In briefShrinking code-based post-quantum key sizes for one-time keys via customized bit-flipping decoders
SummaryThis paper studies how to reduce public-key and ciphertext sizes in BIKE, a code-based post-quantum key encapsulation mechanism, when each secret key is used only once. The authors present the first optimized implementation of the BF-max decoder and combine it with other decoders to trade off decoding failure rate, execution time, and key and ciphertext sizes. Experiments report 7.8% smaller public keys and ciphertexts than LeanBIKE, with similar execution time and failure rate.
Davide De Zuane, Marco Gianvecchio, Alessandro Annechini et al.
In briefEvaluating whether tiny language models can write post-exploitation malware code
SummaryThis paper tests seven open-source small language models, ranging from 20M to 1.5B parameters, on two malware-related code generation tasks: directory enumeration and backdoor generation. It compares Python and Lua and finds that offensive code-generation ability does not scale linearly with model size, with task formulation mattering more than prompt engineering alone. The authors conclude that current models remain too demanding for widespread malware use, but rapid progress in compact models may lower that barrier, so the findings aim to anticipate AI-assisted malware and inform countermeasures.
Gabriel Hortea, Simon Pietro Romano, Juan Tapiador et al.
In briefSecurely compiling probabilistic side-channel defenses, with a verified compiler framework and open-source masking library
SummaryThe paper presents a framework, independent of language and leakage model, for provably secure compilation of probabilistic side-channel security notions. Its main contribution is a deterministic leakage-preservation relation that implies preservation of notions such as d-NI, d-SNI, and cryptographic constant-time, avoiding probabilistic proof obligations. The authors use the Rocq proof assistant to show that a model of the Jasmin compiler's core pipeline and several optimizing passes preserves security in the value-probing model with glitches. They also release libmasking, an open-source library of arbitrary-order masked gadgets in Jasmin.
WhyIntroduces a deterministic leakage-preservation relation avoiding probabilistic proofs, with Rocq-verified preservation for Jasmin optimizing passes and benchmarked masked gadgets.
Gilles Barthe, Gaëtan Cassiers, Henri Dohmen et al.
In briefMonitor-validity failures: safety evidence that never reaches LLM framework decisions
SummaryThe paper examines runtime monitors that inspect LLM tool calls, traces, and detector outputs, and finds cases where a framework keeps running while safety-relevant evidence never reaches its decision point. Using canary contracts on public framework repairs, the authors confirm 18 evidence-path failures across 11 safety project groups, 14 of which reach enforcement boundaries. They conclude that monitor assumptions need regression tests at the schemas, streams, tools, and adapters that frameworks change.
In briefSparse Secrets, Dense Problems: Masking HQC in Hardware
SummaryThis paper addresses HQC, a code-based post-quantum key encapsulation scheme being standardized by NIST, by proposing a new masking technique for sparse-dense vector multiplication with a proof of first-order security. The authors present what they believe is the first fully masked hardware implementation of HQC, covering key generation, encapsulation, and decapsulation. They also show that the Rotate-and-Add structure is vulnerable to profiled horizontal side-channel attacks, and integrate hiding countermeasures to address this.
WhyProposes a new masking method for sparse-dense multiplication and the first fully masked HQC hardware, with first-order proofs and discovered side-channel weaknesses.
In briefMobileInject: Testing How Phone AI Agents Resist Hidden Multimodal Attacks
SummaryThis paper introduces MobileInject, the first benchmark for testing whether MLLM-based mobile agents can be manipulated by malicious content in cross-application mobile environments. It covers 11 scenarios, 9 security-risk categories, and 108 executable risk instances, and proposes Cross-Modal Consistency Injection along with two enhanced attack methods. Experiments find that mobile agents are broadly vulnerable to multimodal injection, with many failures caused by early-stage reasoning hijacking.
