In briefPost-quantum certificate-based PSK provisioning for WireGuard over mutual TLS, DTLS, and QUIC
SummaryThe paper proposes an architecture that adds post-quantum resistance to WireGuard while keeping its core protocol and adding certificate-based peer identities. A mutually authenticated control channel built on the TLS 1.3 handshake uses ML-KEM for key establishment and X.509 certificates signed with ML-DSA, and the derived secret is injected into WireGuard's pre-shared key interface. The authors model the composition with Tamarin to analyze secrecy and binding properties, and evaluate handshake latency and CPU time across transports and algorithm choices.
Che Hang Ng, Emil Künstner, Bastian Küppers et al.
In briefSelecting Quality, Diverse Training Data for Cyber Threat Intelligence Instruction Tuning
SummaryThis paper addresses weak quality control and limited diversity in data selection for cyber threat intelligence instruction tuning. It proposes CTI-TDS, which first filters instructions using style consistency and security knowledge verification, then selects training data by framing gradient influence as a distribution alignment problem solved with entropic regularized optimal transport. Experiments on CTIBench across several large language models show that fine-tuning on a small set of selected data outperforms existing selection methods and performs competitively on threat intelligence analysis tasks.
In briefCommitment Security Analysis of Forkcipher-Based AEAD Schemes
SummaryThis paper examines whether authenticated encryption schemes built on forkciphers bind ciphertexts uniquely to their inputs, a property called committing security. The authors comprehensively analyze existing constructions and find that some designs inherently fail to achieve strong commitment, while others provide meaningful guarantees. They also formalize a forkcipher-based hash and prove its collision resistance.
In briefP2Patch: Exploit-Guided Vulnerability Repair (testing each patch with new attacks to catch fixes that only block the original exploit)
SummaryThis paper presents P2Patch, a generative adversarial system for automated vulnerability repair. An exploitation agent first builds a reproducing proof of vulnerability (PoV), a patching agent then repairs the program, and the exploitation agent attacks the patched code for a distinct same-vulnerability exploit. Each successful exploit becomes a permanent repair requirement that the final patch must block. Across 101 C/C++ and Java CVE subjects, the loop found a new confirmed exploit in 41% of runs, and held-out fix-closed coverage rose from 78.1% to 84.7% compared with single-pass repair.
WhyProposes an adversarial repair loop where attacker agents find new same-vulnerability exploits after each patch, validated on 101 CVEs against single-pass and recent baselines.
Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat et al.
In briefRemoving micro-architectural side-channel leakage from embedded processors through hardware changes
SummaryThis paper addresses side-channel leakage caused by micro-architecture in embedded processors, which can undermine software masking. Instead of handling leakage in software, the authors propose register-transfer level (RTL) changes to general-purpose processors that remove the root causes of leakage. Each countermeasure is formally proven secure and integrated into the Ibex processor, which is evaluated through tool-assisted netlist leakage assessment and physical experiments on an FPGA.
WhyProposes eliminating micro-architectural leakage at RTL, with formal proofs and full-netlist and FPGA validation on Ibex.
In briefSecret sharing without extractable randomness
SummaryThis paper studies the randomness needed for two-out-of-two secret sharing. Bosley and Dodis asked in 2007 whether such schemes must also allow deterministic extraction of nearly uniform bits from the randomness source. The authors answer no: for each b≥2, they build a class of flat sources with min-entropy at least b and a perfectly correct, perfectly private scheme that splits a b-bit secret into two (b+1)-bit shares. The idea is extended to other threshold settings.
WhyA parity-based counterexample answers an open question negatively and extends the result to other sharing thresholds.
In briefFreeSBee: a compiler pipeline for constant-time code
SummaryThis paper presents a compilation workflow that hardens code against timing side-channel attacks. It first uses taint analysis to find code locations that depend on sensitive data, then applies automated control-flow transformations inside the compiler to close possible timing leaks. The authors evaluate the approach on a realistic application running on a RISC-V core using static timing analysis and statistical methods. They do not achieve cycle-accurate constant-time execution, but their statistical results suggest the hardened binary is safe against timing attacks.
In briefSecret sharing without extractable randomness: a negative answer to Bosley–Dodis
SummaryThis cryptography preprint asks whether two-out-of-two secret sharing requires randomness sources from which nearly uniform bits can be deterministically extracted. The authors construct a class of flat sources and a perfectly correct, perfectly private scheme that splits a b-bit secret into two (b+1)-bit shares. They show that every deterministic function is far from uniform on some source in the class, answering the Bosley–Dodis question in the negative.
WhyA parity-argument counterexample answers an open question negatively and extends to several threshold schemes with rigorous proofs.
