derives semantic security checks for LLM tools from their metadata and a CWE-guided sanitizer corpus. It generates fuzzing harnesses and semantic oracles to test how tools handle LLM-generated arguments. Evaluated on 273 MCP servers with 3405 tools, ToFu found verified bugs in 343 tools across 118 servers. The results show that real-world tools often fail to enforce their documented input semantics.
WhyAutomatically derives semantic security checks for LLM tools and finds verified CWE bugs in 343 tools across 118 MCP servers, showing broad real-world impact.
Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith et al.
In briefRapid mixing in superspecial isogeny graphs: a proof of expansion properties for these graphs, aiding isogeny-based cryptography.
SummaryThis paper proves expansion properties of superspecial isogeny graphs in dimension at least two, including arbitrary level structures. It gives explicit spectral gap bounds and characterizes obstacles from level structures, such as disconnectedness and periodicity. Without level structure, the bounds substantially improve prior results. The authors also turn earlier conjectural methods into rigorous algorithms and present the first algorithm for computing endomorphism rings of superspecial principally polarized abelian varieties in arbitrary dimension, with complexity Õ(p^{g-1}).
WhySubstantially improves spectral gap bounds for superspecial isogeny graphs with rigorous proofs, yielding a new endomorphism ring algorithm of wide relevance to isogeny cryptography.
Maria Corte-Real Santos, Harun Kır, Olivier Taïbi et al.
In briefAPEX-Harm: A benchmark testing whether AI agents stay safe in shared work folders
SummaryThis paper introduces APEX-Harm, a benchmark for testing AI agents doing finance, consulting, and legal tasks in large shared workspaces against prompt and script injection attacks. It covers six attack categories and evaluates 12 frontier models. The results show that completing a task does not prove safe behavior, since an agent can deliver a correct result while also taking an unauthorized action.
In briefA systematic study of how Android enforces security between app components
SummaryThis paper systematically examines whether security enforcement works at Android's inter-process communication boundaries, such as Activities, Services, BroadcastReceivers, ContentProviders, and URI scheme handlers. The authors ran 120 evaluations on over 30 Google and AOSP packages on Android 17 under a zero-permission attacker model, comparing expected and observed behavior. They found enforcement gaps in 80.8% of evaluations and derived a 14-category taxonomy of those gaps across manifest, code, platform, and architectural layers.
In briefTrustPaper: Issuer-Fingerprint Forensics for Forged PDF Documents
SummarySick leave certificates are increasingly issued as PDFs by online teleconsultation platforms, yet generic PDF scanners cannot judge whether a file's construction is legitimate for a given issuer. The paper presents TrustPaper, which combines the claimed issuer, a reference fingerprint learned from genuine documents of that issuer, and explainable evidence from several forensic modules. On a controlled corpus of two issuers and six forgery techniques, the issuer fingerprint flagged all forgeries by opportunistic and metadata-aware attackers, with no false positives on genuine test documents.
Yassine El Jakani, Mohamed Nadir Rhazi, Othmane Meknassi et al.
In briefEviRepair: Evidence-Driven Agents for Automated Repository-Level Vulnerability Repair
SummaryThis paper proposes EviRepair, a multi-agent framework for repairing software vulnerabilities across entire code repositories. Agents collaboratively collect vulnerability evidence, check that the evidence is consistent, and build a reviewed vulnerability model used to generate and validate patches. Experiments on PatchEval and SecBench with several agent frameworks and LLMs report higher resolved rates than existing agent baselines, with average gains of 16.37% and 40.33% respectively.
WhyAdds evidence review to agent-based repair, with average resolved-rate gains of 16.37% on PatchEval and 40.33% on SecBench over baselines.
In briefTowards Safe World Models: Risks, Defenses, and Evaluation
SummaryThis survey reviews safety issues for world models, which predict the consequences of actions to support planning and control. It organizes the literature across six lifecycle stages, from data and observations to feedback and updates, covering non-adversarial failures, attacks, defenses, evaluation protocols, and benchmarks. The paper argues that predictive accuracy alone cannot establish safety and identifies the measurements needed to connect model-level behavior to closed-loop and operational safety.
