In briefSEEK: Agentic Knowledge Graph Retrieval for Secure Code Generation
SummaryThis paper introduces SEEK, a framework that helps language models write code that is both functional and secure. It builds a security knowledge graph from the CWE taxonomy and real CVE vulnerability-fix examples, then uses planner and selection agents to retrieve relevant weaknesses. SEEK reports higher secure-pass rates than prior methods on CodeGuard+ and CyberSecEval, including on weakness types without directly linked examples.
In briefCensorship resistance for credential issuance and its use in the EU Digital Identity Wallet
SummaryPrivacy-preserving credential systems usually protect data only during presentation, overlooking privacy risks during issuance. The paper proposes a security model for censorship resistance and a round-optimal construction from blind signatures that supports selective disclosure. It also presents CRACS, an instantiation deployable within the European Digital Identity Wallet framework without changes for verifiers.
WhyIntroduces a new issuance-phase censorship resistance model and round-optimal construction deployable in EUDIW, with moderately limited experimental evidence.
Pierpaolo Della Monica, Ivan Visconti, Andrea Vitaletti et al.
In briefStateSync-GKR: a reusable sparse GKR proof engine, design and evaluation
SummaryThis paper presents StateSync-GKR, a reusable Rust sumcheck/GKR proving core with a sparse-Merkle frontend for authenticated state transitions. Release 1.2.0 is compared with release 1.1 on the same instances and workloads, showing lower memory use from sparse layer reduction and higher proving throughput with unchanged proof bytes and verifier acceptance. The authors report that 99th-percentile latency to verified acceptance fell from 440 to 34 ms at 1,000 requests/s, and describe long-duration runs at higher request rates.
In briefMetaCascade: Attacking Agent Skills End-to-End by Poisoning Only Metadata
SummaryThis paper studies security risks of third-party skills used by LLM agent systems, which select skills based on their metadata, while prior work mainly examined harm after execution. The authors propose MetaCascade, an end-to-end framework that poisons only metadata, generating diverse malicious skill candidates and iteratively refining their metadata using task and black-box competition feedback. Evaluated on four datasets and two agents, Hermes and OpenClaw, it achieves state-of-the-art attack performance over the strongest baselines.
In briefKedgeFlow: A Programmable Control Plane for Enterprise AI Agents
SummaryThe paper proposes KedgeFlow, a language-independent contract that governs state-changing operations by enterprise AI agents. Trusted controllers issue signed authority for exact actions, and privileged gateways enforce it independently of agent reasoning, so each allowance can be successfully claimed at most once. In single-resource tests, concurrent claims and boundary cases behaved as designed, but the authors note that permissive policy can still authorize undesirable effects and that distributed reservations and exactly-once effects at real targets remain untested.
In briefProtecting shared AI agent workflows from tampering using signed trajectories and runtime checks
SummaryThe paper addresses the risk that shared repositories of reusable workflows for LLM-based agents could be compromised, causing downstream agents to fail or act unsafely. The authors propose requiring cryptographic signatures on execution trajectories, screening them before inclusion, and having agents verify only the signed trajectories relevant to their runtime path. Experiments across reasoning benchmarks show attacks reach up to 90.12% success without protection, while the proposed method achieves an average F1 of 85.26% and a 79.97% detection rate.
In briefWhen Does Trust Help? Leakage-Free Evaluation of Backdoor Defenses in Federated Intrusion Detection
SummaryThis paper re-evaluates trust-based defenses for federated intrusion detection systems against poisoning and backdoor attacks, using a protocol designed to remove common evaluation artifacts. Across three NIDS datasets with multiple seeds, the defenses help only for small trigger magnitudes, while large triggers reach near-complete attack success. The author finds that knowledge of the attacker's trigger, rather than representation scoring, suppresses the backdoor, and that differential privacy costs little utility but does not mitigate it. The evaluation protocol is released publicly.
In briefLast Secure Code Benchmark: Checking Whether AI Vibe-Coded Software Is Secure
SummaryThis paper introduces the Last Secure Code Benchmark, which evaluates whether AI coding agents write secure code. It contains 450 tasks built from 150 real vulnerabilities, spanning seven languages and three vibe-coding scenarios, with specifications that never mention security. Hidden functional and security tests grade the results. Across six frontier agents, 73.6% to 91.3% of tasks pass functionally, but only 16.4% to 25.1% are both functional and secure.
WhyBuilds a 450-task benchmark across seven languages and 24 CWEs, evaluating six frontier agents in three vibe-coding scenarios, with hidden functional and security tests.