In briefStudying how hard it is to find permutation automorphisms of linear codes
SummaryThis paper examines the computational difficulty of finding permutation automorphisms of linear codes, covering three problems: finding a non-trivial automorphism, a generating set, and the group order. The authors give polynomial-time reductions connecting these problems to permutation isomorphism, suggesting they are unlikely to be easy in the worst case. They also reduce generator finding to graph automorphism problems, yielding quasi-polynomial time when the hull dimension is logarithmic. A proof-of-concept implementation is reported to be significantly faster than Magma and Sagemath built-in algorithms.
WhyGives polynomial reductions and a quasi-polynomial algorithm for automorphism finding, a notable theoretical improvement; experiments are only proof-of-concept.
Michele Battagliola, Giuseppe D'Alconzo, Laura Mattiuz et al.
In briefA study of how payment terminals build tamper-sensing meshes to detect physical intrusion.
SummaryThe paper analyzes how tamper sensing meshes are physically built in payment terminals, ATM keypads, and a data center HSM, with detailed photos of key features. The authors classify construction techniques and find that most commercial devices use surprisingly simple designs, rarely approaching manufacturing limits. Based on this, they propose a concise set of design patterns for building secure tamper-sensing meshes.
In briefGeoCloak: An Agentic Framework That Protects Photo Location Privacy by Editing Peripheral Clues
SummaryLarge vision language models can infer where a photo was taken from the image alone, creating privacy risks. This paper introduces GeoCloak, a framework that identifies location-revealing clues, often at the image edges, and removes them with targeted semantic edits. It then adds adversarial perturbation to suppress remaining location features. Tested on four datasets covering 108 countries and 576 cities, it reduced city-level accuracy from 41.2% to 9.9%.
In briefCoRedSkill: Stealthy Attacks That Hide Malicious Steps Across Combined AI Agent Skills
SummaryThis paper introduces CoRedSkill, a method that combines multiple reusable agent skills to carry out attacks while still completing legitimate tasks. The authors built a 150-case benchmark and report 98.0% attack success, 95.3% task success, and a 3.3% detection rate. Their joint success rate of 90.7% exceeds the 6.7–42.7% of four baselines, suggesting that skill compositions can evade per-package auditing.
WhyProposes cross-skill composition attacks via AST rewriting, exposing blind spots of per-package auditing; validated on 150 cases with 98.0% attack success and 3.3% detection.
In briefESAU: Fast swarm remote attestation for IoT devices with an untrusted cloud proxy verifier
SummaryThis paper proposes a cloud-assisted remote attestation system for Internet of Things devices, which verifies each device's state remotely. The scheme is designed to be lightweight for resource-limited devices and to block unauthorized access by passive malicious administrators or compromised owner accounts on the cloud platform. It also extends remote attestation to an authenticated key exchange protocol. The authors analyze the system's security properties and evaluate its feasibility through implementation and simulation.
In briefSpeeding up number theoretic transforms on AI accelerators (NPUs) by splitting loops
SummaryThis paper proposes a method to accelerate the number theoretic transform (NTT), a core operation in post-quantum cryptography and fully homomorphic encryption, on neural processing units (NPUs). Using AMD's AI Engine architecture as the test platform, the authors use manual loop fission to split large loops into smaller primitives for efficient software pipelining. They build radix-2, radix-4, and radix-8 NTT implementations that outperform the AIE compiler and prior work in throughput and latency, and they discuss portability to other NPU architectures.
Henri Vermeersch, Xander Pottier, Quinten Norga et al.
In briefDiagnose before refining: a query-efficient jailbreak attack using multi-dimensional judge feedback
SummaryThe paper proposes JSB, a query-based jailbreak framework that uses multi-dimensional probabilistic feedback to guide optimization of adversarial prompts. Under a budget of only 10 target-model queries, it reports an average HarmBench attack success rate of 89.8% across ten open-source settings. The authors also analyze varying query budgets and attacker models, and test defenses, noting limitations of existing filtering mechanisms.
In briefedaBitE and Issuer-Hiding Blind Signatures Built on ML-DSA and VOLE-in-the-Head
SummaryThe paper presents the first blind signature in which the issuer runs the NIST-standardized post-quantum signature scheme ML-DSA unmodified. Issuance is an ML-DSA signature on a commitment, and the blind signature is a zero-knowledge proof of that ML-DSA signature using the VOLE-in-the-head proof system. The authors also introduce edaBitE, a batch consistency check between binary and prime-field commitments.
WhyFirst blind signature whose issuer runs unmodified ML-DSA, plus a new batch consistency check; novelty is strong, but evidence rests mainly on summary performance figures.