In briefMobileJailBench: a jailbreak benchmark that evolves, testing whether mobile AI agents can be tricked into unsafe actions
SummaryThis paper introduces MobileJailBench, an evolving jailbreak benchmark for mobile agents, with 520 tasks across three jailbreak paradigms and 14 risk categories. It is built on a mobile sandbox covering over 20 widely used apps. Experiments indicate that current mobile agents are especially vulnerable to implicit jailbreaks, as their safety alignment largely fails to generalize from conversational refusal to dynamic mobile interactions. The authors report that their dynamic evolution mechanism reached a 100% attack success rate on Qwen3.5-122B.
In briefPower analysis attack on SQIsign that recovers secret keys from leaked quaternion data
SummaryThis paper studies the side-channel security of SQIsign, an isogeny-based signature scheme and a Round-3 candidate in NIST's post-quantum signature standardization. The authors identify five side-channel vulnerabilities in Round-3 SQIsign's signing procedure and give polynomial-time algebraic algorithms that recover the secret key from the leaked intermediate values. They also provide algorithms that reconstruct the full key when leakage reveals only partial bits, and perform a power analysis attack on the SQIsign source code to extract the required leakage.
WhyIdentifies five side-channel flaws in Round-3 SQIsign, gives polynomial-time key recovery, and validates leakage extraction via power analysis on the real source code.
In briefIgnored, Not Refused: Why Low Injection Success Rates Can Mislead
SummaryThis paper studies whether tool-using AI agents resist indirect prompt injection, where hidden instructions in external content try to hijack their tool calls. The authors audited 33,000 trajectories from eleven open-weight agents on InjecAgent and AgentDojo, finding that most failed attacks were ignored (76-80%) rather than refused (17-18%). Changing only the system prompt shifted InjecAgent attack success from 0.2% to 43%. The authors argue that evaluations should report how attacks fail and whether user tasks are completed, not just attack success rate.
WhyChallenges the ASR metric by auditing 33,000 trajectories, showing failed attacks are mostly ignored rather than refused; well-evidenced and useful for evaluation methodology.
Farhan Zarif, Kazi Shahid Ahmed Galib, Synthia Akter Promi et al.
In briefAgentLoupe: kernel-level labels that trace AI agent actions back to their LLM origins
SummaryThis paper presents AgentLoupe, an eBPF-based observability tool that requires no changes to applications. It attaches a kernel-resident semantic label to each LLM interaction and propagates it through processes, threads, files, and sockets. The reported average overhead is below 8%, and case studies show it can attribute cross-lineage persistent attacks to their originating LLM interactions.
In briefsafeRNSgcd: Speeding Up Falcon Key Generation Using RNS and SafeGCD
SummaryThis paper presents safeRNSgcd, a method that computes the single Bézout coefficient needed at the deepest level of Falcon's NTRU solver, while keeping large intermediate values in a residue number system. It uses centered explicit CRT with single-word fixed-point arithmetic to recover the low bits required by SafeGCD batches. Integrated into the ntrugen C implementation, it reduces inversion and private-key basis-generation costs on a Raspberry Pi 5 and two x86-64 processors compared with the original ntrugen and a variant that omits the unused coefficient.
In briefHuman Detection of Deepfake Faces Across GAN, Diffusion, and GPT-5 Models
SummaryThis paper proposes the Deepfake Face Artifact Taxonomy (DFAT), a classification of human-recognizable visual artifacts in deepfake face images, and uses it to build general and model-specific training materials. An online experiment with 524 participants compared detection accuracy on images from three GAN-based models, one diffusion model, and GPT-5. Detection accuracy depended strongly on the generative model, and training significantly improved performance, with model-specific training generally giving larger gains. A five-month follow-up with 342 participants found no significant decline in accuracy.
In briefFaster Two-Dimensional Isogeny Evaluation Using Dual Isogenies for Isogeny-Based Cryptography
SummaryThis paper proposes a new method for evaluating two-dimensional isogeny representations using dual isogeny properties, avoiding costly discrete logarithm computations. The approach is applied to isogeny-based schemes such as POKÉ and SQIsign2D. Optimized C implementations show that a fast POKÉ variant achieves up to 3.47× speedup in CPU clock cycles at the NIST-I security level.
