In briefFast ℓ∞ reduction of rank-2 lattices in ℝⁿ using a new reduced-basis notion
SummaryThis paper studies rank-2 lattices in ℝⁿ under the infinity norm and introduces a new definition of a reduced basis for this setting. Based on it, the authors propose a lattice basis reduction algorithm that performs a multidimensional analogue of Euclidean division using a dominant coordinate. Each non-terminal iteration halves the maximum infinity norm of the basis vectors, and the algorithm is proven to terminate with bit complexity O(nT²), matching classical Lagrange–Gauss reduction. Experiments report significant runtime gains, especially for high-dimensional lattices.
In briefSuperspecial points on Humbert surfaces and the probability of (N,N)-splitting
SummaryThe paper studies superspecial principally polarized abelian surfaces over the algebraic closure of a finite field and determines the proportion that are optimally (N,N)-split. It shows this proportion is 5NJ₂(N)/p + O_N(p⁻²), where J₂ is Jordan's totient. The constants are computed explicitly for 2 ≤ N ≤ 7, and the result gives the stationary density relevant to splitting-detection attacks on two-dimensional superspecial isogeny problems.
WhyLinks superspecial surfaces to genus averages via Siegel weights, giving a rigorous first-order formula for (N,N)-splitting proportion, verified exactly at twelve primes.
In briefEfficient fixed-point implementation of the Mitaka signature scheme
SummaryMitaka is a variant of Falcon (FN-DSA) with a simpler, parallelizable signing procedure. This paper implements the MitakaZ signing algorithm in fixed-point arithmetic, replacing the wide integral Gram root decomposition with a fixed-point Cholesky decomposition to reduce the cost of integer Gaussian sampling. Bounds on intermediate values and representation errors are proven. On an Intel Core i7-1360P, signing averages 361 kcycles for Mitaka-512 and 707 kcycles for Mitaka-1024; on an ARM Cortex-M4F, 4.0 and 7.8 Mcycles.
In briefFaster GPU Search for Minimal XOR Circuits in Large Linear Layers
SummaryThis paper speeds up the Boyar-Peralta algorithm and its variants, which find circuits for linear layers using the fewest XOR gates. The authors add a meet-in-the-middle approach to lower the theoretical complexity, redesign the implementation for GPU parallelism, and add a candidate pruning step. They report large speedups while keeping the same solution quality, plus new g-XOR results and MDS matrices of dimension 40 or more.
In briefNarratives Mislead: How LLMs Misjudge CVSS Severity in Bug Bounty Reports
SummaryThe study builds a benchmark of 240 Huntr bug bounty reports with vendor-validated CVSS vectors and evaluates eight LLMs under four prompting strategies and fine-tuning. The best prompting setup reaches only 49.58% level accuracy, and a fine-tuned 7B model reaches at most 56.25%. Models overestimate severity far more often than they underestimate it and rarely recognize low-severity vulnerabilities. The authors attribute these errors to three semantic boundaries where the CVSS specification and narrative reports diverge.
In briefWhen code becomes an LLM call: how agentic systems guard model calls
SummaryThis paper empirically studies 496 LLM call sites across 40 open-source agentic systems, comparing the contract each call should satisfy with the contract the code actually implements. It reports that 48% of model outputs reach control flow or execution, and 73% of those never reach a person. About 63% of expected constraints are unmet, and only 5.3% of call sites satisfy their full contract.
In briefDPA-Style Side-Channel Attacks on VOLE-in-the-Head Signatures
SummaryThis paper presents what the authors believe is the first DPA-style power side-channel attack framework against VOLE-in-the-Head (VOLEitH) post-quantum signatures, targeting the secret witness. It analyzes leakage from sensitive intermediate values in VOLE correlations and proposes six attack classes on FAEST and SDitH, including two vertical and four horizontal attacks. The attacks are validated with simulated leakage under varying noise and with measurements on three ARM Cortex-M4 devices.
