In briefQuantum-computational key distribution with fewer assumptions (short paper)
SummaryThis paper revisits the HM-QCT quantum key distribution protocol from 2025, which relies on a hybrid quantum-computational time-lock model with two assumptions about the attacker. The authors examine two harvest-now-decrypt-later attacks, one using quantum memory and one using classical memory, and show how each is excluded by one assumption. They introduce HM-PRF, a variant that replaces short-term encryption with a locally evaluated pseudorandom function, requiring only the existence of one-way functions.
In briefKairos: Transactional security enforcement at the system boundary for LLM agents
SummaryKairos is a reference monitor placed at the isolation boundary of an unmodified LLM agent, treating tool calls, shell commands, and agent-written scripts as the same file and network operations. A declarative policy of trusted sources decides most effects deterministically and defers the rest while the agent continues speculatively. A bounded-authority oracle, such as a language model or a human, then releases or refuses deferred effects based on the trace. On AgentDojo, the paper reports attack success falling from 47.0% to 2.7% with benign utility comparable to the undefended agent.
Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro et al.
In briefFedGraph: Graph-based aggregation to defend federated LLM fine-tuning against backdoor attacks
SummaryThis paper addresses backdoor attacks in federated fine-tuning of large language models, where malicious clients manipulate updates while behaving normally on benign inputs. It observes that malicious clients' updates are highly consistent, unlike the more dispersed updates of benign clients, and proposes FedGraph, which models clients as graph nodes and uses structural features to suppress malicious contributions during aggregation. Experiments report attack success rates below 10%, 95.5% average detection accuracy, and a 2.33% false positive rate.
In briefTanchun: Robust flow-based HTTP(S) DDoS detection guided by behavioral attributes
SummaryThis paper presents Tanchun, a system for detecting HTTP(S) DDoS attacks using only decryption-free flow data. It groups flows by IP pair across consecutive time slots into behavior sequences, then abstracts them into interpretable behavioral attributes to guide representation learning under traffic drift. The authors report an average F1-score of 0.988 and gains of 5.3% and 9.6% over the second-best method under benign and attack traffic drift. Experiments on real-world traces are also reported.
In briefHULK: A fast method for bitwise operations on encrypted data
SummaryMany cloud applications, such as database, graph, and genome analysis, spend much of their time on bulk bitwise operations like AND, OR, and XOR, often on sensitive data. This paper proposes HULK, an algorithm for homomorphic encryption that computes the Hamming weight of encrypted bits using low-cost additions instead of costly multiplications, then decodes the AND, OR, or XOR result with one indicator polynomial. Across 13 end-to-end applications, the authors report speedups over prior arithmetic approaches on both CPU and GPU.
Mayank Kabra, Phillip Widdowson, Harshita Gupta et al.
In briefAttack That Reassigns LLM Watermark Account IDs Without the Secret Key
SummaryThis paper presents a "targeted displacement" attack that alters the message embedded in multi-bit LLM watermarks, such as an account identifier, so it points to a different account, without access to the secret watermarking key. The attacker needs only a few accounts and model logits, and rewrites the text while preserving its meaning. The authors derive theoretical upper and lower bounds on attack success, which depend on the number of accounts, message length, and text characteristics. Experiments across five watermarking methods and four LLMs show high success rates when enough accounts are available.
WhyFirst targeted displacement attack on multi-bit LLM watermarks with proven bounds; validated across five methods and four LLMs, threatening traceability.
Pawe{\l} Batorski, Przemys{\l}aw Spurek, Paul Swoboda
In briefJev-Guard: Fast Routing and Auditing of Agent Actions Using Editable Policy Trees
SummaryThe paper presents Jev-Guard, a unified model that performs both safety classification and policy routing for AI agents, using a policy tree covering content moderation, cybersecurity, privacy, and legal compliance. It first selects the applicable audit policy from the tree and then classifies safety conditioned on that policy. On 7,033 evaluation cases it reports 93.72% safety accuracy, 58ms mean latency, and 93.10% hierarchical routing accuracy.
In briefBALLAST: Physics-aware moving target defense for industrial control systems using a digital twin safety oracle
SummaryIndustrial control systems use static network configurations, giving attackers time to map the plant. Most moving target defense schemes do not check whether network reconfiguration disturbs the physical process being protected. This paper presents BALLAST, which places a learned digital twin between the security policy and the plant as a safety oracle. On the SWaT water treatment testbed, it cut reconnaissance success by 85 percent and recorded no safety violations across 50 runs.