In briefCharacterizing the polynomial-time computations used in cryptography with implicit complexity
SummaryThe paper shows that λBLL, a recently introduced lambda calculus for randomized computation, can accurately capture first- and second-order polynomial-time computations used in cryptographic definitions and proofs. Stated in the style of implicit computational complexity, the results indicate that the calculus can express cryptographic experiments and adversaries, and that reductions formulated within it preserve complexity. Polynomial-time soundness holds for the full calculus, while polynomial-time completeness already follows with a minimal finite set of basic functions.
WhyUses the randomized lambda-calculus λBLL to characterize first- and second-order polytime cryptographic computations, with formal soundness and completeness results that are significant for the subfie
In brief"No, Your Tools Are Not Enough": A paper on using AI agents to find software vulnerabilities autonomously
SummaryThe paper describes the authors' experience using AI agents to find vulnerabilities in Windows drivers, the Linux kernel, XNU, firmware, and web applications. They use an iterative agentic workflow and report that it generalizes across these different targets. The paper also discusses tasks that agents help with that were previously challenging, along with future research directions for autonomous vulnerability discovery.
In briefResearch on merging-conditional backdoor unalignment attacks against large language models
SummaryThis paper studies a new threat to large language models called One-sided Merging-Conditional Backdoor (OMCB), which stays hidden in a standalone model but activates when merged with another model, removing safety alignment. The authors propose SMOKE, a meta-learning attack framework that implants OMCB through bi-level optimization. They report that SMOKE is effective across various architectures and merging techniques and resists existing backdoor detection methods.
In briefDeclared but Unaccountable: Measuring Seller-ID Gaps in Ad Supply-Chain Transparency
SummaryThis paper examines a gap in advertising transparency: when a seller account authorized in a publisher's ads.txt or app-ads.txt is missing from the applicable sellers.json registry, its public verification path breaks. Using about 233.4 million normalized advertising records, the authors measure this gap across a reference population and publishers linked to at least 100 copyright-removal requests, finding a 6.45 percentage-point increase. Standardizing populations over 1,469 shared ad systems, they attribute roughly 72% of the contrast to differences within systems and 28% to composition. The authors also propose a declaration-centered investigative framework, while noting that correlation does not establish attribution.
In briefConfidential Error-Correcting Codes: A cryptographic tool that keeps messages private while decoding reliably, applied to AI image watermarking
SummaryThis paper introduces Confidential Error-Correcting Codes (CECs), a cryptographic primitive that allows reliable decoding from perturbed codewords while keeping messages confidential, defined by confidentiality, robustness, and soundness properties. The authors build a concrete instantiation, Conc-CEC, using concatenated Reed-Muller and Reed-Solomon codes, and apply it to CECMark, a watermarking scheme for AI-generated images. Experiments report that CECMark achieves higher robustness across 56 evaluated perturbations than several state-of-the-art methods, with a false positive rate below 10^-5.
WhyIntroduces a new cryptographic primitive with a RSS framework, validated against several watermarking baselines across 56 perturbations, with notable impact on AI image watermarking.
In briefLimits of autoregressive token generation via sequential sampling
SummaryThe paper studies autoregressive token generation by modeling it as sequential samplers, circuits that draw the next symbol using only previous symbols and a small amount of state. It shows that a sampler with k bits of state can be simulated by a stateless one with roughly O(2^k) size overhead, and that efficient insertional sampling is more powerful than efficient sequential sampling in any fixed order. It also shows that sequential samplers with small state cannot establish certain covert cryptographic channels, which suggests a possible safeguard against subliminal coordination among malicious LLM agents.
WhyShows stateful sequential samplers simulable by stateless circuits with exponential overhead, combined with a pseudoentropy duality for a clean characterization; novel theory with solid proofs, but na
In briefDUOW: a watermarking method that embeds ownership signals in multi-agent routing decisions to deter policy cloning
SummaryThis paper addresses the risk that routing policies in multi-agent systems can be cloned from execution logs. The proposed DUOW framework works at the external decision layer without changing model parameters or generated outputs, redirecting functionally equivalent routing choices to embed ownership signals. According to the authors, evaluations on four multi-agent routing benchmarks show high task utility, reliable ownership verification even when up to 90% of logs are erased, and negligible computational overhead.
In briefThreshold batch arguments with statistical soundness, enabling obfuscation-free weighted threshold encryption
SummaryThis paper constructs the first threshold batch argument (BARG) for NP statements with statistical soundness, covering an expressive class of trapdoor threshold languages. It is based on circular-secure fully homomorphic encryption, or on witness encryption combined with learning with errors, and the common reference string grows only polylogarithmically in the number of statements k. The authors combine this with a new pseudorandom permutation sampling technique to obtain weighted threshold signatures with statistical unforgeability, and with witness encryption to get a weighted threshold encryption scheme with non-interactive decryption. In the random oracle model, the scheme supports arbitrary weights and silent setup, where users generate their own keys without a central authority.