WhyPresents the first DPA-style attack framework on VOLEitH signatures, with six attacks validated by simulation and real ARM Cortex-M4 measurements.
In briefA method for building a fingerprint-function feature database to support code-clone-based software composition analysis
SummaryCode clone detection tools used in software composition analysis often rely on small experimental datasets, leaving a gap with real-world needs. The paper proposes OSSScope, which uses a greedy algorithm to select repositories from 2.55 million GitHub C repositories, maximizing unique fingerprinting functions while minimizing repository count. The resulting dataset contains 61 million fingerprinting functions from 190K repositories, and the authors report a 22.65% recall improvement over state-of-the-art tools. They also introduce RClassifier, a lightweight model that decides whether a repository should be included, and evaluate it in the Golang ecosystem.
In briefPrivately evaluating arbitrary high-dimensional functions using only black-box queries, with outputs guaranteed to lie in the convex hull of nearby results.
SummaryThis paper studies differentially private black-box evaluation of arbitrary high-dimensional functions. The evaluator can only query the function over subsets obtained by removing a bounded number of elements from a dataset, and aims to privately output an approximation of the function's value. The authors reduce the problem to high-dimensional private quasi-concave optimization, yielding generic evaluators for both pure and approximate differential privacy whose outputs lie in the convex hull of nearby vectors with high probability. The work also covers applications to user-level optimization and shows the formulation is equivalent to private quasi-concave optimization up to a dimension factor.
WhyGeneralizes private real-valued evaluation to high dimensions, proves equivalence with private QCO, and improves user-level optimization overhead to additive, a strong theoretical contribution.
In briefDeterministic Forgeries in Eevee via Associated-Data Correlations Under Nonce Misuse
SummaryThis paper analyzes the Umbreon and Espeon modes of the Eevee authenticated-encryption scheme under nonce reuse. Exploiting correlations between associated-data values, it builds forgeries of non-empty messages with probability one using three encryption queries and one verification query. It also gives a systematic treatment of partial final message blocks, reducing the number of queries needed in some cases.
In briefDefending agents against dormant poisoning that activates after benign fine-tuning
SummaryThis paper studies dormant poisoning, where hidden malicious behaviors stay concealed at release but emerge after benign fine-tuning, and checks whether this extends to harmful agent actions and multimodal settings. The authors build a Safety Buffer from the released model's own safe responses and propose LookAhead Defense, which previews fine-tuning updates and penalizes only those predicted to weaken safe behavior. Reported results show harmful agent behavior falling from up to 93.9% to at most 14.2%, with competitive utility and low over-refusal.
WhyExploits dormant poisoning's preserved safe behavior to build a Safety Buffer and a lookahead defense, with broad experiments across language and multimodal agents.
In briefInterType: Extending Neural Binary Type Inference Beyond Single Functions
SummaryThis paper proposes InterType, which embeds inter-procedural analysis into a pre-trained Transformer for recovering variable types in binaries. Built on CodeArt, it adds caller-callee data flow dependencies during fine-tuning so the model sees cross-function context. On O1-optimized coreutils binaries, recall rises from 89.00% for the intra-procedural CodeArt baseline to 91.76%.
In briefCan AI agents protect secrets they were never told? A test of hidden privacy risks across sessions
SummaryThis paper introduces MemJoin, a privacy benchmark of 288 synthetic cases where a full conversation history reveals a sensitive relation, but no single session does. Six memory systems are tested with the same answer model, compared against full-history and no-history controls. The authors find that checking whether target attribute values are visible is not enough to judge what combined records reveal.
In briefRATION: Quantitative Risk-Based Access Control for AI Agents
SummaryThis paper proposes a quantitative risk-based approach to access control for AI agents, which limits measurable risks accumulated during task execution rather than simply restricting actions. It introduces RATION, a framework that builds a task-specific policy from explicit user-request constraints and implicit risks calibrated from similar past tasks, then tracks accumulated risk during execution. Experiments on four security benchmarks reportedly show strong security alongside high task utility across diverse models and environments.