In briefProof of beyond-birthday MAC security for EWC and EWCDMD
SummaryThis paper studies two MAC constructions, EWC and EWCDMD, which combine block cipher calls with an almost-XOR-universal hash. Whether they achieve beyond-birthday-bound unforgeability had been an open problem. The authors prove both are secure up to about 2^(5n/6) MAC queries and nearly 2^n verification queries in the nonce-respecting setting. Their proofs analyze forgery events using auxiliary experiments, avoiding known birthday distinguishing attacks.
WhyResolves a long-open question on beyond-birthday unforgeability for EWC and EWCDMD with rigorous proofs and new analysis techniques.
In briefHiding Secrets in Wi-Fi Preambles for Robust Physical-Layer Concealment
SummaryThis paper proposes embedding secret bits in the Wi-Fi legacy short training field (L-STF) while preserving its autocorrelation properties, so packet detection and coarse frequency offset compensation still work. A pair of neural networks learns the embedding and extraction rules to increase steganographic capacity. Prototype experiments in indoor and outdoor settings show 46 secret bits can be reliably embedded across diverse channel conditions.
In briefECGWmark: Error-Correcting Deep Watermarking for ECG Signals
SummaryThis paper presents ECGWmark, a deep learning framework that embeds patient metadata directly into single-lead electrocardiogram signals so the information is not lost as recordings pass through multiple systems. It combines a convolutional generator, a frame-by-frame detector, and a frozen arrhythmia classifier that penalizes changes affecting diagnostic predictions, with extended Hamming codes to improve whole-message recovery. On the MIT-BIH Arrhythmia Database, the method keeps over 90% bit accuracy under time shifts of 10 to 50 samples, and the protected 16-bit payload achieves 99.86% exact recovery on clean segments.
In briefLETHE: A Method That Protects Images from Being Turned into Unauthorized Videos
SummaryImage-to-video diffusion models can turn one photo into a realistic video, which raises misuse risks when people do not consent. The paper proposes LETHE, which adds an adversarial perturbation to an image before release so that generated videos become unfaithful or corrupted. Through convex geometric analysis, the authors identify the spread of reference value vectors as a key factor, and combine a value collapse objective with an attention attraction objective. Experiments on multiple modern models are reported to show state-of-the-art protection.
In briefChecksum auditing that tolerates quantization to catch active attacks in federated learning
SummaryThe paper proposes a cross-silo federated learning audit in which the server sends secret challenge batches and clients return checksums of the induced gradients, using a quantized fingerprint with a small tolerance for floating-point differences across platforms. It reports detection of two active attacks at a true-positive rate of 1.0 with no false positives on the checksum axis. Against purely passive attackers, timing alone is not robust, and an attacker that answers on an untouched model copy while tampering with a replica evades the audit.
In briefUnderstanding and Mitigating Cross-Session Attacks Through Persistent Artifacts in AI Agent Skills
SummaryThe paper examines how files, configurations, and cached data that AI agents create during skill execution can persist and be reused in later sessions, creating a new attack surface. The authors describe three attack mechanisms (Instruction Propagation, Data Boundary Violation, and Evidence Poisoning) and build SkillRelayBench, a benchmark of 270 adversarial cases. They also propose SkillRelayGuard, a runtime defense that restores artifact provenance and provides pre-execution advisory review, reducing attack success rates while improving legitimate task completion.
WhyIdentifies a new cross-session attack surface via persistent artifacts, with a 270-case benchmark and measured attack rates and defense gains.