In briefTrojan Horse: Automated attacks that poison code repositories to target coding agents
SummaryThis paper presents TrojanForge, an automated framework that poisons code repositories to attack coding agents. It parses repository structure with abstract syntax trees, selects the least conspicuous locations for payloads, and iteratively refines disguise strategies through adversarial interaction with the target agent. The authors also introduce TrojanBench, a benchmark of 384 poisoned repositories. They report a poisoning success rate above 60%, backdoor injection above 90%, and that commercial agents fail to defend against these attacks.
WhyProposes the first automated repository poisoning framework with AST-guided placement and adversarial disguise refinement, validated on a 384-repository benchmark across many models.
In briefConcrete Functions in Private Simultaneous Quantum Messages: Quantum Advantages and Limits
SummaryThis paper studies communication complexity of familiar total functions in the private simultaneous quantum messages (PSQM) model. For three-party equality, it gives an entanglement-assisted protocol using about 1.633n qubits asymptotically, while perfectly correct protocols without prior entanglement need at least 3n qubits. For three-bit majority, a shared GHZ state and one qubit per player achieve perfect correctness and privacy, beating the six-bit classical cost. For three-bit AND, no qubit protocol achieves both properties, but qutrits give a one-shot protocol with total communication 3log₂3, and a general construction for k-bit AND is provided.
In briefA zero-trust design for securing communication between AI agents in multi-agent systems
SummaryThis paper surveys security threats and cryptographic challenges in communication between AI agents, such as impersonation, message interception, and malicious prompt injection. The authors propose a zero-trust architecture that integrates agent identity, transport security, message integrity, and monitoring. It also evaluates KEMTLS with pre-distributed public keys to reduce handshake overhead, and uses zero-knowledge proofs to verify task constraints without exposing inputs.
Karol Budzyn, Adrian Brodzik, Mateusz Szczepkowski
In briefWhen Approval Becomes Execution: Attacks That Exploit Authorization Gaps in Tool-Using AI Agents
SummaryThis paper studies an attack in which an AI agent is guided through a locally consistent approval workflow to obtain a token and then use it to access a protected document. The authors report that this pattern succeeded on three document targets in a controlled benchmark and in their local validation experiments. The results highlight a gap where possession of a token is treated as sufficient authorization without checking requester identity, approver authority, or scope. The paper also discusses defenses such as context-bound tokens and service-side policy binding.
In briefAVX-512 Speedup for SQIsign 3.0 Verification
SummaryThis paper presents a low-latency AVX-512 implementation of complete SQIsign 3.0 verification, a compact isogeny-based signature scheme, at security levels I, III, and V. It vectorizes curve-side verification, including the Superglue transition, and introduces dynamic-programming strategies for isogeny chains. On an Intel Core i7-11800H, the complete verifiers are 2.14×, 2.08×, and 2.34× faster than the SQIsign 3.0 Broadwell reference verifiers.
In briefAspire: Practical batch queries on encrypted databases with no semantic leakage
SummaryThis paper addresses leakage-abuse attacks that exploit semantic leakage in encrypted databases. It distinguishes ideal zero-leakage from restricted zero-leakage, which permits only metadata such as database size and query timing, and argues the latter is enough to thwart these attacks. The authors present Aspire, an encrypted database meeting adaptive restricted zero-leakage security, using probabilistic batch codes and minimal perfect hashing for batch keyword queries and updates. Experiments on a database of 2^22 key-value pairs report amortized query latency under 1.38 ms and about 2.95 KB communication per query.
In briefVulnSAGE: Judging Static Security Scan Reports by Linking LLM Reasoning to Program Structure
SummaryStatic application security testing (SAST) tools flag operations whose safety depends on project context, so maintainers must decide which reports are real defects. The paper presents VulnSAGE, which links LLM reasoning to program structure in both directions: a slicer recovers dependencies of the reported operation, and an intermediate representation, CLAIM, records model judgments as facts citing program relations that program analysis then checks. On 187 labeled reports, it rejected 89 of 97 false alarms and kept 85 of 90 real defects.