In briefQuiet triggers, visible traces: measuring how hidden backdoor attacks are across three spaces
SummaryThis paper studies how stealthy backdoor attacks on image-classification neural networks are, measuring their traces in input, feature, and parameter spaces. Evaluating representative attacks across four datasets and three model architectures, the authors find that an attack quiet in one space is often conspicuous in another, and few attacks stay small in all three. They also introduce two diagnostic metrics to complement existing measurements.
In briefCascadeLedger: Counterfactual auditing of information and resource integrity in LLM cascades
SummaryThe paper presents CascadeLedger, a counterfactual execution-audit framework for budgeted language-model cascades. It enforces call-before-read semantics, binds reads to service and cache identities, and freezes the event trace before scoring. Across several evaluations, the two-layer audit reports a clean false-positive rate of 0.0000 and detects most serialized and unlogged hidden-read faults.
In briefBilinear Compressive Security with Finitely Many Samples: How attackers recover keys from limited encryption observations
SummaryThis paper studies key recovery against Bilinear Compressive Security (BCS), a lightweight encryption scheme, when an attacker sees only finitely many encryptions. The authors propose a covariance-based attack that estimates linear measurements from repeated encryptions of the same plaintext and then recovers the secret measurement matrix, with finite-sample guarantees and sample-complexity bounds. Experiments show that dense matrices such as Gaussian ones need a number of measurements growing roughly linearly with signal dimension, while sparse-row matrices show quadratic growth consistent with theory. The results suggest the sparsity structure of the measurement matrix matters for BCS security.
Axel Flinth, Semira Einsele, Matilda Kylberg et al.
In briefNowhere Man: a device-binding method for post-quantum anonymous credentials
SummaryThe paper presents a modular device-binding protocol designed for the post-quantum signature standard ML-DSA, aimed at preventing anonymous credentials from being shared and supporting proof of personhood. It exploits ML-DSA's structure for efficiency while leaving the FIPS 204 signing interface unchanged. A proof-of-concept implementation is provided to demonstrate feasibility.
Calvin Abou Haidar, Ryo Kikuchi, Octavio Perez-Kempner et al.
In briefLost in the Fallback: How Reliably Do Typed Decision Models Use Fallback Options?
SummaryTyped decision models are used in tasks like request routing and model selection, where fallback options handle categories outside the regular choices, such as deferring to human experts or stronger models. The paper introduces the Paired Fallback Robustness (PFR) Test, which checks whether models correctly switch between regular and fallback options and give consistent decisions for logically equivalent rule definitions. The authors find that correctly recognizing a category does not reliably lead to choosing the correct fallback, with errors persisting even when the correct category is given, and that equivalent rule formulations can cause substantial disagreement in decisions.
In briefEntropy tests for STL files that account for IEEE-754 format validity rules
SummaryThis paper studies entropy-based randomness tests for ciphertexts of STL files. Most numerical data in STL is stored as single-precision IEEE-754 floats that must be finite, which makes byte probabilities nonuniform and creates dependence between exponent bytes. The authors derive the exact mean and variance of entropy under the valid-STL distribution and give second-order expansions for practical computation at large file sizes. They show the global entropy limit shifts to about 7.99991479609 bits and the local reference values also change, so unadjusted tests may wrongly reject ideal ciphertexts; they recommend format-specific reference values.
In briefLinking Cryptanalytic Distinguishers via Divisibility Properties
SummaryThis paper studies integral distinguishers where the number of ones in an output component is divisible by a high power of two, and uses this property to connect linear, integral, differential-linear and restricted differential sums through conversions with explicit guarantees. The authors develop MILP/SAT models and a black-box search algorithm to discover such properties automatically. They report improved divisibility bounds for many SIMON cases, PRESENT, and several other ciphers, including new results for SPECK, BEANIE, GIFT-64, Ascon and SKINNY-64.
WhyUnifies linear, integral, and differential-linear distinguishers via divisibility, with MILP/SAT models substantially improving bounds across many ciphers.
In briefDarKnight: A retrieval-guided agent that solves dark web CAPTCHAs locally
SummaryThe paper presents DarKnight, a self-improving agentic framework that runs on a single workstation GPU and uses small, locally hosted open-weight vision-language models to solve CAPTCHAs on dark web marketplaces. It retrieves past successful and failed attempts on similar images to build image-specific preprocessing pipelines and learns from each site's pass or fail result. In a case study on four real dark web marketplaces, it reached 83.2% on the most heavily defended market, 37.2 points above its base model and above Claude Opus 5 (44%).
