In briefRobust detection of directional adversarial attacks on deep neural networks for radiological images
SummaryThis paper proposes a detection framework that uses follow-up attacks with random noise to identify adversarial perturbations in medical images. It analyzes variations in the Sigmoid function to separate genuine scans from manipulated ones. Evaluated on chest X-ray, retinal fundus, and brain tumor datasets, the method reports up to 99.8% accuracy in identifying directional adversarial attacks with low false positives.
In briefRiemannian Transform Curbs Cross-Session Identity Leakage in Motor-Imagery EEG
SummaryMotor-imagery EEG recordings carry subject-identifying structure that persists across sessions, so sessions from the same person can be linked. This paper proposes a Riemannian transform that works directly on covariance representations by equalizing subject-conditioned geometric statistics, without learning a privacy model. Across two public datasets, the worst-case attacker's identification rate drops substantially, with a moderate loss in motor-imagery decoding accuracy.
In brief"Fetch Me If You Can": A Broad Study of Fetch Metadata Security Headers
SummaryThis paper is a large-scale measurement study of Fetch Metadata, a 2019 mechanism that adds HTTP headers to browser requests so servers can judge request context. The authors analyze the Tranco top 1M websites to find deployed isolation policies, including custom ones, and assess how well they cover cross-site threats. The paper also systematically compares Fetch Metadata with existing client-side mechanisms and identifies security gaps arising from differences between client-side and server-side enforcement.
Pedro Bernardo, Alex Ploner, Marco Squarcina et al.
In briefPoisoned Context Attacks on Constrained AI Decision Workflows
SummaryThis paper studies context poisoning in typed decision interfaces, where models choose only from predefined actions but can still trigger policy-violating state changes. The authors propose an execution-aware protocol that traces poisoned evidence from retrieval through model choice, automated action, and persisted state. They ran 1,659 calls across 20 development tasks in two synthetic workflows, finding that a source-exclusion defense blocks observed violations but also withholds correct automated decisions. Several prespecified contrasts are not statistically supported after correction, so the results are exploratory.
In briefTracking Content Sources for Safer Android Agent Actions
SummaryThe paper observes that Android agents cannot reliably tell which application or document supplied the content they read, which matters when they act with the user's authority. The authors build and separately evaluate two prototypes: an application-source monitor that withholds side-effecting calls tied to untrusted sources, and a WebView source-reference gate that checks object origins using records from a modified browser. The results indicate which source information the tested policies need and why it must remain linked to the object used in execution.
In briefExtending Schur–Macaulay attacks on UOV with truncated polynomial algebras
SummaryThe paper builds on the wedge-attack framework of Ding, Li, and Tao and restates the Schur–Macaulay matrix approach of Merz and Ran in polynomial terms. It uses truncated polynomial algebras over positive-characteristic fields to cover Unbalanced Oil and Vinegar (UOV) over arbitrary finite fields. Divided powers and transfer relations add public relations, yielding quotient-dimension criteria for recovering graded parts of the hidden oil-space ideal. The authors apply this to third-round QR-UOV parameter sets and obtain lower estimates of attack complexity for some of them.
In briefSecurity Risks of LLM-Assisted Coding: A Systematic Review
SummaryThis systematic review examines security risks in coding automation with large language models, along with benchmark limitations and the role of human developers. It finds that models often generate insecure code and faulty patches due to training data biases, and that the models themselves can be directly attacked. Current evaluations suffer from data contamination and lack robust security metrics, so human oversight remains essential.
Liang Yuan, Maryam Khanian Najafabadi, Mashud Rana et al.
In briefWorst-case hardness of succinct and decomposed LWE
SummaryThis paper studies two recently introduced lattice variants of LWE, succinct LWE and decomposed LWE, which underpin several cryptographic primitives but previously lacked a reduction to standard LWE. The authors introduce SuperSVP and give a worst-case-to-average-case reduction from it to succinct SIS, which, combined with a quantum reduction and a search-to-decision reduction, establishes worst-case hardness for succinct LWE. They also show succinct and decomposed LWE are equivalent, extending the same theoretical foundation to decomposed LWE.
WhyIntroduces SuperSVP and reduces it to succinct SIS, giving first worst-case hardness grounding for succinct and decomposed LWE.
