In briefPrivacy Risks in Federated Learning for OT Intrusion Detection, with an ML Plane Audit Framework
SummaryThis paper examines how federated learning used to train intrusion detection systems in Operational Technology environments can still leak sensitive information about industrial processes through model updates. The authors propose the ML Plane, an architectural abstraction that integrates federated learning workflows into OT systems so that learning-related information flows become visible. They outline a privacy auditing framework that uses Federated Membership Inference Attacks as an initial assessment method, which is being implemented in a Smart Grid testbed.
In briefBeyond User-Side Defenses: Protecting Images in Open-Weight Diffusion Models
SummaryThis paper examines how model providers can support image protection in open-weight diffusion models. It proposes four requirements: protection effectiveness, clean fidelity, compatibility, and tamper resistance. The authors add long-horizon attack simulations to test resistance to protection removal. Experiments with one protection tool show better resistance to re-alignment but lower clean fidelity, which motivates further research into practical model-side protection.
In briefUnsupervised Drift Monitoring for Deployed Deepfake Speech Detectors
SummaryDeepfake speech detectors are usually evaluated as binary classifiers on fixed benchmarks, yet deployed systems face changing attacks, codecs, speakers, and recording conditions without available labels. The paper proposes an unsupervised drift monitor that uses the internal embeddings of a deployed detector and compares inputs to bona fide and spoof references via regularized Mahalanobis distances. These distances define trusted, ambiguous, and novel regions, so unfamiliar inputs can be routed for review. Evaluated on four detectors and three datasets, the monitor flags dataset mismatches and substantially reduces accepted deepfakes, at the cost of lower automatic coverage.
Luk\'a\v{s} Proke\v{s}, Vojt\v{e}ch Stan\v{e}k, Anton Firc et al.
In briefStableJudge: A Lightweight Defense Against Prompt Injection in LLM-as-a-Judge
SummaryLarge language models are used as judges to assign scores, such as for paper review, but injected instructions in evaluated content can hijack these scores and distort rankings. StableJudge adds a compact 0.13B Sentry model that locates and sanitizes injected spans before evaluation, trained on adversarially evolving attacks. It also derives deterministic, fine-grained scores from the judge's output distribution. Tested on held-out scientific abstracts and out-of-distribution attacks, it improves score recovery under attack while largely preserving general performance.
SummaryAPN functions give optimal resistance to differential cryptanalysis in characteristic two, and finding new infinite families inequivalent to known ones is an important open problem. The paper introduces extended biprojective functions, built by adding truncated trace terms to biprojective polynomials, and establishes a new infinite family of quadratic APN functions. It also develops an efficient APN test based on binary matrix ranks and uses it in exhaustive searches up to dimension 28.
WhyIntroduces a new infinite family of quadratic APN functions, supported by exhaustive searches up to dimension 28 and differential spectrum comparisons.
In briefLogit leakage via floating-point bias addition in language model APIs
SummaryLanguage model APIs can reveal token-specific biases while hiding logits and probabilities. The paper shows that floating-point bias addition creates a numerical side channel that leaks a common additive component using only token identities. Under stated binary32 assumptions and a known score interval, the method recovers a logit pair and its tie-breaking priority in at most 52 token queries. Experiments cover 11 public checkpoints and the vLLM, SGLang, and llama.cpp systems, and subtracting the maximum before bias addition is shown to suppress the disclosure in controlled tests.
WhyFinds a floating-point bias-addition side channel recovering logit offsets from token identities alone, with experiments across multiple serving systems and models.
In briefPrivacyGuard: Source-linked sanitization and local PII references for cloud GUI agents
SummaryCloud GUI agents send instructions and screenshots to remote planners, which can expose personal identifiable information. PrivacyGuard introduces source-linked sanitization (SAN), which reconstructs fragmented evidence and rewrites the full source extent, and a reference lifecycle (REF) that links changed forms to session entities without sending raw values upstream. In five-turn sessions, it reduces audited source-value leakage by 33.55%–82.60% relative to the closest prior system, and raises cross-form continuity from 0.04 to 0.81. The authors report it also improves verified task completion on Android tasks while lowering upload exposure.
In briefDigital-twin-guided Q-learning to detect jammers and control mmWave beam power
SummaryThis paper proposes a belief-guided Q-learning (BGQL) method that uses a digital twin reference to jointly identify jammers and control beam power in a 28-GHz site-specific network simulation. Receiver-level residuals between attack-free and attacked configurations, together with candidate jamming footprints, form a normalized suspicion vector that feeds into the learning state, reward, and exploration rule. In 30 paired Monte Carlo runs against SARSA, Greedy, and Random, BGQL reports higher link-rate and rate-to-power scores and 100% localization recall for one jammer, though its runtime per run is considerably longer.