In briefPredicting CVSS and CWE from CVE Descriptions Using Fine-Tuned Small Language Models
SummaryNIST now enriches only high-priority CVEs, leaving many new vulnerabilities without CVSS and CWE labels needed for patch triage. This paper predicts CVSS v3.1 vectors, base scores, severity tiers and CWE types using only the text of each CVE description. A fine-tuned Phi-3.5-mini model, trained on 2022–2023 CVEs, reaches 69.9% severity accuracy and 70.9% CWE accuracy on 36,325 CVEs from 2024, outperforming TF-IDF logistic regression.
WhyFine-tuned small model predicts CVSS and CWE from descriptions, with leakage-free splits and paired bootstrap tests showing consistent gains over TF-IDF.
In briefUnlimited Losses, Unverified Inputs: Measuring Safeguards in LLM Options-Trading Agents
SummaryThis paper presents the first measurement of options-trading agents published by brokers and developers, scoring them on the safeguards they enforce and the worst loss their order paths can reach. The authors evaluated 26 systems from 215 eligible repositories and 8 broker interfaces, finding that none authenticate text sources or cross-check market data. Thirteen of the systems can reach unbounded loss. The authors conclude that options agents need loss limits enforced at the order boundary.
WhyFirst systematic measurement of options-trading agent safeguards across 26 systems, showing most can reach unbounded loss with unverified inputs.
In briefSPIDES: Information-Flow Control for Browser Agents
SummaryBrowser agents that read and act on web content face prompt injection and data exfiltration risks. This paper proposes SPIDES, which gates basic browser actions such as typing, clicking and navigating using labels derived from element-level confidentiality and integrity annotations. Untrusted and confidential content is masked from the agent, and policies block unauthorized information flows. Evaluated on MicroNet, a 28-website testbed, SPIDES reports a 0% attack success rate while keeping high task completion.
WhyApplies information-flow control with element-level labels to browser agents, validated on a self-built 28-site benchmark; novel but evaluation scope is limited.
In briefZippel: A Language, Compiler, Runtime, and Analyzer for ZK Proof Systems
SummaryThis paper presents Zippel, a language, compiler, runtime, and analyzer for building cryptographic proof systems. Its syntax resembles pseudocode from cryptography papers, and its type system and runtime aim to prevent entire classes of vulnerabilities, such as automatically synchronizing transcripts and applying Fiat–Shamir correctly. Zippel also provides automated static analyses that check whether a protocol is complete and sound from its description alone. The authors implemented 35 proof systems in Zippel and report that its programs are competitive with hand-written implementations on multi-core hardware.
Sebastian Angel, Sydnie-Shea Cohen, Eleftherios Ioannidis et al.
In briefAutomated generation of variant detection rules for evolving attacks using infrastructure-aware technique proximity
SummaryThis paper presents ARMS, a system that automatically mutates existing detection rules to cover attack variants when adversaries change execution paths or telemetry environments. It defines a three-dimensional proximity space to find related techniques and builds a context-aware RAG pipeline grounded in verifiable commands from Atomic Red Team. Evaluated on public SigmaHQ rules, nearly all generated variants compiled into SIEM queries, and about 92% still detected the original behavior despite technique variations.
Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi et al.
In briefRecording-aware evaluation method for multimodal OT intrusion detection
SummaryThis paper notes that benchmark datasets for OT intrusion detection record normal and attack data separately, so high scores may reflect recording differences rather than attack behavior. The authors propose a recording-aware procedure that compares attack windows with same-recording background, plus temporal alignment tests and alarm-burden analysis. On the ProvICS dataset, same-recording evaluation reverses the modality ranking, and cross- versus same-recording AUC differs by up to 0.54.
In briefBad Diagnosis: Consent and Data Collection in Mobile Medical Apps
SummaryThis paper analyzes consent and data collection practices across over 10,000 mobile health apps on the Google Play Store, combining static analysis with privacy policy review. It finds that 69.15% of apps request at least one permission unrelated to their stated purpose, and nearly 93% provide no consent form, which conflicts with regulations such as GDPR. The authors call for stronger privacy enforcement and plan to release their dataset and measurement tools.