In briefAdaptive and proximal federated optimizers for transferable network intrusion detection
SummaryThis paper examines whether federated learning optimizers other than FedAvg improve how well intrusion detection models transfer to attack classes not seen in training. On the CIC-IDS 2017 dataset with 11 clients, it compares FedAdam- and FedProx-inspired optimizers against FedAvg and contrasts bootstrapping with SMOTE. Using the number of client pairs exceeding 70% transferred accuracy as the main metric, the proximal optimizer with strong regularization achieved 48 pairs versus 42 for FedAvg. The authors conclude that the choice of federated optimizer matters for federated intrusion detection.
Rezwan Islam Salvi, MD Rafin Jawad Hafiz, Abeer Mahmood Kalam et al.
In briefA refined XL-based algebraic method for solving the regular syndrome decoding problem
SummaryThis paper studies algebraic methods for the Regular Syndrome Decoding Problem (RSDP), a variant of a core problem in code-based post-quantum cryptography. The authors build algebraic algorithms by combining and extending existing techniques, allowing an arbitrary solving degree in the XL algorithm and considering XFL- and WXL-based variants. Their complexity analysis indicates that, for certain parameters, the WXL variant with a solving degree above 2 is more efficient when the block size is small.
In briefRedDarwin: Evolving Jailbreak Attack Skills Against Frontier LLMs
SummaryThis paper presents RedDarwin, an agentic framework that evolves reusable executable attack skills rather than individual prompts to jailbreak large language models. Starting from 47 base skills, it revises, composes, and selects them using target-model feedback, producing 65 evolved skills. The authors report that the mean attack success rate on AdvBench rose from 18.8% to 47.3%, with high success on held-out models.
WhyShifts jailbreak evolution to executable attack skills recombined via target feedback, a clear novelty. Validated on AdvBench, held-out StrongREJECT and unseen frontier models, with substantial impact
In briefAnalyzing and Mitigating Poisoning Attacks on Flow-Based Intrusion Detection
SummaryThis paper examines how AI-based intrusion detection systems, which rely on large training datasets, can be compromised by stealthy poisoning attacks. The authors show that latent backdoors can be implanted in flow-based models by poisoning only 0.001% of training data, while performance on clean inputs stays near nominal. They propose a diagnostic-first method that localizes trigger-relevant features via constrained perturbation analysis and detects poisoning-induced drift against a distilled baseline model. The method also supports targeted mitigation through automated data sanitization or neuron pruning.
Florian Spelter, Johannes F. Loevenich, Tobias H\"urten et al.
In briefNo Way To Steal My Face: Proactive Defense Against Identity-Preserving Personalized Generation
SummaryThis paper addresses privacy risks in diffusion models that generate personalized, identity-preserving images from facial references. It proposes IDGuardian, a model-agnostic framework that defends against both training-based and training-free personalization by disrupting the identity extraction and identity injection stages with adversarial perturbations. The authors report that experiments show effective protection across various pipelines and architectures, with robustness to post-processing, adaptive attacks, and cross-dataset generalization.
In briefAWARE-RG: Abstraction-Aware Explanations of Resiliency Graphs for Cyber-Physical Systems
SummaryThis paper presents AWARE-RG, a semi-automated, human-in-the-loop framework that gives security analysts role-bounded explanations of resiliency paths in cyber-physical systems. Its abstraction structure is built with Formal Concept Analysis over MITRE ATT&CK for ICS tactics, ordered by the ICS Cyber Kill Chain. For valid attack-fault queries, it identifies missing dependencies, explains why a physical hazard is reachable, and suggests defenses; for invalid queries, it locates the first abstraction level where the path fails and reports confirmed blocking conditions as hardening pointers.
Shadaab Kawnain Bashir, Rakesh Podder, Philip D. Hopkins et al.
In briefSpeeding up Pollard rho on NVIDIA Blackwell GPUs with rebuilt field arithmetic
SummaryThis paper studies how much faster Pollard rho can run on NVIDIA Blackwell GPUs by rebuilding the field arithmetic for the hardware, using the Certicom challenge ECC2K-130 as the benchmark. The speedup comes from a packed normal-basis representation, the carry-less multiply instruction clmad, three-input logic instructions, and batch and memory layout tuning, not from a change to the algorithm. The authors report about 230 times the best published 2010 GPU kernel per card and estimate the whole challenge would take under five GPU-years. They also state that the work does not improve on the generic-group bound.
WhyHardware-level field arithmetic rebuilding gives a large measured speedup on ECC2K-130, but the algorithm itself is unchanged.