Oscar Mogollon-Gutierrez, Mohammadhossein Homaei, Alberto Lopez-Trigo et al.
In briefLeakage-Resilient Incompressible Cryptography: Constructions and Barriers
SummaryThis paper introduces a new security model, leakage-resilient incompressible cryptography, combining protection against partial key leakage and against full key leakage with partial ciphertext or signature exposure. The authors give constructions, including an information-theoretic symmetric-key scheme, a public-key encryption scheme, and a signature scheme in the random oracle model. They also show that certain parameter improvements cannot be achieved through black-box reductions.
WhyIntroduces a unified security model with new constructions and blackbox impossibility results; novel and rigorous, though impact is largely confined to theoretical cryptography.
KAARTIK BHUSHAN, Rishab Goyal, Venkata Koppula et al.
In briefEncrypted AI agent skills can carry hidden attacks if agents decode them
SummaryThis paper introduces Ciphered Skill Injection (CSI), a method that hides malicious instructions in encoded form inside skill files so that LLM agents decode and follow them. Testing Caesar and layered cipher variants across eight models and 139 injection-task pairs, the authors report attack success rates of up to 47.5% and 40.3% in the primary shortened-skill setting. They find that successful decoding does not always lead to a successful attack, and that the skill scanners tested rarely flag injected skills.
In briefAn early study on body-based speech markers for spotting deepfake audio
SummaryCommon deepfake speech detectors focus on synthesis artifacts and often perform worse on unseen attacks or recording conditions. This study tests whether inconsistencies in physiological markers of breathing, voicing, and timing can reveal fake speech, using 36 handcrafted markers evaluated with logistic regression and SVM classifiers. The best in-domain system reached a 21.40% equal error rate, while logistic regression reached 32.77% on an out-of-domain dataset pair. The authors present these results as initial evidence that such markers provide a useful, interpretable detection signal.
Vojt\v{e}ch Stan\v{e}k, Michal Fri\v{c}, Kamil Malinka et al.
In briefCompanionSafe: From Multi-turn Safety Evaluation to AI Companion Guardrails
SummaryThis paper presents CompanionSafe, a framework for evaluating and mitigating safety risks in AI companions. Its CompanionEval component builds 1,300 relationally grounded settings across four turn tiers, using diverse personas, matched companion characters, and dialogue scenarios for scalable multi-turn testing. The CompanionGuard component turns failures exposed in evaluation into turn-localized training supervision for detecting companion-specific risks. The results show that strong LLMs and existing guard models remain vulnerable to relational harms, and that safety risks increase as conversations get longer in both closed- and open-source models.
In briefKey recovery attacks on Trivium using cube attacks with elimination strategy
SummaryThis paper introduces a new framework for cube attacks, called cube attacks with elimination strategy, which finds key conditions and cubes whose conditional superpolies can be computed efficiently to solve equation systems and recover key information. Applied to Trivium, it gives a practical key recovery attack on 840 rounds with complexity below 2^55 and a 77.8% success rate, and a practical attack on 845 rounds with complexity below 2^56. It also presents a theoretical weak-key recovery attack on 855 rounds for 2^74 keys. The authors state these are the best practical and theoretical attacks on Trivium to their knowledge.
WhyProposes a novel cube attack framework; extends practical Trivium attacks by 13 rounds with substantial experiments, though impact remains within cryptanalysis.
In briefPrivacy-preserving GNN inference on transaction graphs using homomorphic encryption
SummaryThis paper proposes a framework for anti-money laundering in which banks keep transaction features encrypted under the CKKS homomorphic encryption scheme, while a server runs graph neural network inference on the ciphertexts without seeing plaintext data or predictions. An edge-centric GNN design expresses message passing through node-edge incidence matrix operations, and nonlinear activations are approximated by composite polynomials of the sign function. On the IBM AML benchmark, the model is reported to perform competitively with plaintext baselines, classifying each transaction in as little as 5.31 seconds on a consumer-grade GPU, or 1.65 seconds amortized when optimized for throughput.
