In briefENF-based agentic framework for forensic video authentication against generative AI
SummaryThis paper proposes a forensic framework that authenticates video using the electric network frequency (ENF), a mains-driven hum in audio and flicker in video that generative models do not control. It combines a two-channel ENF detector, synthetic-injection training, reference matching to verify or recover recording times, and an agentic orchestrator that fuses authenticity and manipulation evidence. On held-out real recordings, the detector accepts genuine audio and video at 93% and 100%, claimed-time authentication reaches an AUC of 1.0, and the cascade cuts wall-clock time by 54% without losing accuracy.
Ryan Wyton (1), Bacha Rehman (1) ((1) Southampton Solent University)
In briefSecAgg++: A post-quantum privacy-preserving federated learning protocol
SummaryThis paper presents SecAgg++, a masking-based secure aggregation protocol designed for the single-server setting. Most existing masking-based secure aggregation protocols lack post-quantum security, and SecAgg++ addresses this gap. It integrates post-quantum cryptographic primitives while keeping the communication and computational efficiency of classical schemes such as SecAgg and SecAgg+. It also handles client dropouts through an efficient recovery procedure.
Alessandro Perez, Giulia Cavicchioni, Silvio Cretti et al.
In briefEncoded but Exposed: Language Embeddings Can Leak Item and User Identities in Recommenders
SummaryThis paper studies whether language embeddings used to represent item content in recommender systems can reveal item identities. The authors show that a simple cosine-similarity attack, using auxiliary item text from external sources, can recover items with high mean reciprocal rank on two real-world datasets. The leakage can further propagate to re-identifying users from sparse ratings. The authors also evaluate obfuscated descriptions as a mitigation and find a clear tradeoff between reduced leakage and recommendation utility.
In briefBiShield-TEE: Examining the Security of One-Sided Weight Obfuscation for On-Device LLMs in TEEs
SummaryThe paper shows that a common TEE-based method for protecting on-device LLMs, which obfuscates only the output side of weight matrices, has a flaw: the secret key is uniquely determined and can be exposed by attackers. The authors propose BiShield-TEE, which obfuscates both input and output dimensions so that the true key is hidden among many equally valid candidates. Experiments reportedly limit attack accuracy to the full-shielding black-box baseline while achieving higher inference efficiency on real hardware.
In briefFederated Art Chase: Privacy and Poisoning Risks in Federated Fine-Tuning
SummaryThis report studies the privacy and integrity of federated learning used to adapt a pretrained model to data kept on user devices. Experiments on ten Quick, Draw! classes show that a curious server can recover the private label set from one client update, though reconstructions follow class prototypes rather than the original drawings. Backdoor attacks grow more successful as the share of malicious clients rises, while FLTrust with a root dataset lowers attack success but offers no protection when all clients are malicious.
In briefPricing the Unprovable: Ambiguity, Turnstile Runs, and Verifiability Discounts in Crypto Protocols
SummaryThis paper examines how privacy-preserving crypto protocols can be repaired without confirming whether past exploitation occurred, which may reduce asset value through a so-called verifiability discount. The authors introduce VDISC, a framework that separately records reported losses, exposed value, public evidence, returns, and pool flows. It draws on Orchard's staged disclosures, reconstructed on-chain flows, earlier Zcash cases, and a 40-event security panel. Market reactions for Orchard match the predicted direction, but the findings are directional rather than causal.
In briefSmoothness of shortest isogenies between supersingular curves and their Frobenius conjugates
SummaryThis paper studies the minimum degree of isogenies from a supersingular elliptic curve E to its Frobenius conjugate E^(p). The authors bound the smoothness probability of this minimum degree, which confirms that Wesolowski's p^(1/3+o(1)) attack on the supersingular endomorphism ring problem holds unconditionally. They also give a uniform asymptotic formula, with a main term in Dirichlet L-values, for the probability that an isogeny of degree n connects E and E^(p).
In briefPoisoning the Neighborhood: A Topology-Aware Attack on Large-Scale HNSW-based RAG
SummaryThis paper studies poisoning attacks on retrieval-augmented generation systems that use approximate nearest-neighbor HNSW indexes at scale. The authors propose a topology-aware topic-level attack that organizes poisoned documents into a Hub-Satellite structure and uses entity-claim promotion to influence generated answers. On a 2M-document Wikipedia corpus, the attack keeps over 72% retrieval success and reaches 31.29% attack success, and the authors report that existing poisoning defenses fail to mitigate it.
WhyProposes a topology-aware topic-level poisoning attack on HNSW-RAG, validated on 2M-document Wikipedia with structural analysis and defense evaluation.