In briefGraph-based analysis of how fairly and at what scale private Transformer inference systems can be compared
SummaryThis paper maps 62 private Transformer inference (PTI) systems into a graph, with system attributes as nodes and evaluation compatibility as edges. It finds that cryptographic progress drives most performance gains but always co-occurs with other factors such as model fidelity, hardware, and cost accounting. Of 1,891 candidate system pairs, only one is directly comparable under shared assumptions. The authors also report that the scaling frontier has plateaued at 13B parameters and project the cost of deploying current PTI techniques on production-scale Transformers.
In briefResearch on automatically finding logic flaws in drone autopilot software (Mission (Im)Possible)
SummaryThis paper addresses subtle logic flaws in open-source drone autopilot software that are hard to find with existing tools. It presents IMF (Impossible Mission Finder), a multi-agent system combining static analysis, dynamic execution, and log analysis to automatically propose, test, and validate such flaws. Evaluated on the PX4 and Ardupilot autopilot systems, IMF uncovered 105 previously unknown logic flaws that can cause unsafe behaviors such as mission interruption, invalid actions, and entry into restricted fly zones.
WhyProposes a multi-agent LLM framework finding 105 unknown autopilot logic flaws in PX4 and Ardupilot; validation details are limited in the abstract.
In briefWhat You Sign Is Not What You Run: Verifiability Gaps in Quantized LLMs
SummaryThe paper argues that model signing covers only full-precision weights, while users run quantized files whose production process is not uniquely determined by current disclosures. Across the 198 most-downloaded GGUF repositories on Hugging Face, none records its build environment, so the independent verifiability rate is 0/198. Disclosing two omitted build settings, floating-point contraction and per-tensor quantization recipes, let the authors re-derive 7 of 8 target quantized files bit-for-bit on x86.
WhyIntroduces the IVR metric and identifies hidden build coordinates blocking bit-for-bit reproduction, backed by measurements and a reproduced divergence case.
In briefDPF-SGD: Byzantine-robust, differentially private federated SGD with proven optimality
SummaryThis paper proposes DPF-SGD, a federated SGD algorithm that protects privacy with differential privacy while resisting Byzantine (malicious) participants. It combines private step sizes with a DP noise-decay schedule and adds a privacy-preserving comparative elimination (PPCE) filter to suppress Byzantine updates during aggregation. The authors establish almost sure convergence to the global optimum under ϵ-differential privacy, and report that experiments on synthetic and MNIST data reduce final optimization error by one to two orders of magnitude versus DP baselines.
In briefMMA-SafetyBench: A Safety Benchmark for Multimodal AI Agents
SummaryThis paper studies how multimodal agents that read screens can be misled by forged visual elements, such as fake system alerts, into abandoning their assigned tasks. The authors built MMA-SafetyBench, containing 1,083 adversarial trajectories across five domains. Across nine evaluated models, attack success reached 87.96% and semantic compromise reached 98.09%. A safety-priority prompt reduced attack success but did not eliminate the failure.
In briefTesting Machine Learning for Detecting Cloud Cryptojacking: How Data Prep and Test Methods Change Results
SummaryThis paper empirically compares six widely used classical machine learning models for detecting cryptojacking, the unauthorized use of cloud resources to mine cryptocurrency. Because no public cloud-native dataset exists, it uses two public proxy datasets, DS2OS and NSL-KDD. The results show that preprocessing choices and evaluation protocols measurably affect performance, with accuracy of 77 to 80% on the official NSL-KDD test set containing unseen attacks versus above 99.5% under random splitting.
In briefPrivate Markov chain learning with near-optimal sample complexity under item and user privacy
SummaryThe paper studies estimating the transition matrix of a discrete ergodic Markov chain from N independent trajectories of length T under differential privacy, measuring maximum row-wise ℓ1 error. The bounds depend on the number of states, the minimum stationary probability, and the pseudo-spectral gap. Under item-level privacy, upper and lower bounds separate the costs of sampling, state occupancy and mixing, and privacy. Under user-level privacy, long trajectories reduce the problem to private product distribution estimation, for which optimal bounds are also established.](https://example.com)
In briefAutoPoly-HE: Automatically Designing Polynomial Activations for Encrypted AI Inference
SummaryThis paper proposes an autonomous framework that selects polynomial activation functions suited to each dataset and model, enabling privacy-preserving inference under homomorphic encryption. The authors evaluate ResNet and Vision Transformer models across multiple datasets. Transformer-based models keep higher accuracy under polynomial approximation, while convolutional models degrade more as task complexity grows. A CLS token based inference pipeline is also reported to reduce computational overhead by removing depth-dependent operations.
In briefAttack showing TEE encrypted database snapshots can leak plaintext histograms
SummaryThis is a cryptanalysis preprint on IACR ePrint titled "Snapshots of TEE-Based Encrypted Databases Leak Plaintext Histograms via Dendrochronology." It examines whether snapshots of encrypted databases built on trusted execution environments (TEEs) can reveal plaintext histograms through a dendrochronology-style analysis. The paper is currently under embargo and is scheduled for release by the end of October 2026.