In briefModulus Operandi: one-round-optimal modulus conversion for MPC and threshold FHE
SummaryThis paper studies modulus conversion in secure multiparty computation, which converts a secret-shared value modulo q into a sharing modulo t without revealing the value. This step is useful for threshold decryption in lattice-based cryptosystems. The authors present three new protocols in the preprocessing model: a single-round protocol for arbitrary moduli, a cheaper-preprocessing variant with a stronger input bound, and a bound-free protocol that takes two rounds. They also give a one-round comparison protocol and prove that non-interactive modulus conversion is unreliable unless t divides q.
WhyPresents a single-round arbitrary-modulus conversion, a new one-round bitwise comparison, and a non-interactive impossibility proof, with clear relevance to threshold FHE decryption.
Ivan Damgård, Sebastian Hasler, Sebastian Kolby et al.
In briefOptimal threshold implementations for all bijective 4-bit S-boxes
SummaryThis paper studies threshold implementations (TIs), a side-channel countermeasure, for bijective 4-bit S-boxes common in lightweight ciphers. The authors present share-optimal, direct, one-stage, uniform first-order TIs and introduce new families, including the first infinite families of cryptographically nontrivial power permutations. They show that every 4-bit permutation of algebraic degree t admits a uniform TI with t+1 shares and no fresh randomness, disproving several earlier conjectures and claims.
WhyConstructs the first infinite families of optimal threshold implementations for power permutations and proves all 4-bit permutations admit t+1 share TIs, refuting prior conjectures.
Enrico Piccione, Yevhen Perehuda, Gregor Leander et al.
In briefCT0: A Small Transformer Specialized for Cybersecurity Tasks
SummaryThis paper introduces CT0, a cybersecurity-specialist Transformer architecture, and CT0-Micro, a compact model of about 4 billion parameters built on an open base model. The model is specialized through two-phase on-policy distillation on the Cybersecurity AI (CAI) dataset. One set of weights serves a fast single-pass decision mode and a tool-using agent mode, and the authors report results across eighteen benchmarks along with limitations.
In briefKey recovery against masked Kyber using belief propagation
SummaryThis paper attacks a first-order masked Kyber768 implementation on an ARM Cortex-M4 using about 2200 decapsulation power traces and only valid ciphertexts. A neural network estimates Hamming-weight distributions of the two shares, and a belief-propagation solver recovers all 1536 secret and error coefficients without lattice reduction. At 2000 traces, the hints lower the estimated BKZ block size from 624 to 505, which remains impractical for lattice attacks.
WhyCombines belief propagation with an Onsager correction to recover all key coefficients of first-order masked Kyber from about 2200 traces, a novel method with solid experimental support and significan
In briefCircuitBreak: Pruning a Sparse Neuron Circuit for Safety
SummaryThis paper proposes CircuitBreak, a neuron-pruning attack that greedily finds a small set of feed-forward neurons whose joint removal flips an LLM's refusal behavior. It needs no paired twin prompts and re-scores candidates after each removal. Across ten instruction-tuned models, the search converges after removing 29 to 150 neurons, raising attack success rates to roughly 88% as judged by Llama Guard 3 8B on StrongREJECT.
WhyModels refusal as a sparse neuron circuit with greedy joint pruning, a novel departure from per-neuron scoring. Ten-model results show large attack gains with tiny removals, giving strong evidence and
In briefPrivacy-protected preference alignment for language models using survey data
SummaryThis paper studies how to align language models with human preferences using questionnaire data from the World Values Survey while protecting privacy. The data contains sensitive topics such as politics, religion, and gender attitudes, and its supervision uses ordinal ratings. The authors show that aligned models are vulnerable, then frame the task as rating prediction with label-level differential privacy, comparing randomized response, the exponential mechanism, and DP-SGD. Experiments find that simple label-level mechanisms outperform gradient-level methods, and a suitable aggregation function during preprocessing also contributes substantially.