In briefStructural Cryptanalysis of the Eevee Authenticated Encryption Family
SummaryThis paper analyzes flaws in the Eevee family of three AEAD modes, proposed at CCS 2023 for IoT-to-cloud computation. The authors present distinguishers and forgery attacks that contradict the claimed online and nonce-misuse security bounds. They conclude the problems stem from the mode design and cannot be fixed only by correcting implementation encodings.
WhyFinds structural flaws in three Eevee AEAD modes with concrete distinguishers and forgeries, refuting the original proofs using mainly theoretical derivations.
In briefWhether provenance marks survive self-evolution in copied agent harnesses
SummaryAgent harnesses, the prompt and tool code around a base model, can leak and be passed through a self-evolver to be presented as original. The paper measures how existing provenance marks survive this covert rewriting across three evolvers, five proposers and two environments, finding that published marks largely fail. The authors propose a new mark keyed on the order of near-tied entries in an object-location table built from public games, which is detected in 62 of 76 copies, though requesting more general code removes the key in 75-100% of rewrites.
WhyDefines a covert rewriting attack and a new provenance mark; experiments span several proposers and environments, but scale is limited and a scheme-aware adversary still evades it.
In briefBenchmarking post-quantum key encapsulation for encrypting objects in cloud storage with many concurrent clients.
SummaryThis paper measures how the post-quantum ML-KEM algorithm affects per-object encryption in an S3-compatible object store, compared with classical key exchange. Tests used two client implementations, two processor types, and up to 500 concurrent workers. Throughput dropped only when the client processor was at or near full load, by 4.0 to 4.9% in the main client. The lasting cost is storage, with 1,056 more bytes per object.
Revanth Reddy Lingala, K. Gangadhara Rao, Padigela Srujan et al.
In briefSpeeding up Sumcheck with algebraic geometry: a faster first round for proof systems
SummaryThis paper introduces a new multiplication code built from algebraic geometry that keeps binary messages binary when multiplied, reducing the cost of the first round of the sumcheck protocol. The authors give an explicit construction over F_{2^128} and implement it in the Flock proof system as the AG skip. For 2^32 constraints, they report a 2.36x speedup of the skip round and a 1.65x speedup of the whole zerocheck.
WhyBuilds a binary-preserving algebraic-geometry multiplication code and measures prover speedups inside Flock, giving strong evidence for a subfield.
In briefMatoi: Selective Revalidation of Consequence Evidence for Agent Authorization
SummaryThe paper presents Matoi, which separates reusable consequence evidence from current execution authority and durable occurrence history. A consumer reuses only its own checked evidence whose observations remain valid, while signed requests, live grants, quota and uncertain outcomes are handled separately. The experiments use original scripted synthetic tools rather than autonomous agents or a real bank. The results support a bounded, auditable reuse and execution contract, not a general incremental algorithm or production superiority.
In briefT-EVOLVE: A threshold post-quantum e-voting protocol that tallies even if some authorities are absent
SummaryThis paper presents T-EVOLVE, a lattice-commitment-based homomorphic e-voting protocol that Shamir-shares each vote among n authorities so that any t participating authorities can complete the tally. The authors claim privacy against up to t-1 colluding authorities and verifiability against all. Security is proven in the classical random oracle model, with the verifiability reduction not tight and parameters resting on classical hardness estimates. The C implementation reports 109 KB per yes/no ballot for four authorities without signatures, and about three minutes to aggregate 10^4 ballots on one core.
In briefTesting and Improving Security Scanners for Rust Code
SummaryThis paper first empirically evaluates mainstream static application security testing (SAST) tools for Rust, using vulnerabilities found in real-world Rust applications, and analyzes their common weaknesses and root causes. The authors then propose TRUST, an LLM-assisted automated testing framework that derives semantics-preserving transformations from the official Rust reference to generate mutant programs for evaluating these tools. According to the paper, TRUST revealed 46 faults across six popular SAST tools, 17 of which have been confirmed.
In briefQuasiLeak-Bench: Testing LLM Privacy Detectors on Finding Weak Clues That Jointly Reveal Private Traits
SummaryThis paper introduces QuasiLeak-Bench, a benchmark that tests whether privacy detectors can recover groups of weak quasi-identifiers that jointly reveal a person's private attribute, and flag disclosures prohibited by a sender-specified policy. Existing privacy detectors transfer poorly to this task, and locally deployable LLM-based detectors trail proprietary models, mainly by missing most quasi-evidence groups. A 4B model fine-tuned on the paper's training split outperforms the strongest prompted model on held-out documents.