H. \c{C}a\u{g}r{\i} Bilgi, Kemal Mutluergil, Ceren Y{\i}ld{\i}r{\i}m et al.
In briefLow-cost privacy enforcement for email-writing LLM agents facing strategic information requests
SummaryThe paper addresses LLM agents that draft and send emails on a user's behalf, where checker-repair defenses rely on repeated calls to remote models, raising both cost and privacy concerns. It proposes intercepting outgoing drafts, building an information-release contract, and rewriting them with a local Gemma model, invoking a final PrivacyChecker only selectively. Experiments report reduced leakage and higher usable-output rates under normal prompts, and lower leakage and checker-only cost amplification under strategic attack prompts.
In brief"Standing, Not Truth": Who May Say What About Whom in Agent Selection
SummaryThis arXiv paper (cs.CR) examines how a publisher, using its own identity and without compromising any channel, can sway an agent choosing among competing offerings with a single false factual claim about a competitor. The authors report that twelve published defenses cannot distinguish this attack from marketing. They propose a "standing" check that asks whether a claimant's identity entitles it to assert about a subject, which can be decided without determining whether the claim is true.
WhyProposes standing rather than truth as the criterion for competitor claims, validated by gating experiments, though the evaluation scope is limited.
In briefTracking Where Information Comes From and Who Approved It in Life-Story AI Models
SummaryThis paper studies how language models built from personal archives can confuse observations, quotations, and earlier model outputs with actual consent or authorized decision rules. The authors propose typed records, authenticated attestations, and a separate policy channel, and give formal arguments under stated assumptions. A reproducible pilot uses a frozen public model on 32 wholly synthetic cases across 576 conditions to compare approaches. The work concerns computational attribution and authorization, not the motives or psychology of people in the vignette.
In briefProof that the maximum nonlinearity of 8-variable balanced Boolean functions is 116
SummaryThe paper addresses a long-standing open question in Boolean functions: whether an 8-variable balanced Boolean function with nonlinearity 118 exists. The authors answer no and prove that the maximum nonlinearity is 116.
WhyResolves a long-standing open problem by proving the maximum nonlinearity of 8-variable balanced functions is 116, via a rigorous reduction.
In briefProtoArena: Can AI Agents Find and Exploit Cross-Component Protocol Flaws?
SummaryThis paper introduces ProtoArena, a benchmark of 80 cross-component vulnerability-exploitation environments across 11 protocol and application domains and 7 attack categories, for testing LLM agents in black-box settings. Agents achieved verifiable exploitation effects in some environments, with Claude Opus 4.8 reaching 48.8% success under guided conditions and 12.5% under effect-directed black-box conditions. Success with limited black-box information remained low and varied by domain and attack category. All experiments used controlled, explicitly authorized targets.
In briefSame Attack, Different Judge: First Controlled Adversarial Comparison of Safety Judges
SummaryThis paper presents the first controlled adversarial evaluation of Jev, TypeSafe AI's safety judge that returns probabilities for predefined questions. The authors send identical payloads under the same policy to Jev, five GPT and GLM judges, and two local classifiers across four tasks and fifty attack variants. Jev is most robust on input moderation but more exposed on phishing detection, where it also flags many benign requests.
In briefSkillScreen: High-Recall Screening of Malicious Agent Skills
SummaryThe paper introduces SkillScreen, a compact decision model that scores how malicious an agent skill is directly from its SKILL.md file in one forward pass. On MaliciousSkillBench, it reaches 99% recall on unseen attack families while flagging 20-25% of benign skills, fewer than the word-level classifier and prompted LLM judges tested. However, false positives rise sharply on unfamiliar benign sources.
In briefRethinking how input sequences are built for Transformer-based network intrusion detection
SummaryThe paper argues that Transformer-based intrusion detection often uses fixed time windows that split related attack activity. It proposes building sequences from communication sessions instead, which more than doubles Macro-F1 over timestamp windowing and reaches up to 0.95 with lightweight models. The authors find that larger Transformers give no measurable accuracy gain, so preserving session semantics matters more than model scale.
Zeeshan Zulkifl Shah, Muhammad Ikram, Dali Kaafar et al.
In briefShamir Secret Sharing Leakage Resilience Below Half Threshold
SummaryThis paper studies how well Shamir secret sharing withstands an adversary who leaks a bounded number of bits from every share. It shows that for a threshold below half the parties, sharing resists arbitrary one-bit leakage from each share, and that at threshold (1/2+δ)n it resists about (δ/24)log₂n bits of arbitrary local leakage, which is optimal up to a constant factor. The authors also give results for constant-rate thresholds, including resilience to quadratic-residue leakage.