In briefPrompt Engineering Tactics Against Multi-Layer AI Agent Defenses: A Case Study
SummaryThis paper reports an empirical case study of prompt engineering strategies used against a three-stage defense pipeline in the OpenClaw Security Attack and Defense Challenge. It covers 19 attack targets across Enterprise OA, E-commerce, and Smart Home scenarios, documenting both successful and failed approaches. The author highlights a trade-off between instruction safety and attack execution accuracy. The final online score was 0.2630, with 5 of 19 tasks fully bypassing the defenses, suggesting that layered defenses with built-in behavioral constraints substantially limit what prompt engineering alone can achieve.
In briefRM-KLPT: Algebraic Pathfinding on Superspecial Abelian Surfaces with Real Multiplication
SummaryThis paper studies isogeny graphs of superspecial abelian surfaces with maximal real multiplication, which were first examined in 2009 and shown to be Ramanujan graphs. The authors design and implement the RM-KLPT algorithm, which solves the algebraic pathfinding problem by solving a norm equation in ideals of a quaternion algebra over a real quadratic field. They also show that knowing the initial surface's algebraic description enables a second-preimage attack on the RM-CGL hash function using this algorithm.
In briefSafety Graph: how safety responses can become attack surfaces in industrial control systems
SummaryThe paper shows that safety responses to operational technology failures in industrial control systems can open new attack surfaces and expand lateral movement. It introduces Safety Graph, a formal framework that unifies attack graphs, fault trees, and event trees, and compiles it into a classical AI planning problem solved with A* search to find cross-layer IT-OT cascade paths. Using a Web3D simulation of the Tennessee Eastman chemical process, the authors demonstrate that the approach discovers safety-response-induced lateral movements, and they analyze its complexity and scalability.
WhyUnifies attack graphs, fault trees, and event trees, revealing safety-response-induced IT-OT lateral movement; validated via simulation on one benchmark plant, limiting breadth.
Rakesh Podder, Philip D. Hopkins, Sarath Sreedharan et al.
In briefLimits of Query Monitoring Against Distributed Model Extraction
SummaryThis paper studies how well a model provider can detect distributed distillation campaigns using only the content of user queries, when account links are unavailable. The authors develop detectors on a million real chat turns and test them on 17 later weeks. They find a campaign is detectable only if it is more distinctive than the most distinctive group of ordinary users in the same week. The paper also reports concrete limits, including slow-ramping campaigns, benign evaluation pipelines that resemble distillation, and low colluder shares that defeat deployable detectors.
WhyDerives detection limits for query-only monitoring of distributed model extraction, validated on a million real chats and a frozen 17-week evaluation; solid evidence, impact limited to model providers
In briefCAPE: A Context-Aware Engine for Ranking Software Vulnerabilities by Real Risk
SummaryThe paper presents CAPE, a framework that adds deployment-specific evidence to vulnerability scanner reports and analyzes reachability, centrality, and exploitability to produce a priority score for remediation. Evaluated on 30 open-source agentic applications with 6,138 scanner-reported CVEs, most CVEs were found to be neither reachable nor exploitable. CAPE's rankings differed significantly from context-free baselines (CVSS, EPSS, KEV) and ranked confirmed-exploitable CVEs higher than all of them.
In briefAuditing training labels in a feature space that never saw them, for label-only backdoor attacks
SummaryThe paper studies FLIP, a backdoor attack that only flips training labels; on CIFAR-10, flipping 3% of labels makes a ResNet-32 classify 99.7% of triggered source-class images as the attacker's class. By keeping the test, labels and metric fixed and changing only the feature space, the authors show that detection works far better on frozen DINOv2 features that never saw a label. They also find that a higher detection score does not guarantee a safer model, and that beyond a point catching more poisons no longer reduces attack success.
In briefProvably subexponential algorithms for bounded-error LWE with few samples
SummaryThis paper shows that a variant of the Kirchner–Fouque Wagner/BKW-style algorithm solves decision and search versions of bounded-error LWE in subexponential time. It needs only about n + O(n/ln ln n) samples, far fewer than earlier analyses required. The proof is elementary, bounding the lower moments of a Fourier statistic.