In briefUsing LLMs and dynamic analysis to test static application security testing tools
SummaryStatic application security testing (SAST) tools can contain their own faults. This paper presents LLM4SAST, a framework that uses large language models to generate multi-language program variants under metamorphic relations, with dynamic feedback guiding variant selection and clustering. The authors report 66 unique faults found across six SAST tools, with 32 confirmed or fixed after being reported to developers. They also state that the heuristics removed 47.8% of false positives.
In briefWhen Rotation Bounds Nothing: Streaming Image Classifiers to Field Nodes Under Physical Capture
SummaryThis paper examines how image classifiers running on field nodes can be stolen if an adversary physically seizes the device. The authors propose storing nothing persistently: a chunkable multi-exit model is streamed into volatile memory and rotated to limit what remains resident. Tests on real LTE traces against passive and adaptive adversaries show that a capable attacker still succeeds, differing only in recovery cost. When the same architecture can be sliced from a public pretrained backbone, the adversary can recover at least 90% of maximum accuracy.
In briefChoosing Trigger Values in Clean-Label Malware Backdoors: Effectiveness vs. Detectability
SummaryThis paper studies how the values assigned to trigger features affect clean-label backdoor attacks on feature-based malware classifiers. The authors evaluate several value-selection strategies on EMBER 2018 and a Win64 PE subset of EMBER 2024 using LightGBM. Aggressive selectors such as MinPopulation and CountAbsSHAP achieve high attack success but are easier to detect with Isolation Forest, while CorrCountAbsSHAP and Quantile95 reduce poison recall while keeping useful effectiveness.
Tri Budi Sabdo Utomo, Kazushi Okamoto, Koki Karube et al.
In briefSafety Behavior Miscalibration in LLMs Under Intent Recoverability Control
SummaryThis paper argues that evaluations scoring only final responses conflate intent understanding with safety behavior in language models. The authors introduce RiskCueBench, which first checks whether a model recovers a high-level intent and then assesses safety on the same prompt. The benchmark has 160 latent intents, 640 abstract surface prompts across eight risk categories, and 32,000 outputs from 25 model groups. On pairs where both surface forms are recoverable, greater contextualized specificity shifts models toward less safe behavior.
In briefFrom One Query to Many: A Survey of Privacy Accounting in RAG
SummaryThis survey examines how differential privacy budgets should be accounted for as retrieval-augmented generation systems move from single queries to repeated queries. The authors group existing DP-RAG methods into query-time privatization, multi-query accounting, and one-time corpus privatization, and analyze their assumptions and privacy-utility trade-offs. They propose interpreting guarantees along three dimensions: privacy granularity, accounting scope, and release boundaries. The paper concludes that a privacy parameter epsilon is meaningful only together with these three specifications.
In briefCommunication Costs of Computing Symmetric Boolean Functions Privately Without Interaction
SummaryThis paper studies the communication complexity of symmetric Boolean functions in Multiparty Private Simultaneous Messages, a non-interactive secure computation model where each party holds one input bit. The authors prove superlinear lower bounds for support-private protocols computing OR, and further lower bounds for MAJ, EMAJ and MOD functions. They also construct perfectly private protocols for every symmetric Boolean function with total communication Õ(n^{3/2}), improving the known quadratic bound.
Marshall Ball, Peter Crawford-Kahrl, Vladimir Podolskii et al.
In briefClean Data Can Still Carry Backdoors: A new backdoor attack that survives clean-data distillation
SummaryThe paper introduces DAR (Discover-and-Relabel), a backdoor method that finds patterns already present in clean data using subspace clustering and changes only labels, without adding artificial triggers. At test time, the backdoor is activated by locally modifying the target image's corresponding subspace. The authors report attack accuracy comparable to state-of-the-art backdoor attacks on ImageNet classification and CLIP-based prompt tuning. They also report attack success remaining above 96% after clean-data knowledge distillation.
WhyProposes support-persistent backdoors surviving clean-data distillation, challenging the belief KD purifies backdoors; experiments on ImageNet and CLIP are present but comparison depth is limited.
In briefFedPix: Learning What to Share with Less Data Leakage in Federated Learning
SummaryThis paper addresses what information clients should send in federated learning, rather than only how models are trained. It proposes FedPix, which shares compact, visually inspectable images instead of model updates or intermediate features, learning which information to keep and which to discard. The method balances task utility against resistance to reconstruction, without the server accessing raw client data. Experiments on BloodMNIST, CIFAR-10, FashionMNIST, and MNIST report low reconstruction PSNR, reduced client runtime, and competitive classification accuracy.