WhyProposes bidirectional linking of LLM reasoning and program structure for SAST adjudication, validated on 187 labeled reports and real-world projects with strong results.
In briefECHO: Using Response Harmfulness Instead of a Compliance Proxy in Jailbreak Optimization
SummaryThis paper presents ECHO, an optimization-based jailbreak attack on large language models. Existing attacks maximize token-level proxies of compliance, such as the likelihood of an affirmative prefix, which cannot tell a cautious hedge from a harmful answer. ECHO instead uses continuous, response-level harmfulness scores from HarmSig, a 1.7B regressor, combined with word-level perturbations and keyword-anchored beam search under a black-box threat model. On five open-weight models using AdvBench, the authors report up to 0.898 StrongREJECT mean score and 89.23% HarmBench success.
In briefSurprise Masking: Filtering Private Training Data Using Model Likelihoods
SummaryThis paper proposes Surprise Masking (SM), a perplexity-based filter that uses a publicly available reference model to find unwanted spans in language model training data and suppress learning from them while keeping the rest of each example. On synthetic code benchmarks and fine-tuning experiments, SM reduces extraction of private values and reproduction of stylistic coding quirks while preserving performance on evaluated coding tasks. The authors also report that SM outperforms the DePA defense for poisoned dead code, while specialized detectors do better on broader credential and PII benchmarks.
Riya Tyagi, Sahra Ghalebikesabi, Vinnie Monaco et al.
In briefTransferring hyperparameters across model sizes under differential privacy
SummaryThe paper shows that Maximal Update Parametrization (μP) fails under differential privacy because high-dimensional noise and low-rank gradients have different spectral properties. It proposes DP-μP, which uses a signal-to-noise ratio condition to set layer-wise learning rate scaling, with rules for DP-SGD, DP-Adam, and DP-Muon. Experiments on MLP, ViT, and GPT-2 show zero-shot learning rate transfer across model widths that matches or exceeds individually tuned baselines at lower computational cost.
In briefSAFE-Mem: secure AI agent memory with fine-grained permissions and governance-aware retrieval
SummaryThis paper addresses the security risk that LLM agents may treat untrusted external claims stored in their persistent memory as authorized preferences or permissions. It proposes SAFE-Mem, which labels each claim with kind, authority, and scope, and uses governance-aware retrieval to block unauthorized use while keeping legitimate information. Tested on MPBench and LoCoMo with four LLM backbones, it achieves the lowest attack success among defenses that retain legitimate memory and the highest answer accuracy among all evaluated defenses.
In briefWhen Core-Network Elements Become Reachable: Field-Level Exploitability Analysis of Diameter
SummaryThis paper presents LENS, an LLM-based system for reliable field-level exploitability analysis of the Diameter protocol used in cellular core networks. It guides models with analysis discipline and protocol evidence, and can generate proof-of-concept attacks. The authors report that over 25% of field paths in the S6a and Cx interfaces are exploitable under their threat model, and uncover 95 unknown vulnerabilities, plus 118 more across 16 other protocols.
WhyCombines LLM analysis discipline with protocol evidence for Diameter; finds 95 unknown vulnerabilities across real deployments, with broad impact.
In briefProvable Compliance: a protocol for verifiable compliance evidence at decision time
SummaryThe paper presents ChainIT Provable Compliance, the compliance layer of the ChainIT Authority Protocol, which gives relying parties compact, attributable proof of the evidence, policy, and transaction context behind a compliance decision. Each fact is recorded as a separate evidence assertion with provenance, freshness, confidence, and permitted purpose, and a versioned policy profile and rules engine produce reason-coded results. The resulting signed, time-bounded decision contributes one predicate to transaction policy and does not by itself authorize payment.
In briefRAMP: A Framework for Quantum-Safe Key Distribution Offered as a Service
SummaryThis paper presents RAMP, a framework that separates quantum key distribution (QKD) key material generation from key use, so providers run QKD hardware while users process the supplied raw keys locally without QKD devices. The authors formalize two complementary confidentiality guarantees that hold as long as the masking domain or the QKD source and acquisition paths, respectively, remain secure. Using experimentally acquired QKD data and standardized quantum-safe cryptography, they implement RAMP on commodity hardware, reporting an average key-distillation throughput of 2.1 Kb/s on an M4 Pro CPU.