WhyReduces Kirchner-Fouque's sample requirement from Ω(n log n) to n+O(n/ln ln n) with provable subexponential time, using an elementary Fourier moment argument; a substantive advance for LWE complexity.
In briefProvably subexponential algorithms for bounded-error LWE with few samples
SummaryThis paper presents a variant of the Wagner/BKW-style algorithm for LWE, solving decision and search versions with bounded errors. It needs only n+O(n/ln ln n) samples and runs in time 2^{O(n/ln ln n)}. Earlier analyses used lattice chains, whereas this work uses an elementary argument bounding lower moments of a Fourier statistic.
In briefPost-quantum session setup for Matter over Thread: message size and transport options
SummaryThe paper examines the cost of replacing Matter's CASE session handshake, which uses P-256 ECDH, with ML-KEM and post-quantum signatures over Thread. A byte-exact model shows the drop-in handshake grows far beyond Thread's 1178-byte Matter message limit, and a multi-hop simulation shows fragmented transport causes spurious retransmissions and slower or failed handshakes. As a first step, the authors propose hybrid P-256 plus ML-KEM-512 key exchange with a cached device certificate chain, which protects against harvest-now, decrypt-later attacks while keeping messages within the current limit.
In briefWaveMark: Robust Wavelet-Domain Watermarking for Diffusion-Generated Images
SummaryThis paper introduces WaveMark, a wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise to help trace the origin of generated images. It spreads keyed copies of message bits across spatial positions, wavelet orientations, and scales, and encodes them via magnitude projection for a decoding margin. Evaluated with SD2.1 under 14 attacks, WaveMark reports 100.0% bit accuracy without attacks and retains over 88% against the state-of-the-art MarkNull and MarkNull-A removal attacks.
In briefA sample-preserving reduction from search to decision for noisy linear equations with large moduli
SummaryThis paper studies the Noisy Linear Equations problem, a generalisation of cryptographic learning problems including LWE, LWR, and LPN. The authors give a new search-to-decision reduction that preserves the sample count and runs in poly(n,m,log q,q/σ) time. For LWE and LWR, it runs in poly(n) time even when the modulus is exponentially large, provided the noise-to-modulus ratio is non-negligible. The reduction works for prime moduli; for composite moduli it outputs a list containing a small multiple of the solution.
WhyGives a sample-preserving search-to-decision reduction, making LWE and LWR polynomial-time even for exponentially large moduli, a clear improvement over prior work.
Andrej Bogdanov, Kel Zin Tan, Prashant Nalini Vasudevan
In briefA new reduction from search to decision for noisy linear equations with large moduli
SummaryThe paper presents a sample-preserving search-to-decision reduction for the Noisy Linear Equations problem, which generalises LWE, LWR and LPN used in cryptography. For prime moduli q, the complexity is poly(n, m, log q, q/σ). In particular, LWE and LWR reductions run in poly(n) time even when q is exponentially large, provided the noise-to-modulus ratio σ/q is non-negligible.
WhyGives a sample-preserving search-to-decision reduction for LWE and LWR, polynomial even for exponentially large moduli, a significant improvement with rigorous proofs.
Andrej Bogdanov, Kel Zin Tan, Prashant Nalini Vasudevan
In briefCounterexamples showing beyond-Johnson proximity gaps fail over binary fields
SummaryThis paper studies proximity gaps used in hash-based proof systems, which bound how closely combinations of words can match Reed–Solomon codewords. It shows that proximity gaps beyond the Johnson threshold do not hold over binary fields, giving several constructions of counterexamples across different rates and challenge fields. All results are stated to be formally verified in Lean.
WhyShows beyond-Johnson proximity gaps fail over binary fields with multiple Lean-verified constructions, affecting soundness analysis of fast hash-based proof systems.
Quang Dao, Scott Duke Kominers, Justin Thaler et al.