WhyGives the first threshold BARG with statistical soundness and polylog CRS, yielding weighted threshold encryption without obfuscation, a notable theoretical advance.
In briefTenseUp: Efficient Post-Quantum Lookup Arguments from Tensor Codes for Dynamic SNARKs
SummaryThis paper presents TenseUp, a lookup argument built from tensor codes that lets a prover succinctly show a batch of table lookups are correct, with time proportional to the number of lookups. The scheme is transparent and post-quantum secure, and experiments indicate performance comparable to or better than prior non-post-quantum schemes. The authors also propose a general compiler that turns a static SNARK into a dynamic SNARK using updatable lookup arguments, which, combined with a hash-based SNARK, yields the first transparent, post-quantum secure dynamic SNARK.
WhyUses tensor codes to build transparent, post-quantum updatable lookup arguments that asymptotically beat prior work, plus a compiler yielding the first transparent post-quantum dynamic SNARK.
Christodoulos Pappas, Pariya Akhiani, Yupeng Zhang et al.
In briefNames Are Not Objects: Confining Compromised AI Coding Agents by Binding Permissions to Objects
SummaryThe paper argues that many attacks on coding agents exploit a gap between the name a check approves and the object later acted on, such as a symlink target. It presents Zero-Trust Agent Cells (ZTAC), which confine the agent in a kernel sandbox so it reaches files, programs, and the network only through a broker that resolves and checks each object at use. In tests of 74 attacks, ZTAC lost 2, completed 43 of 46 benign operations, and added a median 4.0 ms brokered-request latency.
WhyProposes object-bound authorization against name-object mismatch in coding agents; evaluated on 74 attacks and 10 real incidents, far outperforming allowlists and command sandboxes.
In briefWhat Counts as the Same Task? Executable Contracts for Testing Tool-Using AI Agents
SummaryThis paper examines how robustness tests for AI agents that use tools decide whether a modified test case still represents the original task. It finds that common validity rules, such as embedding-similarity thresholds, accept many edits that actually change the task while rejecting many valid hostile inputs. The authors propose executable task contracts that specify task-defining facts, allowed edits, and completion criteria, and check each test case before the agent runs. They compare validity rules by scoring 14,336 stored agent runs under each rule.
WhyProposes executable task contracts and shows, over 14,336 runs, that embedding thresholds misjudge many edits; novel and well-evidenced, with impact mainly on agent evaluation.
In briefSecReason: Detecting and Self-Repairing Vulnerabilities During LLM Code Generation
SummaryCode generated by large language models may contain security vulnerabilities that can reach production. SecReason monitors reasoning models while they draft code in their streamed chain of thought, scanning each statement and tracing dataflows. When a security rule fires, it interrupts generation, inserts a warning, and resumes so the model repairs the draft in the same trace. The paper reports that on CWEval and SecCodeBench, the share of secure and functionally correct runs rose from below 15% to 72.8%–98.1%.
In briefThree new families of simple-root cyclic codes as DS and AMDS symbol-pair codes
SummaryThe paper constructs three families of simple-root cyclic codes over finite fields of odd characteristic using generator polynomials. For length 2q+2, the minimum symbol-pair distance is 10 for odd prime powers q≥7; for lengths 4q−4 and 2(q−1) it is 9 or 10, and 11 or 12, respectively. All constructed codes are MDS or AMDS symbol-pair codes.
In briefMemForm: A Benchmark for Memory Formation Poisoning in LLM Agents
SummaryThe paper defines Memory Formation Poisoning as adversarial manipulation of the interfaces through which LLM agents produce and commit persistent memory. It introduces MemForm, a diagnostic benchmark covering five interfaces: Content, Evidence, Scope, Selection, and Path. Evaluations across six LLMs and two response formats show broad susceptibility, and even authentic successful experiences can lead to undesirable behavior after memory formation.
WhyProposes an interface-based benchmark for memory formation poisoning, showing consolidation order alters behavior; six-model experiments with defenses are thorough, impact limited to LLM agent memory
In briefByteMark: A Unified Byte-Level Watermark for Detecting AI Text Across Models
SummaryThis paper proposes ByteMark, a watermarking scheme that places its signal on the UTF-8 bytes of published text, so models with different tokenizers can embed it under one public specification and key. A single detector can verify text using only the text and the key. The authors report that baseline detectors lose detection performance when the tokenizer or embedding model is replaced, while ByteMark keeps its detection rate. ByteMark also remains detectable when participating models continue or rewrite the text.