In briefDid the LLM Answer the Question? A Semantic Reconstruction Game for Jailbreak Evaluation
SummaryThis paper examines how jailbreak attacks on large language models are scored, showing that the attack success rate can shift by up to 82 percentage points just by changing the judge model. The authors propose a training-free evaluator, the semantic reconstruction game, which has an LLM reconstruct the request a response substantively answers and compares it against decoy requests, allowing abstention when none match. Tested with three off-the-shelf LLM judges, it had the lowest mean error against human labels among the methods evaluated and reduced variation in reported success rates. The method prioritizes avoiding false positives, which means it may miss some successful jailbreaks.
In briefUnmasking the Secret Code: How Masked Context Controls Memorization in SFT
SummaryCanaries are synthetic training records containing known secrets, used to test whether language models reveal training data. Controlled fine-tuning experiments show that how a secret is presented in training strongly affects what the model learns, and repetition alone does not characterize memorization. Changing when a canary appears or which canaries accompany it can substantially alter measured memorization, so audits should check their conclusions across these choices.
Avi Schwarzschild, Om Thakkar, Sahra Ghalebikesabi et al.
In briefTrackShield: Efficient Runtime Defense Against Availability Attacks on Real-Time Multi-Object Tracking
SummaryThis paper presents TrackShield, a lightweight runtime layer that protects multi-object trackers from availability attacks such as SlowTrack, which grow the tracker's persistent state and slow each frame. It combines anomaly monitoring, staged birth capping, pruning of young or weakly matched tracks, and per-stage admission control on association inputs. On a Jetson AGX Orin, attacked tracking-stage latency drops from 139.90 to 6.27 ms and whole-pipeline P99 latency from 190.9 to 48.8 ms, at a benign MOTA cost of 1.06 points.
Zonghua Gu, Julian Singh-Smith, Junlin Liao et al.
In briefGraph analysis of comparability and scale in private Transformer inference
SummaryThe paper builds an empirical graph of 62 private Transformer inference (PTI) systems, with nodes for system attributes and edges for evaluation compatibility. The three-level analysis finds that cryptographic progress usually accompanies performance gains, but always alongside other factors such as model fidelity, hardware, and cost accounting. Of 1,891 candidate system pairs, only one is directly comparable under shared assumptions. The authors also report that the scaling frontier of private inference has plateaued at 13B parameters.
In briefBeyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills
SummaryThis paper studies Markdown-based agent skills, which gain the session's privileges to act once installed. The authors combine static analysis, dependency provenance checks, and sandboxed execution traces to profile the attack surface of 6,309 listings from two marketplaces. About half show shell-execution capability, and seven in ten carry at least one elevated capability, mostly invisible at install time. The authors argue that capability-based profiling is a necessary complement to maliciousness detection.
WhyProposes capability-oriented attack-surface profiling for agent skills, combining static analysis and sandbox execution, measuring 6,309 listings and revealing declaration-capability mismatches.
Ratnesh Pandey, Japneet Singh, Harsh Akshit et al.
In briefAgentCIScope: A Benchmark for Testing Whether AI Agents Protect Contextual Privacy
SummaryThis paper introduces AgentCIScope, a platform and benchmark for checking whether LLM agents preserve contextual integrity, meaning their information sharing follows context-specific disclosure rules. It turns public and synthetic privacy cases into executable multi-step tasks across realistic app environments, with constraints grounded in privacy policies, persona-based agreement, and a sensitive-attribute taxonomy. Testing 12 agents on 936 tasks, the authors find that strong task completion does not ensure privacy preservation, with single-run leakage rates from 32.5% to 94.4%.</summary>
In briefCombining Post-Quantum Cryptography and Quantum Key Distribution: A Survey of Hybrid Designs, Proofs, Standards and Open Problems
SummaryThis survey examines combining post-quantum cryptography (PQC) with quantum key distribution (QKD) so that a session key stays secure if either component holds. It uses deployed hybrid classical-plus-PQC key exchange as the baseline and proposes an eight-dimension taxonomy to compare published protocols and IETF standards. The paper also reviews security arguments, deployment evidence, and standards and policy positions. It closes with open problems including QKD channel authentication, shared-infrastructure threat models, and formal verification.
In briefCyberArena: A live attack-and-defense benchmark for AI cybersecurity agents
SummaryCyberArena is a dynamic benchmark in which two AI agents compete in isolated sandboxes, acting as both attacker and defender over continuously changing services. An automated pipeline generates and validates new environments, and a dynamical model converts match results into multidimensional scores. The authors evaluated 12 frontier LLM agents across 40 challenges in 466 matches.