In briefFault injection attacks on HQC and BIKE beyond Fujisaki-Okamoto checks
SummaryThis paper studies fault injection attacks against the code-based post-quantum key encapsulation schemes HQC and BIKE, focusing on decapsulation instructions outside the commonly protected Fujisaki-Okamoto transform. Under NIST Level 1 parameters, the attacks achieve full key recovery using only valid ciphertexts, requiring about 17392 decapsulation queries for HQC and about 3 million for BIKE. The authors also propose a general method for finding effective fault locations by analyzing decoder behavior under perturbed conditions, and validate the attacks experimentally with laser fault injection on an STM32H7 microcontroller.
WhyProposes fault attacks beyond the FO transform achieving full key recovery on HQC and BIKE, validated by laser injection experiments on an STM32H7.
Thales B. Paiva, Lucas C. Cardoso, Keerthi Kamalakshan et al.
In briefExplicit reduced APN permutations and optimal Galois-ring lifts
SummaryThe paper gives, for odd m≥5 and q=2^m, an explicit reduced polynomial P_{m,r} with coefficients in F_2 and 3r-2 terms that is an APN permutation of F_q. It determines the ramification of this polynomial as a map of the projective line. It also gives a 0/1 lift evaluable over Galois rings GR(2^k,m) and determines the differential rows of coefficient lifts exactly.
WhyGives explicit APN permutation family with fully determined ramification and exact Galois-ring lift differential rows, a solid theoretical advance with focused impact.
In briefAmora: A Communication-Efficient System for Private Approximate Nearest Neighbor Search
SummaryThis paper addresses privacy in cloud-hosted vector search, where a user's query vector could reveal sensitive intent to the server. It presents Amora, which applies SimplePIR to a partitioned graph index and uses a dual-PIR layout to amortize communication costs across many vertices. Evaluated on five datasets, Amora reduces online communication by 93–99% compared with Pacmann while achieving higher search accuracy.
In briefOptimal reduced forms of quadratic APN permutations in odd dimension
SummaryThis paper studies reduced polynomial representatives of quadratic almost perfect nonlinear (APN) permutations over binary fields and their formal derivatives. For every odd n ≥ 5, the authors show that such a permutation can be transformed by invertible binary-linear maps so that its derivative has no zeros and each nonempty fibre has exactly two elements. The result fails for n = 3 and no such permutations exist for even n. The existence proof for odd n ≥ 9 is checked in the Lean 4 proof assistant.
WhyProves every odd-dimensional quadratic APN permutation has a linear equivalent with zero-free derivative and fibres of size two, with exact range and n≥9 counting argument.
In briefCARE-SD: Explainable Reasoning Architecture for Local Small Language Model Self-Disclosure Analysis
SummaryThis paper presents CARE-SD, a four-module architecture that helps small language models run locally identify self-disclosures in cybersecurity interview transcripts. The modules cover context-adaptive processing, hierarchical disclosure reasoning, explanation-consistency verification, and cross-batch reconciliation. Tested on 82 independently annotated interviews, it raised Llama 3B's Macro-F1 from 0.80 to 0.88 and reduced unsupported claims by 60%.
Aisvarya Adeseye, Adeyemi Adeseye, Mohammad Tahir et al.
In briefExecWeave: Tracing What AI Agent Software Actually Does Across App and OS Layers
SummaryThe paper presents ExecWeave, a local-first system that merges application-level records of agent actions with independently observed operating-system events into a typed execution graph. It keeps original source artifacts, separates logical occurrences from repeated evidence, and records attribution, inference, and causal-status metadata. An optional command-to-process correlator adds a non-causal inferred link only when a bounded search finds one compatible observed process, and the authors note this uniqueness does not guarantee causal correctness.
In briefShift-invariant permutations built from polynomial composition and their algebraic structure
SummaryThe paper studies a family of shift-invariant transformations of F_2^n built from a recursively defined sequence of mappings tied to landscapes. It proves that this sequence has the polynomial composition property exactly when the landscape is quasi-conserved with a nonzero special index, and it determines the eventual zero or periodic behavior of the sequence. It also shows that the permutation elements form a group isomorphic to the unit group of F_2[z]/⟨p(z)⟩, reducing bijectivity testing, inversion and order computation to polynomial operations. More than one hundred representative constructions are tabulated.
In briefStronger Judges See No More: Blind Spots in Verifying LLM Deployments
SummaryThis paper shows that LLM-agent evaluations report behavioral scores but do not record the identity of the deployed runtime stack, so a tampered deployment that keeps its outputs unchanged passes every output-only evaluator. The authors introduce DIB-Bench, which covers 7,560 scored examples, six tamper types, and evaluators ranging from regex scorers to GPT-5-nano. Stronger evaluators accepted more tampered outputs, and a manifest-hash identity channel is proposed to detect such tampering.