In briefUC-secure zkSNARKs with succinct proofs under weaker trust assumptions
SummaryThis paper presents the first framework for building UC-secure zkSNARKs (zero-knowledge succinct arguments) under weaker trust assumptions. It relies on a new primitive, Key-Updatable Polynomial Commitments (KU-pCom), which needs only one honest publicly verifiable key update instead of a fully trusted setup. The authors instantiate the framework with KZG commitments and a lattice-based scheme, and provide an end-to-end implementation benchmark showing UC security, succinctness, and practical efficiency can coexist.
Nahid Roustaeifar, Maryam Zarezadeh, Neel Mehendale et al.
In briefDICE: Interface attacks that tilt System One model decisions
SummaryThe paper studies a Jev-based pipeline in which three adapter outputs (state extraction, question generation, and output interpretation) are bounded-substituted. In three small synthetic studies, each adapter can change the final decision even though Jev and its authentic API responses stay outside attacker control. Checks binding these relationships stopped the tested interventions, but also rejected some valid clean decisions. The work does not estimate how common these failures are in deployed systems.
In briefSuccinct proofs from symmetric-key tools with near-minimal time and space costs
SummaryThe paper constructs public-coin, succinct, zero-knowledge interactive arguments for NP relations decided by time-T, space-S random-access machines. Assuming collision-resistant hash functions, it gives a range of tradeoffs between prover time, prover space, and proof size. The authors build two streaming multilinear polynomial commitment schemes inspired by Brakedown and BaseFold within the streaming PIOP+PCS framework. Applying Fiat-Shamir yields time- and space-efficient zero-knowledge SNARKs from symmetric-key primitives.
WhyBuilds streaming code-based multilinear commitments achieving near-optimal time and space tradeoffs for symmetric-key zero-knowledge SNARKs, a substantive advance over prior designs.
In briefTokenization-invariant watermark: a byte-local method for LLM text
SummaryThe paper proposes TI-WM, a watermarking method that embeds marks during token generation but keys and scores them on canonicalized UTF-8 bytes, so detection does not call the tokenizer. Under a specified white-box attack, its attacked AUC exceeds that of Unigram with detection-side deletion. The authors note the operating points are not jointly matched on quality or clean detectability, and they do not claim general robustness or a low false-positive-rate guarantee.
In briefNatural code changes that confuse AI agents hunting software vulnerabilities
SummaryThis paper studies how AI agents perform at vulnerability analysis on real code commits. It finds that agents produce very different results on commits with the same functionality and vulnerability. The authors mine functionality-preserving transformations from real development patterns and test them against agents. They report that even a single transformation can reduce vulnerability discovery success for frontier agents, and they also examine composed transformations and adaptive attackers.
In briefLattice Bingo: Post-Quantum Asynchronous Verifiable Secret Sharing with Adaptive Security
SummaryThis paper presents Lattice Bingo, a lattice-based packed asynchronous verifiable secret sharing protocol that distributes many secrets at once despite Byzantine faults and arbitrary message delays. It keeps quadratic communication and linear packing, replacing the non-post-quantum assumptions of Bingo with a commitment scheme for two-dimensional linear codes based on the PowerBASIS assumption. The protocol also achieves one-shot adaptive security, where corruption and reconstruction requests must be submitted together in a single batch.
In briefARMOR: a schema-preserving password-hardening retrofit that raises attacker cost on resource-constrained systems
SummaryThis paper addresses offline password guessing after credential-database leaks on resource-constrained systems such as IoT gateways and edge servers, where memory-hard KDFs may be too costly. It proposes ARMOR, a verifier-side transform that keeps the password schema by applying secret per-account chains of injective operations held in an isolated Chain Registry. In a bounded chain-aware attack on 1,000 salted-MD5 targets, the attacker executed 89.35 times the plain arm's counted salted checks, yet all target passwords were still in the bounded pool and were recovered. The authors state these results describe the implemented attack, not minimum attacker cost.
In briefWatermarking LLMs in federated learning despite robust aggregators
SummaryRobust aggregators used in federated learning can be exploited by a malicious server to remove LLM watermarks, causing existing methods to fail detection. The paper proposes CamoMark, an aggregator-agnostic scheme that makes watermarked updates look like clean updates while keeping enough watermark signal for detection. On Qwen fine-tuned on Alpaca, it reaches a p-value of 1.82×10⁻² using only 3.3% watermarked data, and stays robust to post-training removal attacks such as continued fine-tuning, pruning, and distillation.