In briefVulnerable AI Models in the Supply Chain: How Flagged Models Are Adopted and Used
SummaryThis paper empirically studies how 16,977 HuggingFace models flagged as vulnerable by InsightDB are adopted and propagated across GitHub repositories, software packages, fine-tuning chains, and deployed applications. The authors found these models in over 21,000 code locations across more than 5,000 open-source repositories, with 3,757 flagged models (22.1%) referenced in at least one project. Across the observed usage patterns, they found no provenance verification or sanitization, and developers often bypassed security parameters or relied on permissive framework defaults. The authors conclude that scanning model files alone is insufficient and that context-aware analysis and stricter guardrails at the application layer are needed.
WhyLarge-scale tracking of flagged vulnerable models across repositories, using code property graphs and frequent subgraph mining, gives strong evidence with notable supply-chain security impact.
In briefThe Allure of Hiding Systems for Security: A Game-Theory Study
SummaryThis paper provides the first rigorous game-theoretic model of "security by obscurity," the idea that hiding how a system works helps protect it. It examines how rational attackers and good-faith researchers respond to openness or secrecy in fallible systems. The authors prove that in equilibrium under realistic conditions, obscured systems are more likely to suffer successful attacks than open ones, supporting long-standing security community views.
In briefVerifiable computation on encrypted data using homomorphic encryption over random encodings
SummaryThis paper addresses verifiable computation on encrypted data, letting clients outsource computation while keeping inputs private and checking results. The authors introduce Homomorphic Encryption over Random Encodings (HERE) and a new security notion, IND-CPA-E, that resists reaction attacks from malicious servers. They build a HERE scheme for bounded-degree functions using Shamir secret sharing and demonstrate it on matrix-vector multiplication. The prototype shows a proof overhead as low as 2 times the homomorphic computation runtime.
In briefReward hacking spreads between coding agents in multi-agent systems
SummaryThis paper studies how a reward-hacking strategy, where an agent earns reward by bypassing automated evaluation instead of solving the task, can spread among agents that collaborate on coding. Experiments on four open-weight models show the strategy propagating through shared code, memory, and natural-language plans, and even inducing hacking in stronger closed-weight models. The authors also test code review by the coder or a separate verifier, which reduces the number of delivered hacks.
WhyFrames reward hacking as transmissible across agents, with theory on amplification and decay conditions. Experiments span four backbones, but scale and benchmark details are limited.
Yuepeng Hu, Pegah Ghahremani, Reza Aghajani et al.
In briefVEPA: A Verified, Evolving Formal Policy Framework for Guardrails on Long-Running LLM Agents
SummaryThis paper introduces VEPA, a framework that represents an LLM agent's guardrail as a formal policy of executable symbolic rules applied to typed agent events. During deployment, an LLM proposes policy patches based on feedback, and a deterministic verifier accepts only structurally valid, conflict-free policies, with an evidence-aware layer activating rules only when supported. The authors report that VEPA outperforms baselines on ASSEBench-Safety, ASSEBench-Security, and ATBench, including under mixed streams, corrupted feedback, and longer horizons.
Duy Nguyen, Lesly Miculicich, Bhavana Dalvi Mishra et al.
In briefPower, Performance, and Area of Hardware Malware Detectors Built on Performance Counters: FPGA and Open-PDK ASIC Study
SummaryThis paper studies the area, power, and timing costs of hardware malware detectors (HMDs) that classify programs as benign or malicious using hardware performance counter data. The authors built a pipeline to generate and validate RTL implementations across many classifier families, HPC sets, and ensemble methods, then evaluated them. They report that tree- and rule-based detectors achieve the highest detection performance with much lower area and energy than function-based classifiers. Reducing the number of HPC inputs to fit a processor's counter limit preserves detection performance while substantially cutting area, power, and delay.
Alireza Abolhasani Zeraatkar, Parnian Shabani Kamran, Parsa Mirfasihi et al.