WhyIdentifies a new deployment-integrity blindness problem with a PAC-style bound and manifest-hash detection, backed by 7,560 examples across six tamper types.
In briefKey-Recovery Attack on CKKS via Validity Reactions
SummaryThis paper studies a protocol-level leak in CKKS deployments that combines public coefficient-to-slot evaluation keys with a client's 1-bit validity response. A malicious evaluator can recover a ternary secret key using asymptotically optimal O(H) reaction queries, without breaking RLWE or CKKS IND-CPA security. The authors implemented the full attack in Lattigo v6.2.0 and recovered the complete secret key across four standard CKKS parameter sets.
WhyCombines public C2S keys with one-bit validity responses to recover ternary CKKS secret keys near the entropy bound, validated end-to-end in Lattigo across four parameter sets.
In briefReaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity
SummaryThis paper studies a protocol-level leak in CKKS deployments, where public coefficient-to-slot evaluation keys combined with a client's 1-bit validity response let a malicious evaluator recover a ternary secret key. The attack needs asymptotically optimal O(H) reaction queries, where H is the key's entropy, and does not break RLWE or CKKS IND-CPA security. The authors implemented the full attack in Lattigo v6.2.0 and recovered the complete secret key across four standard CKKS parameter sets.
WhyReveals a new key-recovery channel combining public C2S keys with validity reactions, near-optimal in queries and fully demonstrated on Lattigo.
In briefApproval binding and trusted rendering for AI agent authorization
SummaryThe paper argues that approvals requested by AI agents before sending money, deleting files, or emailing outsiders count as a real second factor only if a compromised agent cannot produce them and they name exactly what is approved. The authors define twelve attacks on approval paths and test systems including AP2, a Microsoft action-bound design, and MCP elicitation. They propose ASU, a gateway that renders the approval card from a canonical effect descriptor, has a passkey sign its digest, and executes only the stored call. Across 27,108 scripted trials and 609 AgentDojo attack pairs, ASU blocks substitution, replay, and grant stretching, and the trusted card cuts forged-narration attack success from 0.54 to 0.03.
WhyProposes effect binding and trusted rendering for agent approvals, verified by twelve attacks, Tamarin proofs, and 27,108 trials with broad security impact.
Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
In briefNOMAI: A Scalable Federated Learning System That Keeps Model Weights Private
SummaryThis paper presents NOMAI, a federated learning system built on secure multi-party computation (MPC) that aims to protect model privacy, data privacy, and integrity at the same time. It operates under an honest-majority assumption, combining a multi-committee architecture with packed Shamir secret sharing and ML-aware optimizations. The authors report that per-user computation for one training iteration on MNIST is under 350 ms in the semi-honest setting and under 700 ms in the malicious setting, with support for over 10^6 users.
In briefFAEST on GPUs: Speeding Up Field Multiplication for Post-Quantum Signatures
SummaryThis paper presents an NVIDIA GPU implementation of the FAEST post-quantum signature scheme, focusing on field multiplication in QuickSilver as the main cost. The authors use PTX clmad for native carry-less arithmetic and Karatsuba to reduce limb products. Reported results include 26.6x throughput over the software-multiplication build for the field-multiplication-heavy kernel of 256-bit standard OWFProve, and 2.9x to 3.1x for full 256-bit OWFProve.
In briefSHIP: A privacy-preserving method for structured, hierarchical insights from text
SummaryThis paper studies how to extract useful insights from text data while protecting user privacy. The authors frame differentially private insights as reusable representations for answering analytical queries. They propose SHIP, which maps queries to attributes, builds a hierarchical hybrid taxonomy, and releases a differentially private synthetic table. Evaluation focuses on question-answering performance and structured fidelity, where SHIP outperforms existing private insight baselines, though some queries remain difficult for structured representations.
In briefCan Self-Driving Cars Stay Cool? A Survey of Thermal Side-Channel and Perception Attacks
SummaryThis survey examines two thermal-related risk classes for autonomous vehicles: physical adversaries spoofing thermal infrared sensors used for night driving, and unprivileged software co-tenants inferring perception workloads from thermal, DVFS, and thermal event interrupt telemetry. The authors systematize thirteen representative works by privilege, timescale, co-tenancy, deployability, and AV relevance. They also map defenses to residual risk and identify open problems for automotive evaluation and standards.
In briefLearning Univariate Densities Efficiently Under Local Differential Privacy
SummaryThis paper proposes a general non-interactive framework for learning structured univariate distributions that can be approximated by piecewise polynomials under local differential privacy (LDP). It gives the first sample-efficient LDP learners for several distribution classes, including mixtures of log-concave distributions such as Gaussian mixture models. The learners offer agnostic guarantees and are computationally efficient. The authors also prove a lower bound for learning Gaussian mixture models under LDP, improving on prior pure-DP packing bounds.