WhyUnified analytic framework lowers Shamir sharing's leakage-resilience threshold from 0.668n to below n/2, with near-optimal bit bounds proven rigorously.
In briefCausal awareness in encrypted group chats: helping users see the order and concurrency of messages
SummaryThis paper studies how group chat users can tell whether messages were sent in a clear order or concurrently, a relationship most encrypted messengers do not show. The authors define causal awareness, the ability of a receiver to reconstruct part of the context in which an accepted message was sent. They develop correctness and security definitions, give baseline constructions, and introduce checkpoint-aided and server-aided variants with proofs that the notions imply causal awareness.
WhyFormalizes causal awareness for group chats with parameterized correctness and security notions, proving properties of baseline and checkpoint/server-aided constructions.
In briefExtending Layered Attestation into ARM Application Run-Times
SummaryThis paper presents ARA, an Application-Runtime Anchor for ARM that extends the load-time chain of trust into application execution. It uses the newly introduced ARM Permission Overlay Extensions (POE) to create a protected run-time domain inside the application's address space, which can host programmable measurement and storage roots of trust. The authors demonstrate ARA with protected media decryption and control flow measurement, reporting roughly 10x to 50x lower overhead than out-of-process alternatives.
Antonio Joia Neto, Bilel Sefsaf, Norrathep Rattanavipanon et al.
In briefMaster-key recovery from internal activations in ReLU versions of Camellia
SummaryThis paper examines whether ReLU-network implementations of Camellia-128, -192, and -256 behave correctly and whether the master key can be rebuilt from key-schedule relationships. The authors report known-answer-test agreement for Camellia-128 and exact key recovery in all 3,000 trials under a synthetic internal-oracle access model. The results apply only to these stated internal-access assumptions and do not show a plaintext/ciphertext-only attack on standard Camellia.
In briefSecure Sorting and Its Use in Privacy-Preserving Graph Pattern Matching
SummaryThis paper extensively compares two fully secure multi-party sorting implementations, based on Quicksort and radix sort, under both honest- and dishonest-majority settings. It then applies secure sorting to improve sparse matrix multiplication, producing outputs in the same format as inputs so that graph adjacency matrices can be repeatedly multiplied. This allows detection of cycles and scatter-gather patterns, which are associated with money laundering, making the approach applicable to privacy-preserving anti-money laundering detection.
In briefDiscovery or Memorization? A Faithful Benchmark for Real-World Business-Logic Vulnerability Discovery
SummaryThis paper introduces AnonVul, a benchmark of 132 application-level business-logic vulnerabilities across nine languages, with anonymized tasks to reduce data contamination. The authors evaluate six state-of-the-art vulnerability-discovery agents, and the best one succeeds in only 23.11% of attempts. On a matched set of 20 vulnerabilities, restoring software identity raises success from 21.25% to 40.83%, showing the need to control recognizable software knowledge in evaluations.
In briefEnhanced Detective: A two-stage defense against internal poisoning in federated financial fraud detection
SummaryThis paper proposes Enhanced Detective, a two-stage robust aggregation method that protects federated learning for financial fraud detection from malicious clients who poison data or model updates. It combines Median Absolute Deviation (MAD), distance-based update filtering, and FedMedian aggregation. Experiments on an imbalanced credit card dataset tested label-flipping and weight-scaling attacks over 50 communication rounds. With 40% malicious clients, it achieved an AUPRC of 0.796 and a Recall of 0.847.
Maria-Ioana-Andrea Ivan, Orhan Ermis, Ruxandra F. Olimid
In briefBrowseSafe++: A Benchmark for Detecting Prompt Injections in Web Pages Across Contexts, Languages, and Views
SummaryBrowseSafe++ expands the earlier BrowseSafe benchmark to 38,675 paired pages, each with an attacked version and a clean control. Many injections were taken from real production websites, and the pages are provided as HTML, Markdown, accessibility trees, and screenshots across twelve website types. The authors train two 0.8B-parameter detectors, BrowseSafe-Guard, on these pairs, reporting higher F1 scores than a frontier-model-based detector.