In briefRevisiting Fast Tendermint: a consensus violation and two fixes
SummaryThis paper shows that the published round-change rule of Fast Tendermint violates Agreement: one Byzantine process can cause a violation for every f≥1, and two can do so for f≥2 without double signing. The problem arises when a process skips a round without recording the value that may have been decided there. The accompanying Quint specification does not permit such skipping and is unaffected; the flaw is in the published pseudocode. Two repairs are proposed: Walk requires leaving a round only after a precommit quorum and precommitting before leaving, and Justify places the evidence needed to accept a proposal in the proposal itself. Both satisfy Agreement and Validity under asynchrony and Termination under partial synchrony.
In briefNot All Challenges Are Equal: Testing Liveness Gestures Against Real-Time Face Swaps
SummaryRemote identity checks assume a live person appears on camera, but public real-time face-swap tools can replace that person before the video reaches the verifier. The authors tested randomized gesture challenges in 108 live sessions using two face-swap tools, DeepFaceLive and FaceFusion. Pose and combined gestures scored highest, expression gestures showed no clear gain, and hand occlusion against FaceFusion performed below the static baseline. The authors conclude that challenge sets should be tested against current attack setups and that response time may add a deployment-specific signal.
Anton Firc, David Drtil, Martin Pere\v{s}\'ini et al.
In briefPurpose IR: Compiling User Purpose into Privacy Limits for Agent Memory
SummaryThis paper addresses the privacy problem of reusable state in LLM-agent workflows: an observation may be needed as task evidence without its full meaning being authorized to persist. The authors introduce Purpose IR, a bounded typed intermediate representation that compiles a user's natural-language purpose into an executable semantic boundary for reusable state. Evaluated on 1,200 cases across LangGraph, CrewAI, and MobileRun, and on 493 PrivacyLens trajectories, it reports gains in privacy-compliant success and safe action rate.
In briefPrivacy-protected synthetic road-network trajectories with risk-aware noise
SummaryThis paper presents TrajRACE, a framework that synthesizes road-network trajectories under local differential privacy, so raw trajectories never leave the user's device. It reports start points, segment counts, and transitions, perturbing each true next road segment among legal successors. Protection strength is assigned per transition based on local road-network and trajectory context. Experiments on three datasets show improved synthetic-data utility and stronger protection for high-risk transitions.
In briefLightweight remote attestation for smart meters using Merkle trees inside a Trusted Execution Environment
SummaryThis paper proposes a remote attestation method for smart meters that structures their communication data as a Merkle tree to verify data integrity and authenticity and detect unauthorized tampering. Building the Merkle root and hashing critical data run inside a Trusted Execution Environment implemented with OP-TEE. The authors report that compared with related work, the method offers better resource efficiency, security robustness, and feasibility on resource-constrained devices.
Amirhossein Shakiba, Hamid Reza Ghaeini, and Sadegh Dorri Nogoorani
In briefDoctor Trigger: release-bound face verification framework
SummaryThis paper presents Doctor Trigger, a framework for checking whether circulating face images match a publisher's enrolled release. Before publication, the publisher embeds a weak keyed Fourier-phase signal in each face and stores its spectral reference; verification compares the image with that reference and measures signal retention through key projection. Experiments on FF++, DFDC, and Celeb-DF show spectral agreement separates tested face swaps and generative manipulations from enrolled releases.
In briefATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking Against Protected LLMs
SummaryThis paper evaluates how well large language models resist jailbreak attacks when protected by prompt-based safety layers. It finds that adding such a protection lowers a strong multi-turn baseline's average attack success rate from 0.896 to 0.608, suggesting unprotected tests overstate real vulnerability. The authors propose ATTCK-R, a multi-turn red-teaming framework that plans long attack trajectories, curates reusable tactics, and resumes attacks from strategic states. It outperforms recent multi-turn jailbreaking methods across nine LLMs with a single prompt-based protection layer.
Md Mushfiqur Rahman, Tobias Rohde, Rahul Tripathi et al.
In briefA methodology for deriving security specifications for complex electronic systems
SummaryThis paper proposes a risk-based methodology for determining the security requirements of complex electronic systems. It lists system missions, deduces the assets each mission needs, analyzes threats to those assets, and derives security requirements that can then be matched with countermeasures. The approach is illustrated with datacenter and automotive chiplets across missions such as provisioning, trimming, debugging, booting, and remote attestation.
Sylvain Guilley, Ritu Ranjan Shrivstwa, Ville Yli-Mäyry
In briefML-assisted power side-channel attacks that reconstruct images from ML accelerators on shared FPGAs
SummaryThis paper studies how an attacker sharing an FPGA with a victim can use TDC sensors to measure the victim's ML accelerator power and recover its input images. By combining ML-based upscaling and recoloring, the authors report the first on-chip TDC attack producing full-color reconstructions of ImageNet-scale inputs. They also test a pixel-substitution defense, finding it costs the victim more accuracy than the attacker and is largely defeated by an attacker retrained on the transformed data.