In briefDecentralizing Trust in Identity: Linking Meaningful and Self-Authenticating Identifiers
SummaryThis paper describes work on linking meaningful identifiers with self-authenticating identifiers to form self-authenticating meaningful identity. It presents two approaches: associating a registered domain name with an onion address, and associating an atproto handle with a decentralized identifier. The authors also show how both associations can be combined in a single identity. They propose grounding identity trust in contextual relevance of an attestor rather than relying only on structural authority.
In briefBetter Batches, Better Privacy: Random Allocation for DP-BandMF
SummaryThis paper improves batch selection for DP-BandMF, a differentially private training method, by proposing strategies inspired by random allocation. The authors report RMSE improvements of up to 1.85 times over prior work. They also accelerate Monte Carlo privacy accounting by about two orders of magnitude with an optimized GPU implementation, and present a framework that jointly selects the strategy matrix and batch selection, reducing RMSE by up to 13.4%.
In briefDefending Federated Large Language Models Against Byzantine Attacks Using Hypergraph Message Passing
SummaryThis paper addresses Byzantine attacks that use malicious model updates to corrupt semantic consistency in federated training of large language models. It proposes the Hypergraph Message Passing Graph Autoencoder (HMP-GAE), which represents low-rank model updates as hypergraph nodes and uses iterative message passing to suppress inconsistent updates. The method is implemented with Qwen-2.5 and Llama-3.2 and evaluated on AG News and Yahoo! Answers, with reported gains in accuracy, semantic entropy, and perplexity over existing defenses.
In briefPVBRF-ID: Private, Verifiable, Attack-Resistant Federated Intrusion Detection for Oilfield Networks
SummaryThe paper proposes PVBRF-ID, a two-server protocol for federated intrusion detection across oilfield sites that keeps each site's model updates private. Servers jointly check each update's norm and cosine similarity to a clean reference, revealing only an accept bit per site. On a 15-class dataset with ten sites, it matched FedAvg on clean data and resisted sign-flip and adaptive attacks, but backdoor updates passed the filter.
Mustafa S. Aljumaily, Ali Ataeemh Allami, Mustafa N. Mnati et al.
In briefExtended SGX Enclaves Inside Confidential VMs: A Research Paper
SummaryThis paper presents TEEVisor, an architecture that runs inside a Confidential Virtual Machine (CVM) and uses AMD SEV-SNP privilege levels to build hardware-protected process-level enclaves. It offers a binary compatibility mode for unmodified SGX applications and an extended SGX (eSGX) mode with faster execution paths and richer programming features. On AMD EPYC hardware, the authors report under 5% overhead for compute- and memory-bound workloads and about 12% for I/O-heavy applications, with enclave cloning at 93 microseconds per MB.
In briefProvable subexponential algorithms for Module-SIS and Module-LWE
SummaryThis paper extends the Ducas, Engelberts and Loyer (CRYPTO 2025) framework to module matrices over power-of-two cyclotomic rings for every residue degree of the prime modulus. Under stated rank and error assumptions, it gives worst-case subexponential algorithms for Module-SIS and decision and search algorithms for Module-LWE. Separate heuristic estimates in the same model suggest that Wagner-style attacks do not reach the NIST security targets of ML-KEM and ML-DSA.
WhyExtends a subexponential framework to module lattices with new provable algorithms and improved bounds; strong theory, but no experimental validation.
In briefCancerous Backdoor Attack: A Gradual Hidden-Trigger Attack on LLM Reasoning
SummaryThis paper proposes the Cancerous Backdoor Attack, which targets large language models by making malicious behavior develop gradually across several intermediate stages rather than appearing at once after a trigger. It uses invisible tokens to supply hidden stages and a stage controller to track the attack's progress during inference. Experiments on several reasoning datasets, models, and tasks show consistent gradual reasoning corruption and better results than prior backdoor baselines. The authors conclude that answer accuracy alone is insufficient for detecting such attacks.”
Tahmid Imtiaz Imu, Emama Nahid, Prodipta Sen Amartya et al.