In briefExtracting Training Data from a Genomic Language Model
SummaryThis paper studies whether the Evo 2 7B genomic language model leaks sequences from its training data through its generation interface. The authors use an output-only black-box attack that selects convergent groups of repeated generations without gradients or access to the training corpus. Across 304 runs, 85 of 888 candidate clusters matched training segments of at least 500 bp, a cluster-level success rate of 9.57%, with 22 uniquely matched extraction events at the 500 bp threshold.
In briefSecurity Risks of Edge-Deployed Audio LLM Agents: From Sound to Physical Action
SummaryThis survey examines security risks in audio large language model (Audio LLM) agents deployed on edge devices such as smart homes, vehicles, wearables, and embodied systems. It introduces an Acoustic Sensing-to-Action (S2A) model that traces how acoustic inputs move from sensing to external execution, accounting for edge-cloud runtime and lifecycle changes. The authors synthesize attacks, defenses, and evaluation methods, finding that security gaps can arise within components and at stage transitions, so end-to-end security evaluation is needed.
In briefAccuracy and Uncertainty in Machine Deception Detection (Research White Paper)
SummaryThis white paper proposes the Machine Deception Detector, which reads a language model's internal activations to catch deceptive responses that appear honest. It reads every layer, learns which tokens signal deception using only response labels, and calibrates its alarm threshold to keep the false-positive rate below a set level. An ensemble of detectors measures each score's uncertainty and raises an alarm only when its members agree. The evaluation tests on five unseen deceptive tasks across Qwen3 models from 0.6B to 32B parameters.
In briefAsymptotic size of enumeration trees on random lattices, improving on HKZ bases via dense sublattices
SummaryThis paper studies how large unpruned lattice enumeration trees are on random n-dimensional lattices, and how the tree-size exponent c depends on the chosen basis. For quasi-HKZ bases it proves c = 1/(2e), matching the worst-case enumeration exponent. It further shows that with high probability the best achievable exponent over all bases lies between about 0.1464 and 0.1474. The authors also use the resulting two-block construction, together with a collision search, to obtain a polynomial-space CVPP algorithm on random lattices.
WhyUses Kim's mean-value formula to rigorously bound random-lattice enumeration exponents and a two-block construction, improving prior heuristic bounds substantially.
In briefA faster way to build CCA-secure key encapsulation using encrypt-then-MAC
SummaryThis paper studies a faster alternative to the Fujisaki-Okamoto transformation used in ML-KEM, the lattice-based key encapsulation standard in NIST FIPS 203, whose decapsulation is slowed by re-encryption. The authors propose a generic 'encrypt-then-MAC' transformation that applies the random oracle only to the short plaintext and authenticates the long ciphertext with a MAC, and they define a finer security notion, IND-qCCA. They present ML-KEM-EtM and McElieceEtM as instantiations. According to the abstract, ML-KEM-EtM adds only a minimal cost to encapsulation and ciphertext size while substantially reducing decapsulation CPU cycles.
In briefHow Depth-Based Dynamic Inference Affects Jailbreak Vulnerability in LLMs
SummaryThis paper studies how depth-based dynamic inference, which generates outputs from intermediate layers of large language models, affects their robustness to jailbreak attacks. The authors find that shallow exits are consistently more robust than deeper ones, and that exit depth influences how easily adversarial suffixes can be optimized, with deeper exits reaching lower attack loss. They also observe that adversarial suffixes affect utility uniformly across exit depths. The findings aim to inform the design of dynamic inference methods that are more resistant to jailbreak attacks.
In briefNobody Will Read the Lean: Why Cryptography Needs High-Level Languages
SummaryThis IACR ePrint paper argues that as AI produces machine-checked cryptographic proofs, the scarce resource becomes people who can read what those proofs actually state. The author proposes high-level cryptographic languages where protocol owners write short, readable models, every claim rests on a checked theorem, and protocol goals like forward secrecy have publicly agreed, versioned definitions built in. It cites examples where a checked Lean theorem promised nothing, and where a one-page Verifpal model's verdicts change under other standard definitions.
In briefEffectiveness of Coarse NetFlow Data in Deanonymizing Tor Onion Services
SummaryThis paper examines whether coarse NetFlow-style traffic counts, such as one-minute samples of one-in-a-thousand packets, can deanonymize Tor onion services. Large-scale experiments on live Tor data show that when an adversary can induce recognizable traffic patterns through controlled downloads, such coarse telemetry suffices to identify a target. The authors also propose a stronger active attack using controlled introduction requests and a passive attack that sends no traffic to the target, instead using Tor's public puzzle difficulty as a side channel. The authors conclude that coarse network data is a practical threat today and call for mitigations and a redesign of globally visible defense signals that may leak service-load information.