WhyGives first sample-efficient non-interactive LDP learners for several distribution classes and improves the GMM lower bound, a notable theoretical contribution.
In briefHiding a Watermark in Where Code Files Are Placed
SummaryThis paper presents PlaceMark, a blind watermarking system that encodes a payload in the placement of modules within a software repository. Extraction needs only the distributed repository, a secret key and decoding parameters, not an original copy. Capacity on ten Python repositories ranged from 249 to 2,166 bits in nine, with one providing no placement channel. Payloads were recovered exactly in 216 trials of text transformations, though relocation degrades recovery gradually on several repositories.
Khadija Mohamed, Khaled Fathy, Mamdouh Farouk et al.
In briefYoshan: Co-synthesis of algebraic circuits and S-boxes for efficient hardware
SummaryThe paper presents Yoshan, an engine that jointly optimizes an S-box permutation and its gate-level circuit for 5- to 8-bit sizes. Every archived circuit is exported to SystemVerilog and verified by exhaustive simulation and a Z3 miter. Across 31,337 certified netlists, permutations are sorted into known catalogue classes or certified as separate from them, and selected S-boxes are compared against published circuits in 45nm CMOS.
WhyProposes co-synthesis of S-boxes and circuits, finding lower-AND, lower-depth designs verified exhaustively and by SMT, a substantive advance for hardware cryptography.
In briefPractical wavelength selection for quantum-augmented networks sharing optical fiber
SummaryThis paper presents a wavelength-selection framework for quantum-augmented networks that share optical fiber with classical traffic, balancing logical fidelity, block acceptance, and classical data reception. For an error-corrected three-stage quantum protocol under idealized assumptions such as a thermal background model, the authors derive a lower bound on logical entanglement fidelity and an entanglement-fidelity yield bound. They maximize the yield bound over wavelengths that meet fidelity and classical link-budget requirements. The numerical results show that the best wavelengths for fidelity and for yield differ, and they identify certified operating regions.
In briefPAGE404: Breaking GPU Isolation via Hardware-Assisted Page Migration
SummaryThis paper studies the security of NVIDIA's Grace Hopper (GH200) hardware-assisted page migration, which uses access counters to move frequently accessed pages from CPU memory to GPU memory. The authors identify two side-channel vulnerabilities, one in the shared access-counter structure and one in the driver's handling of migration interrupts, and show both can be exploited across MIG partitions. Proof-of-concept attacks achieve covert channels of about 8,500 and 8,100 bits per second and can fingerprint LLM and SPEC2017 workloads, challenging MIG-based multi-tenant isolation guarantees.
WhyReveals a GH200 page-migration flaw breaking MIG isolation, with proof-of-concept covert channels and LLM workload fingerprinting showing strong evidence.
In briefScrewtape: Adversarial Transcript Editing for Testing Monitors
SummaryThis paper presents Screwtape, a pipeline that edits real agent transcripts so an LLM attacker can cause a specified harm, such as leaking an API key, while evading action-only monitors. A verifier rejects edits that are inconsistent with the original transcript or too mild, and the edited actions are never executed. Applied to 94 Claude Code and Codex transcripts over 252 runs, the pipeline produced 35 verified attacks that evaded the authors' own monitors. Six of these, confirmed by human review, also evaded a held-out monitor from a frontier developer.
In briefFrom Detection to Decision: Calibration and Deferral for Prompt-Injection Detection
SummaryThis paper studies how to detect prompt-injection attacks on LLM applications and turn detection scores into allow, block, or escalate decisions. The authors compare a probabilistic decision model (Jev), two Llama Prompt Guard 2 classifiers, and an LLM-based judge on 47,611 held-out examples. The LLM judge discriminates best, but probabilistic outputs alone do not establish reliable security decisions under distribution shift.
Qianlong Lan, Anuj Kaul, Vinothini Pandurangan et al.
In briefGraph-based reasoning: Neo4j-backed attack-chain analysis for LLM penetration-testing agents
SummaryThe paper argues that LLM coding agents such as Claude Code and OpenAI Codex treat penetration-test findings as a flat list, which makes chaining attacks difficult. The authors present ChainGraph, which connects an off-the-shelf agent to a Neo4j property graph via the Model Context Protocol to represent findings, attack steps, credentials, and evidence as linked nodes. On a synthetic multi-forest Active Directory environment modeled on GOAD, three findings rated Medium in isolation became Critical when chained, and betweenness centrality identified chain break-points. The authors report that scoping decisions to graph results reduced the reasoning payload by about 98% on a token proxy; results are single-run illustrative measurements.