In briefVeriRouter: Verifiable Routing for Large Language Models
SummaryLLM routers pick models and rewrite requests to balance quality, latency, and cost, but a compromised router could select ineligible models, rewrite without endorsement, or relay content unfaithfully. This paper proposes VeriRouter, a framework that combines zero-knowledge proofs with a provider-issued serving certificate to verify both model selection and rewriting while keeping the router's private assets hidden from clients. On real-world workloads, model-selection and rewrite proofs average 21.92 s and 4.24 s, giving 1,307× and 101× speedups over the fastest completing baselines. Compared with unverified serving, it adds 4.08 s under per-turn selection and 0.11 s under session-pinned selection.
In briefComplete count of rejection conditions for expected ML-DSA signing iterations
SummaryThe paper notes that the Dilithium equation cited by FIPS 204 Table 1 covers only two validity checks and omits two encoding-correctness checks. The authors account for all four conditions: the z check is computed exactly, the c·t0 term follows a closed-form Irwin-Hall tail, and the hint-weight tail is estimated by Monte Carlo. The corrected expected iteration counts are 4.36, 5.14 and 3.91 for ML-DSA-44, -65 and -87, within 0.14% of an end-to-end measurement.
In briefFast SIMD Base64 decoding that ignores whitespace
SummaryThe paper presents a block-oriented Base64 decoding algorithm that removes ASCII whitespace inside a SIMD loop, following the WHATWG forgiving-base64 rules. Clean 64-character blocks are decoded directly, while blocks containing ignorable characters are compacted into a small stack buffer. Implementations are provided for x64, ARM NEON, and LoongArch, with the C++ decoder reaching up to 94 GB/s on AMD Zen 5 processors. The authors report that integration into Node 25 raised Uint8Array.fromBase64 throughput by up to 6x compared with Node 19.
WhyRemoves whitespace inside the SIMD loop, decoding clean blocks directly; reports up to 94 GB/s and 6x speedup in Node 25 with broad adoption.
In briefDefending Score-Based Black-Box Attacks with Gradient Confusion
SummaryThis paper proposes the Gradient Confusion Defense (GCD), a deterministic, retraining-free wrapper that reshapes the probability outputs returned to adversaries who repeatedly query a model with black-box score-based attacks. GCD aligns the exposed logit gradient with a direction misaligned from the true adversarial loss gradient. The authors report theoretical analysis that GCD slows gradient-estimation attacks and causes errors in random search attacks. Experiments on CIFAR-10 and ImageNet across several architectures show improved robustness with no clean accuracy loss.
In briefVulnBump: A Benchmark for Fixing Vulnerable Dependencies Without Breaking Builds or Tests
SummaryThis paper introduces VulnBump, a benchmark of 307 upgrade tasks covering 2,066 fixable vulnerabilities across 43 repositories and six package managers. An upgrade counts as a pass only if dependencies resolve, a rescan shows the vulnerabilities fixed, the project builds, and all previously passing tests still pass. Results show a non-agentic baseline passing 46.9% of upgrades, compared with 90.2% for Snyk's Evo Remediation Agent, 77.5% for Claude Code with Snyk scan, and 59.6% for Claude Code unaided.
Gabija Pasiunaite, Ryan McMorrow, Brian Clark et al.
In briefCOMPASS: A Method That Tests Whether Vision AI Models Memorized Their Training Images
SummaryVision large language models are used in privacy-sensitive areas, so exposure of their training data is a concern. The paper systematically studies how these models respond to small and large Gaussian noise perturbations, finding that the best noise level and score direction vary by model and dataset. The authors propose COMPASS, an adaptive attack that calibrates noise magnitude and score direction using a known non-member reference set. It outperforms baselines across several models, reaching AUC up to 0.88 on general data and 0.64 on medical data.
In briefSSM-Attack: Learning where to add noise to protect faces from recognition
SummaryThis paper introduces SSM-Attack, a black-box face privacy method built on Selective State Space Models that protects photos from unconsented face recognition. Instead of synthesizing a perturbation directly, the model predicts in one pass how the perturbation budget should be spatially allocated across facial locations, followed by a short refinement step. The authors report the highest average black-box attack success rates among compared methods on CelebA-HQ, LADN and FFHQ.