In briefHDKEM: A Hybrid Key Exchange Scheme Allocating Authentication for Deniability
SummaryThis paper studies deniable authenticated key exchange, where two parties share a key without leaving transferable proof that they took part. It analyzes protocols that authenticate each session with one ring signature and proposes HDKEM, a three-slot hybrid combining ML-KEM-768, X25519, and an optional pairwise information-theoretic key source. Under the stated component models, the authors claim eCK key indistinguishability, forward secrecy, and strong local deniability. They also report performance measurements using FalconRS and Gandalf signatures.
Kazi Hassan Shakib, Muhammad Asfand Hafeez, and Arslan Munir
In briefConfidential Error-Correcting Codes: Reliable decoding that keeps messages secret
SummaryThis paper introduces Confidential Error-correcting Codes (CECs), a cryptographic primitive that allows reliable decoding from perturbed codewords while keeping the message confidential. The authors define three security properties (confidentiality, robustness, and soundness) and build a concrete instance, Conc-CEC, on a randomness-security separation framework. They also present CECMark, a watermarking scheme for AI-generated images, which the authors report outperforms prior methods across 56 perturbations with a false positive rate below 10^-5.
WhyProposes a new cryptographic primitive with provable security and experiments on 56 perturbations beating prior watermarking methods, impact centered on AI image watermarking.
In briefWhen Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
SummaryThis paper studies a privacy problem in multi-agent LLM systems, where information shared with one authorized agent can reach an unauthorized agent through routine coordination, without any compromise or malicious behavior. The authors evaluate 485 scenarios across three communication topologies and propose RECONS, a sanitizer that conditions on the recipient and execution context rather than sensitivity alone. RECONS reduces residual disclosure from 96.7% without sanitization to 29.25%, while preserving 94.1% of authorized disclosures.
WhyIdentifies topology-driven privacy leakage and proposes recipient-conditioned sanitization, validated across 485 scenarios, multiple models and frameworks, advancing multi-agent privacy defenses.
In briefTesting how robust camera-radar sensor fusion is for self-driving cars under attack
SummaryThis paper systematically measures how well camera-radar sensor fusion in autonomous driving holds up under adversarial attacks. The authors built an evaluation pipeline on the nuScenes dataset with eight camera-image and three radar point-cloud perturbations, testing five fusion algorithms on 3D object detection and depth estimation. Camera perturbations substantially degraded both tasks, while radar perturbations had smaller, task-dependent effects. The authors conclude that sensor fusion does not inherently guarantee robustness and suggest design directions for future systems.
In briefDelegateGuard: Purpose-Bound Runtime Permissions for Delegated LLM Agent Workflows
SummaryLLM agents that delegate subtasks while holding sensitive data risk data leaks or misuse if a delegate is compromised. The paper presents DelegateGuard, a reference monitor that turns the user's authorization into attenuable capabilities and mediates every data-moving action outside the model, with revocation cascading through the delegation graph. Evaluations report that it blocks unauthorized exfiltration, authority amplification, and revocation replay, with microsecond per-decision overhead.
In briefAutoSec-RAN: Fine-tuning an AI model on O-RAN standards for automated security analysis
SummaryThis paper presents AutoSec-RAN, a framework that fine-tunes Mistral-7B-Instruct with two LoRA stages on a corpus of 69 O-RAN, 3GPP, and related standards, with optional retrieval-augmented generation. The model answers investigator-style questions using only scenario metadata, without raw packet evidence. It was tested on a 5G/O-RAN testbed using labeled fronthaul distributed denial of service replay scenarios. The authors report strong results for mitigation and threat-model reasoning, and a measurable gap on the attack-direction class.
Anoop Mishra, Joshua Moore, Aly Sabri Abdalla et al.
In briefRevocation Is Not Complete at Receipt: An Executable Outcome Contract for Agent-Tool Gateways
SummaryThe paper argues that distributed agent workflows cache delegated authority at tool gateways, so a revocation confirmed by the issuer, transport, or receiver does not prove that every gateway enforced it or that guarded actions stopped. The authors define a bounded outcome contract, C0 to C5, and implement it as a persistent monitor. In experiments using Keycloak 26.7, transport and receiver persistence still succeeded under selective non-delivery, yet 112 of 225 calls were admitted and all of their effects committed. Transport success is therefore evidence of progress, not a verdict that revocation is complete.