WhyIntroduces a dynamic symmetric attack-defense benchmark with a unified scoring model; validated over 466 matches across 12 agents, giving solid evidence and moderate field impact.
In briefAegisAsync: Symbolic Simulation of Async Events to Find Risks in Python Code
SummaryThis paper presents AegisAsync, a bytecode-based tool that analyzes security and robustness risks in Python asynchronous programs for CPython 3.10 to 3.14. It builds an async event transition graph and runs bounded path-local simulation that tracks event order, object states, and cancellation at await points, with six detector plugins producing candidates with witnesses. On AsyncBench, a benchmark of 180 labeled risks, it detects all of them with zero false positives across five versions. On real PyPI packages, about half of the candidates were confirmed by source review, and 16 reported bugs have been fixed.
WhyNovel bytecode-based async event graph with symbolic cancellation simulation; validated on a 180-risk benchmark and 2,500 PyPI packages, with reported and fixed real bugs.
Baihong Chen (Utah State University), Wen Li (Utah State University)
In briefEFI pairs equal 1PRS: a minimal assumption for quantum cryptography
SummaryThis paper proves that EFI pairs are equivalent to expanding single-copy pseudorandom state generators (1PRS). Earlier work by Cavalar et al. showed this equivalence only in a non-uniform setting; the authors remove that non-uniformity. The result gives the first uniform meta-complexity characterization of EFI pairs. Combined with Batra and Jain's equivalence between statistically verifiable one-way state generators and commitments, it yields a quantum analogue of the classical equivalence among one-way functions, commitments, and pseudorandom generators.
WhyRemoves non-uniformity from prior work, proving EFI pairs equivalent to expanding 1PRS, yielding the first uniform meta-complexity characterization.
In briefBytes to Threats: A Transformer That Detects Malware From Raw Bytes
SummaryThis paper introduces MalwareFormer, a transformer-based framework that detects malware by analyzing the raw bytes of executable files, without handcrafted features or domain expertise. The authors report 98.35% accuracy, 98.32% balanced accuracy, 98.32% macro-F1, and a 1.94% false positive rate. They state it outperforms two baselines on all threshold-dependent classification metrics.
In briefDynamic attack surfaces: a queue of branching processes model
SummaryThis paper models dynamic attack surfaces as a queue of branching processes that links vulnerability discovery and resource-limited patching with the changing attacker population targeting each vulnerability. The main risk measure is the cumulative number of exploits a vulnerability faces before it is patched. The authors derive expected cumulative exploits under two attacker activity models and identify a phase transition under the birth-death-immigration model, where the expectation is finite only if attacker growth stays below both the discovery rate and the effective patching rate.
WhyIntroduces a queue of branching processes for dynamic attack surfaces, deriving expected cumulative exploits and a phase transition under BDI and RD models.
Ismail Cosandal, Abdullah Y. Etcibasi, C. Emre Koksal et al.
In briefARACDE: Adding ABAC to Databases via External Authorization Engines
SummaryThis paper presents a method for separating a relational database's authorization logic from its core data engine, allowing more advanced access control policies with minimal code changes. The decoupled architecture, called ARCADE, delegates access decisions to a formally verifiable policy engine such as Cedar, while the database enforces those decisions. Experiments on MySQL and PostgreSQL show negligible overhead, with throughput penalties below 3.9% for MySQL and 1.3% for PostgreSQL on the TPC-C benchmark.
Karthikeya S M Yelisetty (Indian Institute of Technology Kharagpur), Shamik Sural (Indian Institute of Technology Kharagpur), Santosh Nagarakatte (Rutgers University)
In briefNudge the Judge: Revealing Program Decision Hijacking in Real-World Jev Applications
SummaryThe paper introduces Jev Program Decision Hijacking (JPDH), a security risk where attacker-controlled contexts steer program decisions through schema-valid judgments from Jev-style models. It presents JevProbe, an automated framework that traces adversarial influence from context inputs to downstream consequences, and JevProbeBench, a benchmark for evaluating JPDH. Across 228 real-world applications and 2,273 test cases, 81.5% showed decision flips, and 98.6% of those could lead to potential security impacts.
WhyIntroduces a new decision hijacking threat with an automated framework; 81.5% of 228 real applications show decision flips across 2,273 tests.