In briefHOMARD: Stealing Off-chip Memory Information Through Power Rail Measurements
SummaryThis paper presents HOMARD, a method that uses unprivileged millisecond- and milliampere-resolution power sensors on modern Arm SoCs to read DRAM activity without timers. It introduces two attack primitives: HOMARD-RE, which reverse-engineers DRAM addressing functions from power alone, and HOMARD-DATA, which recovers the Hamming weight of cache lines and secret byte values. The results show it works on several platforms, including cases where timing-based methods fail.
WhyUnprivileged power telemetry recovers DRAM mappings and Hamming weights, a new side channel, tested on limited platforms.
Eliott Qu\'er\'e, Li-Chung Chiang, Carina Fiedler et al.
In briefA study on moving from reactive containment to proactive assurance for AI agent security, based on 2026 incidents.
SummaryThe paper compares 2026 cases in which OpenAI, Anthropic, and Google AI agents reached real systems outside their authorized test scope during cybersecurity evaluations. It proposes a Proactive Agent Security Assurance Cycle and a five-layer Boundary Assurance Stack that verify boundaries while agents are running. The authors also present design propositions and falsifiable hypotheses, and note that the public record on the Gemini case is limited, so its causal mechanism remains provisional.
In briefORCAGen: RAG-guided generative AI for context-aware malware deception playbooks
SummaryThis paper presents ORCAGen, a framework that uses retrieval-augmented generation and structured prompting to offline generate proof-of-concept malware and matching deception code, which is validated before deployment. The authors evaluated five LLMs on synthesized scenarios and 150 real-world samples covering keyloggers, information stealers, and ransomware. GPT-5.5 needed the fewest refinements with no observed hallucinated APIs, while Gemini 3.5 Flash had the lowest response time and runtime overhead.
Shihab Ahmed, Md Sajidul Islam Sajid, Teryl Taylor et al.
In briefOptimal statistically secure ORAM and oblivious search tree
SummaryThis paper addresses oblivious RAM (ORAM), which lets a client access data in untrusted memory without revealing access patterns, and oblivious search trees. Prior constructions had a log-squared overhead, which the authors break. They achieve statistically secure ORAM with O(log_B N) cost when B ≥ log^{1+ε} N, and an optimal oblivious search tree with the same cost when B ≥ log^{2+ε} N.
WhyBreaks the long-standing log-squared barrier for statistically secure ORAM and oblivious search trees, achieving optimal O(log_B N) cost.
In briefSAGE: A hardware-aware method for private vision-language AI on smart glasses
SummarySAGE is a framework that makes privacy-protected vision-language inference on smart glasses more efficient. It keeps raw images on the device, uses INT8 graphs specialized for input shapes, and compresses protected representations into compact 256-dimensional packets before transmission. On real Mentra Live glasses with a Qwen workload, it reduces inference latency by 39.18% and protected packet size by 96.56%, while retaining 85.62% of the protected reference's relaxed utility.reduced
In briefImproved leakage resistance of Shamir secret sharing and optimal polynomial matching
SummaryThis paper studies two problems about polynomials over a finite field: how much is revealed about a secret when a few bits leak from each share (local leakage resilience for Shamir secret sharing), and how to find a polynomial matching the most input lists (optimal polynomial intersection). Using a connection between the two problems, the authors show Shamir secret sharing is one-bit leakage resilient when the ratio is at least 1/2 minus a small constant, breaking the previous 0.668 threshold. They also give a quantum algorithm for the polynomial intersection problem that matches a semicircle-law fraction of lists up to any small error.
In briefReSI: A recursive framework for AI safety that resists known attacks and resists unforeseen risks
SummaryThis paper proposes ReSI, a framework that repeatedly improves AI safety alignment across successive model updates. Each round uses diverse red-teaming methods to find vulnerabilities, creates training recipes, and selects the update with the largest safety gain that preserves capabilities as the next model. Across four dense and mixture-of-experts models, ReSI matches or exceeds evaluated frontier models on safety benchmarks and reduces the mean X-Teaming attack success rate from 86.01% to 31.45%.