In briefCreepScope: Measuring Authority Left Usable After Use in Tool-Using AI Agents
SummaryThe paper argues that checking authorization at each tool call does not show how long earlier permissions remain usable after they are needed, a problem it calls privilege creep. The authors propose CreepScope, an evaluation protocol that samples reachable authority at every step and measures overexposure and leftover privilege with several metrics. In a deterministic replay over 12 controlled workflows, persistent policies show clear overexposure, while the oracle-controlled Step Lease approach has zero by construction.
In briefExplainer: A paper on public key authenticated keyword search secure against chosen-ciphertext and trapdoor attacks
SummaryThis paper proposes a generic transformation that upgrades public-key authenticated encryption with keyword search (PAEKS) schemes to achieve CCTA security, meaning resistance to chosen-ciphertext and trapdoor attacks. The transformation is a variant of the CHK transformation and uses the receiver's identification of the sender in trapdoors so that keywords can serve as tags. The authors report the first fully CCTA-secure PAEKS schemes based on both pairings and lattices. They also note that verification keys embedded in ciphertexts and trapdoors allow sender-receiver matching without cryptographic computation, improving search efficiency.
In briefA paper on hardware-assisted, adaptive machine learning for detecting multi-stage ransomware
SummaryThis paper proposes a framework that combines software-level static scanning with hardware-level microprocessor activity monitoring to detect ransomware. The authors use adversarial training to resist obfuscation and neural architecture search to tailor models for better generalizability. Experiments reportedly show higher detection accuracy and lower latency than existing methods, along with trace-level interpretability.
Salma Aboelmagd, Md. Rakibul Ahasan, Zhixin Pan et al.
In briefAutomatically hardening verifiers in agent environments against reward hacking
SummaryThis paper presents a fully automatic method for strengthening the programmatic verifiers used to reward LLM agents, so that agents cannot earn full credit by cheating. It first builds an isolated verifier sandbox that agents cannot modify, then runs a hacker-fixer loop to find and repair remaining vulnerabilities. Applied to Terminal Bench, KernelBench, and SETA, the approach substantially reduces attack success, and more iterations yield stronger defenses than a static baseline.
In briefRecovering readable text from degraded Word document thumbnails using a text-aware U-Net
SummaryThe paper addresses the difficulty of running OCR on low-resolution Word thumbnails, which may be the only visual evidence of deleted documents. It proposes a U-Net restoration framework trained with a hybrid objective that combines pixel fidelity with machine-readable text constraints. Model selection uses an OCR-based Normalized Levenshtein Distance (NLD) to prioritize accurate character structure. Experiments report that the method significantly reduces NLD, enabling more reliable text recovery from severely degraded thumbnails.
In briefForensic analysis of HackRF One with Mayhem firmware
SummaryThis paper examines where forensically relevant data is stored on the microSD card of a HackRF One with a PortaPack running open-source Mayhem firmware v2.0.1, and how that data should be interpreted. The author analyzed an SD card image from their own device after four months of use, drawing conclusions from the image alone. According to the paper, the example image yielded recovery of part of a deleted IQ capture and a trimmed-away segment, and attributed six captures to one rolling-code OOK transmitter.
In briefRetryBench: Separating Retry Permission from Recovery Outcomes in GPT Tool Use
SummaryThis paper introduces false retry permission (FRP), where an agent retries a timed-out tool call without support from the visible contract. Controlled experiments show that successful protected recovery does not guarantee reliable rejection of unsupported retries, so the authors recommend reporting permission and recovery together. The findings cover four tasks, fixed GPT endpoints, and one recovery decision, and do not identify internal mechanisms or episode-level safety.
In briefHidden text the model ignores: covert, provable invisibility in LLMs
SummaryThe paper studies how text wrapped in a trigger can be made invisible to a language model, so it is omitted from summaries and ignored in question answering. The authors treat this as a dual-use information-flow mechanism, a supply-chain backdoor, and a white-box auditing problem. They verify the underlying noninterference property across ten models and report that distilled weight-level backdoors can hide marked context at little benchmark cost. They do not establish that the tradeoff between probe visibility and routing visibility is fundamental.
WhyIntroduces provable text invisibility and a covert backdoor, supported by noninterference checks across ten models and white-box probe analysis.