In briefTRAP: A Tree-Guided Method for Automatically Finding Jailbreak Weaknesses in Aligned LLMs
SummaryThis paper presents TRAP, a framework that automatically discovers jailbreak strategies against aligned large language models, requiring only black-box access to the target. It organizes known jailbreak methods and successful templates into a semantic strategy tree, and uses a tree-structured gradient bandit reinforcement-learning policy that updates strategy preferences from evaluator feedback. Retrieval-augmented prompt construction turns the selected strategy into an attack. On AdvBench across seven aligned LLMs, TRAP outperforms its counterparts on six models, with attack success rates from 45.6% to 97.9%.
In briefTighter privacy accounting for end-to-end differentially private synthetic data
SummaryThe paper addresses the loss of accounting precision when combining different differentially private mechanisms in one pipeline. It develops end-to-end accounting tools based on privacy loss distributions (PLD), f-DP, and Gaussian DP (GDP), including PLD and GDP analyses of bounded-range mechanisms such as the Exponential mechanism. It introduces AIM-GDP, a GDP-native variant of the AIM synthetic data mechanism, and MixCal, an algorithm for calibrating adaptive mixed compositions. The authors report that these tools allow less noise at the same privacy level while achieving better utility.
WhyDerives new PLD and GDP analyses for bounded-range mechanisms and an GDP-native AIM variant, showing better utility at equal privacy across experiments.
Georgi Ganev, Vadym Doroshenko, Arun Ganesh et al.
In briefWho Is the 'I' in AI? Decentralized Identity and Accountability for Autonomous Agents
SummaryThis paper proposes a decentralized AI identity framework built on self-sovereign identity (SSI) principles, distinguishing human users from AI agents and applying separate verification logic to each. Its core is the ABCD Framework, combining an algorithmic fingerprint, a behavioural fingerprint, cryptographic identity via Decentralized Identifiers (DIDs), and delegation that binds agent actions to human accountability. The authors argue this enables trust policies ranging from simple authentication to liability assignment, addressing the black box identity problem in autonomous AI economic activity.
Ahammod Munim Ramil, Khalid Al Kafi, M. A. Abdullahis Sany et al.
In briefCan Rényi accountants beat lossless accountants for DP-SGD?
SummaryThis paper studies privacy accounting for differentially private stochastic gradient descent (DP-SGD) with fixed-size batches under replace adjacency. It shows that Rényi DP accounting can use a different worst-case distribution pair than lossless frameworks, characterized as two-dimensional Gaussian mixtures. This yields an improved Rényi DP bound, and numerical and asymptotic comparisons indicate it can give better privacy guarantees than lossless frameworks across various hyperparameter settings.
WhyShows Rényi DP can use different worst-case distribution pairs for fixed-batch DP-SGD, deriving an improved bound that numerically beats lossless accounting.
In briefSEAL-DT: A Security Engineering Framework for Digital Twins Across Domains
SummaryThis paper presents SEAL-DT, a framework for building and evaluating secure digital twins. It links entity definitions, process models, deterministic simulations, data contracts, evidence records and automated tests so that security decisions and simulation results trace back to their data, assumptions and requirements. The framework is demonstrated in five scenarios, including Car2X protection, passive IoT device detection and medical IoT monitoring. The authors report that it supports consistent model construction, traceable execution and linking of security findings to observable evidence.
Iraklis Varlamis, Stelios Zindros, Christos Sardianos et al.
In briefForgetting Data Under Correlation: Balancing Privacy and Usefulness
SummaryThis paper studies privacy-preserving algorithms that remove information from a correlated dataset to reduce leakage about sensitive parts. For local mechanisms and binary Markovian correlations, the authors analytically characterize the optimal tradeoff between privacy (leakage through correlation) and utility (number of redactions). They show the design problem decomposes into a sequence of local mechanism design problems, and that the optimal mechanism is the solution to a finite-horizon deterministic Markov decision process.
In briefCUTS: Chained Uniform-sum Tree Signatures (hash-based signature paper)
SummaryThis paper studies how much a hash-based signature leaks when a one-time key is used twice, for schemes whose key is a tree of hash chains. It proves that values derivable from several signatures equal the union of those derivable from each one, and bounds forgery in the random-oracle model with a combinatorial coverage exponent. It then presents CUTS, whose signature length does not depend on tree height, and gives a lower bound of about 128.6 on the two-use coverage exponent for one parameter set, plus a counter variant, CUTS+C.