In briefRoboFake: Can Deepfake Detectors Spot Humanoid Face Robots?
SummaryHumanoid face robots can move their lips in sync with speech and show detailed expressions. If a real person's face is put on such a robot and driven by generated speech, it becomes a new presentation attack that talks and reacts on camera without any edited pixels. The authors test three public face presentation attack detectors and six public deepfake detectors, and suggest current models catch today's robots mainly because their faces do not look human, not because they recognize the attack.
WhyProposes a new presentation attack using humanoid face robots, evaluated across multiple detectors on physical and synthetic samples, though scale is limited.
In briefPhysical side-channel attacks that extract LLM outputs and prompts on edge devices
SummaryThis paper examines whether running a large language model locally on an edge device protects user privacy. The authors show that electromagnetic emissions recorded during inference on a Raspberry Pi 5 running LLaMA-3.2-1B-Instruct can leak generated tokens and user prompts. They describe three attacks, including keyword identification, token prediction over the full vocabulary, and hidden-state inversion to reconstruct prompts. The authors conclude that local execution alone may not guarantee confidentiality.
WhyNovel EM side-channel recovery of output tokens and prompts from edge LLMs; evaluation limited to one model and device.
In briefDetecting active label inference attacks in vertical federated learning by reading embedding asymmetry
SummaryThe paper studies the active label inference attack in vertical federated learning, in which a feature-holding party modifies its optimizer so its embeddings reveal class structure and recovers private labels. The authors show that the server can detect this attack from the embeddings it receives, since the adversary's class separability diverges from the honest party's within a few epochs. A defense triggered by this signal targets only the adversary and reduces label inference below honest-training leakage on CIFAR-10, CIFAR-100 and CINIC-10, at under two points of task-accuracy cost.
In briefPaper showing AI models can provably hide arbitrary capabilities
SummaryThis paper argues that capability evaluations relying on hidden capabilities being elicitable are unreliable under adversarial conditions. The authors embed encrypted neural networks in host model weights, executing them only when a secret trigger is received. Under cryptographic assumptions, they show these hidden circuits are provably hard to elicit or interpret. Experiments using a small chemical reaction prediction task as a proxy show resistance to fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training.
WhyExtends hidden backdoors from fixed strings to arbitrary computations with cryptographic guarantees; evidence is a small PyTorch proof-of-concept tested against several elicitation methods.
Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas et al.
In briefFlying, Not Floating: a precise fixed-point Falcon signer for microcontrollers, implementing the FN-DSA signature scheme with integer-based arithmetic
SummaryThis paper presents the first fixed-point FN-DSA (Falcon) signer for microcontrollers, using 32.64 fixed-point arithmetic in constant-time Cortex-M4 assembly for Falcon-512 and Falcon-1024. The authors keep reciprocals, inverse square roots and small constants at wide precision and round once at the point of use to restore accuracy lost in a naive fixed-point design. They report about 45% fewer cycles than double-precision emulation and measured precision supporting more queries per key than double precision.
In briefLearning Guided by Decisions to Manage Cyber-Physical Risk in Power Grids
SummaryThis paper proposes a framework that combines optimization and learning to detect intrusions in power grids while accounting for the operational effects of detection errors. It converts machine learning prediction errors into cyber-physical risk costs for grid operations and iterates to reduce those costs. Experiments on the ICS Cyber Attack and Sherlock datasets report improved power grid operation costs compared with the traditional approach.
Ayesha Siddiqua Dina, Ebisa D.Wollega, and Afzal Hossain Sohag
In briefDistinguishers for the Squeezing Stage of Alternating Sponge and Duet Hashing
SummaryThis cryptography preprint analyzes the mode of operation of Duet, a permutation-based hash function candidate inspired by the Alternating Sponge (ASP). The authors present a distinguisher against ASP and both a distinguisher and a state-recovery attack against Duet. They show Duet's multi-block output can be distinguished from random, which matters if it is used as an XOF or KDF, though collision and preimage resistance are not affected.
In briefMemory-Coupled Unlearning: forgetting identities without the original forget data
SummaryThis paper proposes Memory-Coupled Unlearning (MCU), which attaches a Modern Hopfield Network as a controllable external identity-prototype memory to a host model. On a forgetting request, MCU removes the target identity's prototype from this memory and then readapts the model using limited support information for those identities together with retained data. Experiments show a favorable empirical trade-off among utility, membership distinguishability, and request-time efficiency, though the work does not formally guarantee complete information removal.