In briefGenerative AI for automated testing of Open RAN systems: the GNG-OTA framework
SummaryOpen RAN (O-RAN) uses a disaggregated, interoperable architecture, but complex testing environments and evolving specifications make interoperability hard to ensure. This paper proposes GNG-OTA, a framework based on generative AI and graph neural networks for O-RAN testing and automation. It combines generative AI, natural language processing, and graph neural networks to automate interoperability and performance testing.
In briefPenetrating the Reality Wall: Long-Range Through-Wall AR/VR Privacy Eavesdropping via Wireless Power Side Channel
SummaryThis paper examines a power side channel in AR/VR network connections, capturing wireless power in Wi-Fi signals through a wall from 5.0 to 8.0 meters away without intrusion. The authors propose MetaSpy, which identifies the device type and infers user activities such as web browsing, app use, in-game VR actions, avatar-based re-identification, and virtual keystrokes tied to head movements. Evaluations on four commercial VR headsets show competitive accuracy, and the paper also proposes countermeasures to protect data confidentiality in AR/VR wireless transmission.
WhyIntroduces a through-wall wireless power side channel attack on AR/VR privacy at longer range, with novel virtual keystroke inference, though evaluation scope is limited.
In briefPrivacy Conductor: enforcing contextual integrity in LLM document retrieval through architecture
SummaryThe paper presents Privacy Conductor, an architecture in which a deterministic gate enforces an authority-written policy, so the model only receives documents the requester may already see. On a synthetic clinical corpus of 2,520 requester-document flows, the gate reproduces its policy exactly, leaving the remaining risk in the document labels it reads. Comparing LLM-generated and human labels across seven configurations, the authors find that LLM-written labels degrade the policy in every case.
WhyProposes a deterministic out-of-model gate for privacy policy; evaluates LLM labels on clinical corpus and HIPAA cases, showing substantial failures, a broadly relevant finding.
Ryan Thornton, Mir Mehedi A. Pritom, Maanak Gupta et al.
In briefA compiler that builds dynamic SNARKs from static ones, for fast proof updates
SummaryThis paper presents a compiler that builds a dynamic SNARK for Plonkish constraints using a static SNARK for NP and a vector commitment scheme as black boxes. Dynamic SNARKs let a prover update an existing proof in time related to how much the witness changed, rather than regenerating it fully. With a hash-based SNARK and Merkle trees, the authors claim post-quantum security in the QROM and a transparent setup. Their Ligerito-based implementation reports prover speedups of 147x and 11.7x over a static HyperPlonk baseline for 10,000 single-gate and 1,000 128-gate updates on a 2^23-gate circuit.
In briefLLM-based code auditing that infers and tests developers' security assumptions
SummaryThe paper presents Creed, a method that infers a developer's security-related beliefs from a function, assesses how reasonable each belief is, and derives when it is violated. Unlike syntactic static analysis tools, it aims to detect semantic flaws such as a timing side channel revealed when response times differ for valid and invalid usernames. The approach explains each vulnerability's root cause, symptoms, and exploitability conditions. The authors also introduce recall and overhead measures for explanation-based vulnerability detection, reporting better effectiveness-effort trade-offs than existing tools on a real-world benchmark.
In briefSkillMarker: A KGW-based watermarking method for verifying ownership of agent skills
SummaryAgent skills are shared as plaintext, which makes them vulnerable to unauthorized copying and leakage, and practical ownership verification and leakage tracing tools are limited. The paper proposes SkillMarker, a KGW-based watermarking method that combines quality-constrained rewriting with signal-oriented candidate search to keep instructions accurate while strengthening the watermark, and releases an open-source toolkit for embedding, auditing, and detection. In the reported experiments, the method has a negligible average effect on downstream task performance, window-based detection identifies copied passages of as few as 1,536 consecutive tokens, and detection rates remain 72.2–77.8% after merging with one or three background skills.
In briefTo Cache or Not to Cache: Safety Risks of Reusing KV Caches Across Models, and a Fix
SummaryThis paper studies the safety risks of sharing key-value (KV) caches between a sender model and a receiver model to speed up processing. The authors find that the safety deviations depend on the model pair and reuse setup, and that reusing values causes much larger deviations than reusing keys. They propose VReparo, which learns offline affine maps to align reused value tensors with the receiver's own. It lowers average HarmBench attack success rate from 57.28% to 39.21% and average StrongREJECT score from 0.4215 to 0.2163, while keeping an 85.62% average reduction in time to first token.