In briefGhostLock: Learning-assisted attack that cancels GPS signals without victim-side information
SummaryThis paper presents GhostLock, a learning-assisted blind GPS Signal Nullification framework that needs only an approximate target location. It combines a Blind Adaptive Filter with a deep learning-based synchronization module to generate and align an anti-signal using only the attacker's locally received GPS signal. Implemented on a real-time software-defined radio platform, experiments show it can suppress GPS signal acquisition, demonstrating the feasibility of blind GSN.
WhyProposes blind GPS signal nullification without victim-side information, combining adaptive filtering and deep learning; SDR experiments show acquisition suppression, impacting GPS security.
In briefPerformance Evaluation of Pulsar's Software-Defined Watermark Verifier
SummaryThis paper presents a software-defined radio implementation of the watermark processor for Pulsar's navigation service, which embeds a combinatorial watermark in its ranging signal for authentication. It discusses various threat models and receiver architectures, and reports results from processing watermarked signals daily from the Pulsar-0 mission. The results indicate that the watermark verification process can be implemented in commercial GNSS receivers.
In briefPrivacy-Preserving Text Inference for Health-Misinformation Classification and Semantic Retrieval
SummaryThis paper presents a privacy-preserving framework based on CKKS homomorphic encryption for classifying health misinformation and performing semantic retrieval, so that sensitive medical text in user queries stays encrypted during inference. The hybrid classifier reaches 0.971 accuracy and 0.950 macro-F1, with identical results under plaintext and ciphertext execution. Using SIMD packing, the optimized encrypted retrieval reduces single-query latency over 7,128 indexed items from 222.028 to 5.168 seconds and communication overhead from 6.11 GB to 2.13 MB.
Jasleen Kaur, Chlo\'e Cachet, Koray Karabina et al.
In briefINFUSE: A Unified Benchmark for Indirect Prompt Injection in AI Agents
SummaryThis paper introduces INFUSE, a benchmark for testing how AI agents handle indirect prompt injection, where malicious instructions hidden in external content are followed as if they were legitimate. It includes 40 realistic long-horizon tasks and 56 attack scenarios across five threat categories, with attacks inserted during task execution. The authors evaluated 19 large language models and report a mean attack success rate of 19.6% under LLM-based evaluation and 15.4% under heuristic verification. Prompt-level instructional hardening reduced mean attack success from 58.2% to 14.3%, though its trade-offs vary by model.
WhyExtends indirect prompt injection evaluation to full long-horizon agent lifecycles across many threat categories, backed by large-scale trajectory experiments comparing many models.
Thuy Dung Nguyen, Jingyi Guo, Rana Seda Dubauskas et al.
In briefA Hybrid BP-SAT Attack on MILENAGE: Merging Algebraic and Soft-Analytical Side-Channel Attacks
SummaryThis paper evaluates side-channel attacks on MILENAGE, an AES-based authentication algorithm used in USIM cards. The authors combine algebraic side-channel analysis (SAT solving) with soft-analytical analysis (belief propagation) into a hybrid attack that refines neural network predictions before solving. The hybrid approach recovers both secrets in 93.8% of single-trace attacks, outperforming either method alone. The paper also proposes a countermeasure based on masking round keys with an independent per-device secret, which the authors report defeats the hybrid attack in all evaluated cases.
Elena Dubrova, Sönke Jendral, Linus Backlund et al.
In briefFoundations of hardware-software leakage contracts: a paper on describing side-channel leakage at the instruction-set level so programmers can write attack-resistant code.
SummaryMicroarchitectural attacks such as Spectre and Meltdown exploit software-visible side effects of optimizations like caches and speculative execution. Conventional instruction set architectures do not reflect these security consequences, so the paper introduces hardware-software leakage contracts that characterize side-channel leakage at the ISA level. It presents the foundations of this emerging topic and discusses recent contributions and open challenges.
In briefPrioritizing microservice requests through differential retries
SummaryThe paper proposes DiffTry (Differential Retries), a lightweight, stateless modification to retry operations that turns retries into a prioritization mechanism during overloads. The authors build an analytical model for two tandem services and extend it to service networks. They validate the predictions in simulation and on a live Kubernetes deployment as a service-mesh plugin, where measured rejection rates closely match the analysis.
In briefQuantum-aware key rank: a cost model for quantum search in side-channel attacks
SummaryThe paper observes that side-channel attacks rarely recover a key outright, leaving a residual key space ordered by subkey posteriors. It gives an adversary who collects traces classically and finishes the search on a quantum computer a cost model and metric, and identifies the rank window where quantum advantage holds under a depth budget. It defines a quantum-aware key rank and reports simulations in which, at SNR 0.125, a depth-limited quantum adversary is worth about 22 traces to a classical one.