In briefIdentify, Classify, Act: Per-Instruction Controlled Compliance for LLMs Over External Data
SummaryLLMs that process external data such as documents or tool outputs often encounter legitimate instructions mixed with adversarial prompt injections. Existing defenses either trust or suppress all such instructions, causing over-refusal or over-compliance. The paper proposes EDIC, a decomposed reward framework that classifies each embedded instruction and trains the model to follow beneficial ones while rejecting harmful ones. Reported results across two backbones and five benchmarks show improvements in both safety and utility over the strongest prior defense.
In briefCovert poisoning attack exploiting reused reasoning KV cache in LLMs
SummaryThis paper studies a security weakness in large language models that reuse key-value caches from reasoning traces. The authors propose R²ECAP, a black-box attack that plants poisoned reasoning traces solely through a system's chat interface, so residual adversarial influence persists in a retained trace's cache after the preceding trace is discarded. Evaluated on three open-weight LLMs and three datasets, it achieves up to 79% attack success rate and outperforms the white-box HijackKV attack in 8 of 9 resource-constrained settings. Only 1% of its retained responses were flagged by a popular prompt injection detector.
In briefByzantine Broadcast with Near-Quadratic Communication
SummaryThis paper presents a deterministic Byzantine broadcast protocol for n parties that remains secure against up to t<n faults. Its communication complexity is O(n²log⁴(n)λ), where λ is a security parameter, and it runs in O(t) rounds. The protocol improves on the 1983 Dolev–Strong protocol.
WhyImproves the 1983 Dolev-Strong bound to near-quadratic communication, a notable theoretical advance supported by proofs.
In briefSwiftAuth: Privacy-preserving UAV authentication with aggregated credentials and non-interactive authorization
SummaryThis paper proposes a traceable, aggregatable tagged witness signature (TA-TWS) and builds an anonymous authentication framework called SwiftAuth on it. Asynchronous credential distribution lets issuers generate authorization components while users are offline, and multiple credentials are compressed into a constant-size form to reduce overhead for concurrent multi-service access. A regulatory trapdoor allows authorities to trace malicious actors after protocol violations, and the authors claim formal proofs of unforgeability and witness hiding, with experiments on resource-constrained devices and Aliyun servers.
In briefGRAD: A Graph-Based Defense Against Distributed Attacks on LLM Agents
SummaryThis paper addresses memory poisoning and decomposition attacks that spread malicious evidence across the operations of large language model agents. The proposed GRAD method aggregates evidence over an execution graph into a graph-level risk score and adds detection experts on frozen encoder snapshots as tasks arrive (Continual Antibody Adaptation). The authors report AUROCs of 97.19%, 77.59%, and 86.60% on Decomp, MCP, and MRT, and a 13.08-point final accuracy gain over Replay on a cross-dataset task stream.
In briefWatermarkability: How Well Language Models Accept Logit-Based Watermarks
SummaryThis paper introduces "watermarkability," a measure of how compatible a language model is with logit-based watermarks that boost chosen token sets during decoding. It defines the watermarkability cost as the expected minimum KL divergence from the base model needed to reach a target probability mass on the requested tokens. The authors propose a two-stage method: a target-set-conditioned low-rank adapter, followed by a closed-form controller that applies the smallest uniform logit bias. Tested on OPT-125M and Qwen3-8B, the cost correlates with perplexity increase under a fixed-bias baseline, and the method reduces perplexity while keeping at least 99.80% of tokens in the target set.
In briefVeil-then-Reveal: Reversibly Pseudonymizing Personal Data to Protect Privacy When Using LLMs
SummaryThis paper presents Veil-then-Reveal (VtR), a framework that runs on the user's side and replaces personally identifiable information in prompts with realistic same-type surrogates before sending them to remote LLM providers, keeping plaintext PII on the device. Structured PII such as phone and credit-card numbers is handled with format-preserving encryption, while semantic PII such as names and organizations uses a keyed-hash dictionary and secure vault. On three datasets with 11,322 annotated PII instances, the authors report 97.9% detection recall, 95.2% protection of detected values, and 99.9% round-trip restoration.