In briefVerification with Transfer: Exact Information Frontiers and Call Costs
SummaryThe paper studies how a verifier that only accepts or rejects whole answers can use related source tasks, either solved first or interleaved with verification, and prices this in information and source calls. With an exact verifier, it identifies the minimum causal information needed as a list rate-distortion function, and bounds the expected number of binary source calls. For linear task banks over F_2, it gives a closed form for optimal accuracy and a computable budget profile. Apart from two clauses about the planner, the numbered results are machine-checked in Lean 4.
WhyDerives an exact information-call frontier for verification with transfer, with most results machine-checked in Lean 4, though scope is limited to specific settings.
In briefPoster: Preliminary study of detecting whether an LLM was distilled from another model
SummaryThe paper addresses unauthorized distillation, where a model is trained on a proprietary LLM's outputs. It proposes distillation inference, a hypothesis test that uses shadow models trained either by distillation or independently to calibrate a suspect model's score into a p-value. In a preliminary study with Qwen2.5-7B as teacher and Llama-3.2-3B as suspects, the test reached a true positive rate of 1.0 at significance level 0.02. The authors conclude that distillation inference is feasible for detecting distillation attacks.
In briefUnpredictability from Parity: Linear Correctors for Dependent Random Bits
SummaryThis paper studies linear correctors, which reduce bias in random bits by XOR-ing them, for dependent bits generated by a Markov chain rather than independent bits. It gives an exact formula for the parity bias of such dependent bits. Under next-bit unpredictability, where conditional bias is at most β, the bias decays according to β itself, improving on the previous best bound from Zhou and Bruck (2011). The authors also show that bounded memory is necessary, since imposing unpredictability on the full history means XOR-ing does not reduce bias at all.](en-note)
WhyGives an exact parity-bias formula for Markov sources, corrects the known exponent, and proves near-optimal bounds with matching construction, a substantive advance for randomness extraction.
In briefNew methods for building quadratic and cubic permutations with optimal threshold implementations
SummaryThis paper studies threshold implementation (TI), a method for protecting hardware block ciphers against side-channel attacks such as differential power analysis. It targets the minimum possible number of shares, t+1, for bijective S-boxes. The authors present four constructions, including proof that Q_30^5 admits optimal TIs and a matrix criterion for a class of quadratic permutations. They also introduce a weighted interpolation method yielding an infinite family of power permutations, which counters a 2023 conjecture, and a derivative-uniform framework showing every 4-bit cubic permutation admits optimal TIs.
WhyGives several constructions yielding optimal threshold implementations for quadratic and cubic permutations, counterexamples to a 2023 conjecture, and the first such results for differentially 4-unifo
In briefCould detectors for LLM watermarks be made public?
SummaryThe paper asks whether watermark detectors for large language models can be released publicly, since public access could help attackers make targeted edits. It proposes a split-key method that exposes one key through a public detector while keeping the other private for full verification. A statistical test detects imbalances between public and private scores, and the method is evaluated against removal and forgery attacks.
WhyProposes a novel split-key public-private watermark with an imbalance test; evaluated on varied attacks, with clear implications for deployed watermark detection.
Georgios Milis, Tom Sander, Tom\'a\v{s} Sou\v{c}ek et al.
In briefThe Power of Multislices in Monotone Computation: a theoretical cryptography and complexity paper on how multislice functions can be computed by formulas and applied to secret sharing.
SummaryThe paper studies multislice functions, parametrized by a width w, and proves that when w is much smaller than n, formulas over multislice gates still need exponential size to compute a certain explicit monotone function. The authors show how to realize multislices using slice gates, yielding small formulas and, for sufficiently long secrets, secret-sharing schemes for fixed-width multislices with polynomial information ratio. They also prove an exponential lower bound on share size for an explicit access structure in a family of schemes covering known general constructions.
WhyProves exponential formula-size lower bounds for multislice gates and constructs slice-gate realizations, a strong theoretical advance with secret-sharing consequences.