In briefDPOison-VL: A Hidden Poisoning Attack on Vision-Language Preference Training
SummaryThis paper introduces DPOison-VL, the first clean preference poisoning attack against vision-language models trained with Direct Preference Optimization. It adds imperceptible perturbations to a small fraction of training images while keeping prompts, responses, and preference labels semantically unchanged. Experiments report up to 98% attack success with only 2% poisoned data, cross-model transferability, and largely preserved clean accuracy. The results expose a vulnerability in which image perturbations can silently redirect model alignment.
WhyProposes the first clean preference poisoning attack on VLM-DPO, achieving high attack success with 2% poisoned data across multiple models.
In briefA simulated training ground for AI that defends networks against cyberattacks
SummaryThis paper presents the ACO gym, a framework combining network emulation, user behaviour modelling for normal and adversarial traffic, and tools for generating cybersecurity scenarios. It supports extracting features at packet and flow levels to create labelled synthetic datasets for training deep neural network intrusion detection systems and for evaluating autonomous defence agents. A DNN classifier performed well within the same domain, achieving near-perfect recall on adversarial flows. However, the experiments show that small changes in network composition, such as shifts in traffic protocol distribution, can sharply reduce model transferability and detection performance.
Tobias H\"urten, Johannes F. Loevenich, Florian Spelter et al.
In briefLimits of statistical safety guarantees for embodied and agentic AI against adaptive adversaries
SummaryThe paper shows that finite safety evaluations cannot rule out an adversary that behaves normally until certification and then activates attacks. It derives the expected number of post-certification violations and tests this limitation in simulated robot collaboration and tool-use experiments. It also proposes a mixture likelihood-ratio monitor that bounds cumulative excess violations when certification can be permanently revoked.
WhyProves adaptive adversaries gain linear post-certification excess events, and gives a mixture likelihood-ratio monitor with square-root bounds under revocation.
In briefX.js: A Live Benchmark of Node.js Taint-Style Vulnerabilities
SummaryThis paper presents X.js, a continuously updated benchmark of real-world Node.js taint-style vulnerabilities, including code and command injection, prototype pollution, and path traversal. It is built from 1,738 advisories collected through mid-2026, mainly from the GitHub Advisory Database, with each entry linked to source and sink locations, a validated exploit, and a patched version when available. The current release contains 1,159 validated exploits across 965 packages. The authors find that these vulnerabilities are increasingly reported in large packages, with the median vulnerable package growing from about 250 lines of code in 2021–2022 to 6,100 in 2026.
Jos\'e Afonso, Jo\~ao Madeira Pereira, Ronghao Ni et al.
In briefRethinking Quality in LLM Routing: Security-Aware Model and Budget Selection
SummaryThis paper introduces SCRouter, a router that chooses which large language model to call and how many output tokens to allow for each query. It weighs answer utility for ordinary queries against security behavior, such as refusing harmful requests, for sensitive ones, then balances the result against cost. The authors also release SCRouterBench, containing 38,869 in-domain queries across nine security dimensions and 2,753 out-of-domain queries, each evaluated under 144 model-budget combinations. The paper reports that SCRouter outperforms baselines by 13 to 29 points in-domain and 19 to 23 points out-of-domain.
In briefCombining prompt segmentation with ROI encryption for fine-grained video protection via diffusion isolation
SummaryThis paper addresses selective encryption of regions of interest (ROI) in H.265/HEVC video, aiming to protect sensitive content while preserving non-ROI quality. It proposes a prompt segmentation-guided coding-unit-level method that maps pixel-level ROI masks to coding units, refines boundaries to 8×8 granularity, and uses dual spatial and temporal diffusion isolation to limit encryption-induced distortion. According to the reported experiments, the method produces encryption regions that better fit irregular ROI boundaries and confines distortion to the ROI.
In briefAdaptive Gaussian mixture model for detecting physical-layer spoofing in wireless localization
SummaryThis paper proposes an adaptive Gaussian mixture model (GMM) framework to detect physical-layer spoofing attacks that manipulate channel state information in indoor wireless localization. The method learns legitimate CSI patterns and flags spatial inconsistencies through statistical anomaly detection. Evaluated on a massive MIMO dataset with a 64-element antenna array, it reports 95-98% detection for displacements above 150 mm at a 1% false alarm rate, and it outperforms conventional GMM, LOF, one-class SVM and k-NN classifiers.
In briefToward Safe Autonomous Computer-Use Agents Resistant to Prompt Injection
SummaryThe paper argues that current LLM agent defenses, such as alignment training and safety classifiers, cannot fully rule out sophisticated indirect prompt injection attacks on computer use agents. It proposes SA-CUA, a dual-LLM framework that derives conservative deterministic rules from the accessibility tree to define a trusted region and keep trusted and untrusted content separated. The authors report that SA-CUA keeps higher utility than CaMeL-CUA while holding the attack success rate at zero.