Mohamed Elmahallawy, Mohamed Shaaban, and Thomas E. Carroll
In briefShorter Hash-Based Signatures Using Guarded Sharing in a DAG Model
SummaryThis paper proposes BGS-CC, a stateless hash-based signature scheme that introduces a new technique called guarded sharing and moves from a tree-based to a DAG-based structure. It combines guarded sharing with bucket thinning, hash chains, and rejection sampling to improve the few-time signature BPORS-C+BFP. The authors report that at 128-bit security with a use quota of 2^24, complete signatures are 2,228 bytes, which they claim is the first SPHINCS-based stateless signature shorter than the 2,420-byte ML-DSA-44 scheme.
In briefLLM-Attack Suite: a shared framework for testing privacy leaks in split LLM systems
SummaryThe paper presents LLM-Attack Suite, a framework for evaluating privacy risks in split language models, where intermediate representations sent to a server can allow text reconstruction. It records attacker observations, model weights, datasets and scoring rules so that evaluations can be checked and compared. In a controlled GPT-2 experiment, giving attackers training-time gradients raised token recovery from 94.20% to 97.38% and exact-document recovery from 13.71% to 37.77%.
In briefACE: An AI-Orchestrated Intrusion Detection and Compliance Mapping Engine
SummaryThis paper proposes ACE, an AI-orchestrated framework that links intrusion detection, regulatory control mapping, and automated defensive rule deployment. It was tested in a two-virtual-machine lab using eight simulated attacks and three legitimate traffic tests. ACE detected all attack alerts with zero false positives on legitimate traffic, generated deployable rules for 37.5% of alerts, and achieved an average NIST control-mapping confidence of 0.87. The authors note the evaluation was limited in scope and requires validation on enterprise-scale telemetry.
Abdoulie Ceesay, Rishikesh Sahay, Md Rasel Al Mamun et al.
In briefPaper: Securing AI Agent Web Browsing with Web Semantics (Intact)
SummaryAI agents read webpages as screenshots or text, so injected third-party content can persuade them to use the user's authority improperly. The paper proposes Intact, which runs on an unmodified browser, builds GenTree to capture provenance and web semantics, and passes the page to the LLM one element at a time, asking the user before acting on third-party content. On 1,091 webpages with injected attacks, only 12.8% of attacks got through Intact's planner, compared with 73.1% for a conventional planner. Isolation disrupted functionality on 3.7% of tasks.
WhyProposes GenTree and element-level isolation enforcing web semantics, cutting injected-attack success to 12.8% across 1,091 attacked pages, a notably novel approach.
In briefComparing how training methods trade off language model capability against private data leakage
SummaryThis paper compares data-level and training-level methods on synthetic medical records, using canary samples to test for leakage. Direct finetuning gives the best capability but the most leakage, while DP-SGD reduces leakage at a substantial cost to capability. Privacy-aware rewriting of records, guided by an instruction to replace uniquely identifying details, offers a more favorable balance than naive paraphrasing.
Zihao Zhao, Avi Schwarzschild, Casey Meehan et al.
In briefStratFL: Defending Federated Learning Against Intermittent Hidden Model Poisoning
SummaryThis paper studies covert model poisoning, a persistent threat in federated learning where an attacker sneaks corrupted model updates in intermittently. The authors model the server-attacker interaction as an imperfect repeated game in which neither side sees the other's actions. They propose the StratFL adversarial search algorithm and belief update algorithms for both server and attacker. Experiments on MNIST and CIFAR-10 show empirical convergence of the belief updates and about 10% higher accuracy than state-of-the-art methods.