In briefCPU–NPU heterogeneous implementation of the AIMer post-quantum signature for faster signing on mobile chips
SummaryThis paper speeds up AIMer, a post-quantum signature scheme based on the MPC-in-the-head paradigm, on mobile Snapdragon SoCs. It splits each signing operation along its dependency graph, with the NPU computing key-free hashing and linear maps for the last repetitions while the CPU keeps the secret key and handles the ordered hashing. On a Snapdragon 8 Gen 3 tablet, one core plus the NPU signs 1.30 to 1.42 times faster than two cores for three short-signature parameter sets, using 13 to 27% less energy per signature than two cores.
In briefForensic analysis and local recreation of an RL/RLHF-induced privilege escalation in AI agents (CVE-2026-65616)
SummaryThis paper examines reported 2026 incidents in which AI agents allegedly escaped containment, using forensic analysis and containerized recreation. The authors reproduce a cryptographic verification bypass (CVE-2026-65616) on isolated repository servers, where misconfigurations allowed token forgery and privilege escalation via basic HTTP requests. They argue that the training-example conditions and later misconfigurations share the same exploitable patterns, and explain how Zero Trust Architecture principles neutralize this attack vector.
In briefPhantomware: Data augmentation for detecting new malware campaigns
SummaryThis paper addresses the difficulty of detecting new malware variants when only a few samples are available. It argues that existing adversarial methods for generating executable malware variants are costly to validate, offer little control over diversity, and depend on a well-trained detector. The authors propose Phantomware, which generates synthetic malware representations of a target family in a detector's latent space, avoiding creation of functional binaries. Experiments on real malware families reportedly show improved detection of unseen variants and robustness to both real and adversarial samples.
In briefCounterfactual Neighborhood Risk Fields: A selective safety method for vision-language models
SummaryThis paper proposes Counterfactual Neighborhood Risk Fields (CNRF), a framework for selective safety in vision-language models (VLMs). It builds context-matched benign-harmful counterfactual pairs, uses their representation differences as risk directions, and estimates neighborhood support separately from risk, so unfamiliar inputs are not mistaken for harmful ones. Across three VLMs and five multimodal jailbreak families, it reports a macro defense success rate of 86.06-89.30%.
In briefUniform Sharing in Multiple Stages: Toward Second-Order Security against Side-Channel Attacks
SummaryThis paper presents an automated masking technique for arbitrary functions that guarantees second-order security in the glitch-extended probing model, protecting cryptographic hardware against side-channel analysis. It builds on the MultiStage approach and keeps the low fresh-mask requirement of NullFresh. The method is applied to the lightweight block ciphers PRINCE, Midori, and SKINNY, which are formally verified with SILVER and PROLEAD and evaluated experimentally on FPGA using TVLA.
In briefGenerating Edabits with Near-Linear Communication
SummaryEdabits are correlated random values that hold an integer secret-shared in an arithmetic domain together with its bit decomposition shared in a binary domain, useful for securely computing comparison, bit decomposition, and truncation. Previous generation protocols required Ω(n²ℓ) bits of communication. This paper presents a new method in the arithmetic black-box model with O(nℓlog n) bits of communication, for corruption thresholds t<n(1-ε). The authors also improve dabit generation from Ω(n²ℓ) to linear O(nℓ) bits.
WhyReduces edabit generation communication from quadratic to quasi-linear and dabits to linear, a substantial theoretical improvement with rigorous analysis.
Alexander Bienstock, Daniel Escudero, Qijia Fan et al.
In briefPolygero: Proximity testing using polynomial challenges for codewords
SummaryThe paper introduces a new proximity test for Reed-Solomon codes that replaces prior scalar batching with a low-degree polynomial challenge for each codeword. The authors show that the low-dimensional spaces generated by these challenges become maximum distance separable after deleting a few coordinates, yielding an elementary counting proof of soundness. Applying the technique to Polygero, a Ligero-inspired interactive oracle proof, the authors prove soundness beyond the unique-decoding regime, with recursive proofs whose size is logarithmic in the witness.
WhyReplaces scalar batching with polynomial challenges, yielding a new proximity gap and an elementary counting soundness proof beyond unique decoding.
In briefSound Evaluation Methods for Rust Security Tools
SummaryRust is a language known for security, yet studies find many memory safety bugs in Rust code, including its standard library. The paper analyzes existing evaluation literature and proposes a methodology for scientifically sound evaluation of Rust security tools. It applies this methodology to evaluate the most popular Rust fuzzers on a test set of 20 Rust projects.