WhyProves a general class result on multi-signature leakage and proposes CUTS with exact coverage computations, though evidence rests on specific parameter calculations.
In briefCompute Locally First: Efficient Secure Multi-Party Computation by Maximizing Local Processing
SummaryThis paper studies secure multi-party computation based on garbled circuits. Prior work mostly used the number of non-linear gates, especially AND gates, as the cost measure. The authors observe that when one party knows or can locally compute a non-linear gate's inputs, that gate need not be garbled and can be evaluated outside the secure protocol. They propose an ownership-aware optimization that minimizes non-linear gates requiring joint evaluation, implemented as a compiler-integrated, gate-level framework. Experiments report reduced jointly evaluated computation and better end-to-end performance on circuits with party-local structure.
In briefShamir secret sharing leakage resistance when the threshold is below half
SummaryThis paper studies how well Shamir secret sharing resists leakage of a bounded number of bits from every share. It shows that with a reconstruction threshold below half the number of parties, the scheme withstands arbitrary one-bit leakage per share. For thresholds of (1/2+δ)n, it tolerates about (δ/24)log₂n leaked bits per share, which is optimal up to a constant factor. The results come from an analytic framework for generalized Reed-Solomon codes.
WhyUsing Efron–Stein decomposition and a generalized von Neumann inequality, it lowers Shamir sharing's leakage-resilience threshold below one half, with near-optimal bit counts and full proofs.
In briefRevisiting Witness-Succinct UC-lifting Compilers
SummaryThis paper studies compiling zero-knowledge succinct non-interactive arguments into Universal Composability (UC) security. The authors introduce verifiable reconstructible straightline codes (VRSCs) as a primitive and show that the witness-succinct UC compiler of Ganesh et al. (EUROCRYPT 2023) lacks a required security property. Permuting revealed evaluation openings can yield a fresh accepting proof, which invalidates its simulation argument. A pairing-based construction is given that reduces certificate-generation work to quasi-linear in the witness size.
WhyIntroduces VRSCs, exposes a flaw in a prior UC compiler, and gives a quasi-linear-prover lifting construction; evidence is mainly theoretical security argument without experiments.
Davide Li Calsi, Luigi Russo, Dominique Schröder et al.
In briefCWE-bench: Measuring AI agents' ability to find and fix software vulnerabilities
SummaryThis paper introduces CWE-bench, a private benchmark of 120 repository audit-and-repair tasks covering 73 CWE types, eight languages, and all OWASP Top 10 2025 categories. Agents must find and fix vulnerabilities without being told their location or number, and patches are checked by a programmatic verifier for blocking exploits and preserving functionality. The best agents reach 68% pass@1 and 81% pass@4. The authors also report that agents with equal pass@1 differ in retry gains and cost, and that difficulty varies more by vulnerability category than by language.
Gonzalo Gonzalez-Pumariega, Ajay Jagannath, Adit Jain et al.
In briefGenericity in Multivariate Cryptography: Checking Whether UOV Public-Key Properties Hold Generally
SummaryThe paper proves that certain properties of ideals and varieties generated by UOV (Unbalanced Oil and Vinegar) public keys hold generically, including equidimensionality of UOV varieties and radicality of public key ideals. These results justify regularity assumptions used in cryptanalysis of UOV and its variants. The authors also review several cryptographic schemes, identifying cases where non-genericity led to cryptanalysis and giving a counter-example whose non-genericity is hard to exploit.
Simon Abelard, Pierre Pébereau, Mohab Safey El Din
In briefSecurity and robustness of encrypted local home-automation communications: ESPHome Native API versus MQTT over TLS 1.3
SummaryThis paper systematically compares two encrypted communication options between ESP-family microcontrollers and the Home Assistant platform: MQTT secured with TLS 1.3, and the ESPHome Native API, which uses the Noise Protocol Framework. The analysis covers cryptographic robustness, attack surface, implementation complexity, and resource consumption. The authors find that TLS 1.3 fits public-key infrastructure but is more complex to configure, while the Native API is simpler to operate. Resource figures come from measurements published by the projects and manufacturers rather than the authors' own test bench, a limitation the authors acknowledge.
Carlos Roberto Gonzalez-Escarpeta, Juan Eduardo Garcia Sanchez, Jos\'e Antonio Hernandez Reyes et al.