In briefBroad and Efficient PII Detection with Unified Labels
SummaryThis paper presents a 141M-parameter encoder-based detector for personally identifiable information (PII), trained on 1.12 million examples from 77 public datasets relabeled under a unified definition covering 12 structured PII categories. On the AI4Privacy and Nemotron-PII benchmarks at a low false-positive rate, it achieves the highest recall against larger baselines in most comparisons. It also runs 2-10x faster and uses 94-97% less peak GPU memory than those baselines.
In briefCan SOLARBURST reach chip design? Software supply chain attacks on VLSI design flows
SummaryThis paper systematically analyzes the vulnerabilities of VLSI design flows from a software supply chain perspective. It empirically examines VLSI software suites' composition, security features, and tool interactions, then builds an attack taxonomy identifying 717 possible new attacks, 60 of them highly feasible. The authors produce a threat model, evaluate existing defenses, and present case studies using an open-source VLSI reference design flow.
WhySystematically analyzes VLSI design-flow attack surfaces via software supply chain, yielding a taxonomy of many new attacks; evidence from empirical tool analysis and open-source case studies, though
In briefModel-as-a-Trojan: Malicious Behavior Hidden in an LLM's Weights
SummaryThis paper shows that open-weight language models could carry malicious behavior within their weights rather than in external code. The authors fine-tune a model so that, when it infers a shell tool is available, it reads a secret from the environment and leaks it through DNS queries to an attacker-controlled name server, then answers normally. The authors report that the attack works behind an egress firewall allowing only DNS, and that prompting was unreliable at suppressing it.
WhyIntroduces a novel threat of weight-embedded DNS exfiltration bypassing sandboxes; thorough multi-configuration resolver-side verification with broad security impact.
In briefFinding Hidden File Access in MCP Servers at Scale
SummaryThis paper studies a vulnerability in MCP (Model Context Protocol) servers, where attacker-steered arguments make a tool read sensitive host files beyond its declared scope. The authors built MCP-FSD to analyze 21,097 servers and found 787 (16.4%) of triaged servers with filesystem capabilities despite non-filesystem classifications. Dynamic validation confirmed 150 vulnerable instances under tested sandbox policies, and coordinated disclosure led to 13 security advisories.
WhyIntroduces a new MCP vulnerability class, validated at scale across 21,097 servers with 150 exploitable instances and CVEs.
In briefPrivacy-preserving retrieval-augmented generation using random projection
SummaryRetrieval-augmented generation lets language models query external knowledge, but this can leak sensitive data from the retrieval datastore. The paper proposes applying the same random projection to datastore and query embeddings to protect that data. The authors state the method preserves semantic similarity between queries and retrieved items and substantially mitigates data extraction attacks. Experiments across several RAG architectures and datasets report better retrieval and generation performance than prior differential-privacy methods, with comparable empirical privacy under strong attacks.
In briefCounting Subgraphs While Protecting Individual Nodes' Privacy
SummaryThis paper studies approximately counting subgraphs under local node differential privacy (LNDP), a model designed to give strong privacy guarantees in analyses of distributed social networks. The authors give a noninteractive (ε,0)-LNDP algorithm that counts occurrences of any public k-node template graph with additive error O(n^{k-1/2}/ε^{k-1}). They also prove that for templates with maximum degree greater than 1, any noninteractive (ε,δ)-LNDP algorithm must incur error Ω(n^{k-1/2}), so the algorithm is optimal up to poly(1/ε) factors.
WhyExtends LNDP-approximable statistics beyond degree distributions to constant-size subgraph counts, with near-optimal matching upper and lower error bounds.
Sofya Raskhodnikova, Adam Smith, Connor Wagaman et al.
In briefGhostFaceMPC: Privacy-preserving face recognition using secure multi-party computation
SummaryThis paper presents GhostFaceMPC, described as the first end-to-end face recognition system that runs a deep convolutional neural network for feature extraction and matching under secure multi-party computation. It aims to keep raw images and biometric embeddings hidden at every stage, from extraction and storage to matching. The authors also introduce a quantization of the GhostFaceNet model and circuit optimizations to make the approach practical. The code is publicly available.]