WhyNovel use of only coarse NetFlow telemetry and public puzzle difficulty as a zero-traffic passive side channel; live Tor experiments support it, though comparison details are limited.
In briefStaggered instruction-fetch duplication: a light hardware defense against fault-injection attacks
SummaryThis paper proposes Staggered Instruction-Fetch Duplication (SIFD), a processor-level countermeasure that fetches each instruction twice in consecutive cycles to detect inconsistent fetch results. It avoids full processor duplication, compiler support, or cryptographic hardware. Implemented on a custom RV32I processor on an Artix-7 FPGA, SIFD was tested with clock and electromagnetic fault injection, lowering attack success rates at the cost of added area and execution time.
In brief"Only What You've Signed up For": Secure Workflows with Constrained Diffusion Agents
SummaryThis paper addresses the vulnerability of agentic AI systems to prompt injection attacks. It proposes CoDA (Policy-Constrained Diffusion Agents), which enforces task-specific security policies inside the denoising process of diffusion language models by projecting token distributions onto policy-compliant sets at each step. The authors evaluate CoDA across several diffusion language model families under static and adaptive attacks. They report substantially lower attack success rates with competitive task utility and practical inference overhead.
In briefCan a life-protecting AI agent be tricked into lethal shutdowns? Delayed injection tests in simulated lunar habitats
SummaryThe paper tests whether a tool-using AI agent whose only duty is to keep crew alive, and which controls a simulated lunar habitat's life-support systems, can be pushed by delayed prompt injection into shutting them down. The attacker can only persuade the agent, not alter sensors or equipment, and the attack must persist while the crew suffocates. Results differ across model families and across how the injected messages are framed, such as a trusted commission, peer communication, or untrusted source. The experiment code and traces are open-sourced.
In briefAgent Approves Unauthorized Access: Injected Page Text Tricks Browser Agents Into Granting Access
SummaryThe paper studies how a browser agent working in a user's signed-in session can be manipulated by hidden text on a web page into approving third-party access to the account or registering an unwanted webhook. Testing two authorization surfaces, an OAuth-style grant and a webhook registration, the authors found that without a defense the unauthorized action completed in all 73 attack runs. They propose a service-side authority envelope gate that accepts requests only when they match the client, account, or webhook URL fixed by the user's task, and report that it blocked all 70 attack runs.
WhyExtends confused-deputy attacks on browser agents to OAuth grants and webhooks, proposing a server-side envelope gate; 73 and 70 attack runs give solid but limited evidence.
In briefAuthority-Set Integrity: Keeping Approvals Valid When Other Files Change
SummaryThe paper observes that deployment and coding-agent approvals usually bind only one file, while the run also reads other repository files whose edits can pass approval checks unnoticed. In 20 public repositories, 54.6% of commits changing files that runs read left the approved file untouched. The authors define authority-set integrity, requiring an approval to bind every file the authorized run reads and no others, and suggest the checker compute the digest itself using a verifiable source for the file set.
In briefFaster Vectorized MQOM Signatures on SIMD Hardware
SummaryThis paper presents a vectorized implementation of MQOM v2.1, a post-quantum digital signature scheme, using a transpose-enabled paired-matrix technique to reduce wasted SIMD work and memory traffic. The authors evaluate key generation, signing, verification, and memory use on Arm NEON, x86 AVX2, and x86 AVX-512. Peak dynamic memory decreases by up to 39.43%. Supplementary experiments apply the matrix-layout optimization to MQOM v3, the Round-3 code.
David Santos, Julio López, Francisco Rodríguez-Henríquez
In briefGAMW: A generation-aware mel-domain watermark for tracing TTS speech
SummaryThis paper proposes GAMW, a watermarking framework that embeds information into speech during text-to-speech generation rather than after waveform synthesis. It inserts a content-adaptive multi-bit watermark residual into the generated representation before waveform synthesis. With a 16-bit payload, GAMW improves decoding accuracy over the strongest baseline by 9.2 and 23.5 percentage points under individual and compound perturbations, while keeping speech quality competitive.