Davide Carnemolla, Dario Catalano, Mario Di Raimondo
In briefLanguage as a Security Weak Point: Translating User Requests Changes Agent Guard Verdicts
SummaryThe paper tests whether step-level guards for AI agents give different safety verdicts depending on the language of the user's request. The authors built LinguaGuardBench from 1,220 labelled steps of TS-Bench AgentDojo-Traj, translating only the user instruction into five languages while keeping everything else identical. Most small open and purpose-built guards changed verdicts beyond their noise floor, with larger effects for rarer languages, while frontier guards shifted by about one point or less.
WhyShows step-level agent guards depend on request language, validated across 19 guards with controlled translation experiments and placebo baselines, a novel and well-evidenced finding.
In briefStudy of Shortcut Sensitivity in AI Agent Safety Evaluations
SummaryThis paper examines how shortcut cues in evaluation data can make labels predictable without measuring true safety and can also shift the decisions of safety guards for AI agents. The authors audit LinuxArena and two TS-Bench-derived datasets, and in controlled tests find that editing certain markers changes false-positive blocking and measured accuracy. They recommend domain group holdouts, evaluation-unit metrics, and placebo-controlled paired interventions.
In briefEveryone's a Little Bit Racist: A Black-Box ML Backdoor Attack
SummaryThis paper introduces Backdoor-as-a-Service, a model-agnostic, fully black-box technique that activates a latent secondary task using behavior the model already has, rather than installing a backdoor. It uses genetic search to find input transformations that produce systematic output differences aligned with an attacker-defined task, without changing training data, architecture, or weights. The authors test the approach on a MNIST digit classifier, which is made to perform binary letter recognition, and on a production-grade NSFW classifier, which is turned into a demographic-group proxy using face-specific perturbations. The attack succeeded in both cases. The paper also discusses existing countermeasures to assess the risk to deployed systems.
WhyProposes black-box backdoor activation via genetic search without training poisoning; validated only on MNIST and one NSFW classifier, limited scope.
In briefErase the Watermark, Keep the Movement: Removing Video Watermarks Without Breaking Motion
SummaryThis paper introduces PoseRegen, a pose-consistent reconstruction framework that removes video watermarks while keeping the original content and motion. It first applies a temporally shared viewpoint transformation to disrupt watermark patterns, then jointly reconstructs the sequence with a pose-conditioned video model and a lightweight motion consistency adapter. Tested on eleven video watermarking schemes, it reduces average bit accuracy to 0.505, near random guessing, and outperforms the strongest baseline by 9.34% on motion-related VBench metrics.
In briefMAppPrint: Robust, Real-time Mobile App Fingerprinting Using Traffic Behavior Graphs
SummaryThis paper presents MAppPrint, a framework that identifies which mobile apps are in use by analyzing patterns in encrypted network traffic. It models each app's traffic as a Traffic Behavior Correlation Graph that captures unit traffic behaviors and their correlations, then compresses these graphs for real-time use. An unsupervised method separates mixed traffic from multiple concurrently running apps. The authors report 4.9–13.9% higher precision and 3–6 times better timeliness than state-of-the-art methods, with robustness under dynamic network conditions.
In briefNoise-tolerant quantum one-time programs built on stateless trusted hardware, revisited
SummaryThis paper studies quantum one-time programs, quantum states that can yield only one output of a program. The authors design a BB84-state-based scheme that tolerates single-qubit corruption errors and detectable erasure errors, and give a numerical example under specific noise rates. They also extend the scheme to reusing the same trusted hardware across programs and to using multiple devices, where security holds if at least one is uncompromised.
In briefSMT-Based Security Types for Verifying Low-Level Secure Multi-Party Computation
SummaryThis paper addresses Secure Multi-Party Computation (MPC), a technology that protects data privacy in distributed applications. The authors develop a new Hoare logic and type theory to automatically check that protocols written in the Prelude/Overture framework are correct, confidential, and have integrity. Both the analyses and their automation rely on SMT verification. The approach is described as compositional and scalable, and generalizes to arbitrary prime fields and secret sharing schemes.
Christian Skalka (1), Steven Baldasty (1), Yeonhee Yeh (1) et al.