WhyLarge-scale static analysis plus policy review of 10,000+ mHealth apps reveals widespread missing consent forms, with broad regulatory and practical impact.
Ethan Myers, Lorenzo De Carli, Shantanu Sharma et al.
In brief"Under the Skin": A study of cross-modal backdoor attacks on multimodal AI models
SummaryThis paper introduces "backdoor infection," an attack that targets multimodal large language models. Starting from a model already backdoored in one input type, the attacker builds a matching trigger in another input type, using the model's shared latent space, without poisoning that second modality during training. The authors also propose a lightweight, constraint-aware optimization method for generating these triggers. Experiments on LLaVA, InternVL, Qwen-VL, and Gemma show the cross-modal triggers are more efficient, effective, and harder to detect than direct optimization baselines.
WhyProposes a novel cross-modal backdoor transfer attack exploiting shared latent spaces, validated on several major MLLMs, though experimental details are brief.
In briefTask-aware kernel Stein certificates for Rényi differential privacy
SummaryThis paper uses kernel Stein discrepancies based on escort distributions to certify Rényi differential privacy, a privacy measure that is hard to compute outside the Gaussian case. By designing the kernel to focus on relevant privacy directions, the authors derive task-aware privacy certificates. They give exact identities for Gaussian and Laplace mechanisms and bounds for exponential mechanisms. A real data example shows how the protected comparison set and released subspace together determine the certificates.
In briefToolRosetta: Testing whether tool-call safety guards hold up across different action formats
SummaryThe paper notes that step-level guards for tool-using agents are typically evaluated on clean JSON tool calls, whereas deployed coding agents issue string-based execute_bash and execute_code payloads. The authors introduce ToolRosetta, which re-renders AgentDojo and AgentHarm actions as Python calls and shell commands, optionally removing the agent's rationale, while keeping the underlying meaning and labels fixed. Frontier guards remain stable, but most specialized agent guards show large rises in false-positive rates under the shell form. The authors conclude that benchmark accuracy on JSON calls does not predict a guard's operating point behind a code-acting agent.
In briefTesting how coordinated AI agents could evade monitoring and cause loss of control
SummaryThe paper introduces MiniLab, a benchmark of five interconnected live services with 249 benign tasks and eight attack objectives. It shows that when different agents carry out separate parts of an attack, a frontier monitor reading each agent's trajectory flags only 7% of successful attacks, versus 87% for a single agent. Models asked to plan such covert attacks succeeded at most 25% of the time, compared with 80% for human-crafted plans.
WhyProposes distributed multi-agent collusion attacks evaluated in reproducible environments, showing monitors miss most attacks; novel and well-evidenced.
John Kitaoka, Thao Amelia Pham, Carlos Rafael Giudice et al.
In briefHardEval: An Execution-Verified Benchmark for AI-Driven Security Hardening and Compliance Remediation
SummaryThis paper introduces HardEval, a benchmark for testing whether language models can harden operating-system security. It uses Red Hat Enterprise Linux 8 STIG controls that fail on an unhardened baseline, where the model writes a Bash script that runs on a live virtual machine and is checked with OpenSCAP/OVAL to see if it changes the result from fail to pass. Evaluating fourteen configurations, the authors find large, uneven differences across security domains, and a recurring failure in which plausible code does not meet the exact compliance condition.
WhyProposes execution-verified STIG hardening benchmark using OVAL checks on live VMs, with fourteen-configuration comparison and confidence intervals, giving solid evidence and moderate domain impact.
Manohar Vellala, Soumya Banerjee, Sandip Roy et al.
In briefWatermarking Zero-Knowledge Proofs to Bind Them to Their Provers
SummaryThe paper addresses the need to embed prover identity and a request nonce into ZK-SNARK proofs in outsourced and decentralized proving markets. It shows that the prior approach of placing provenance in Fiat-Shamir challenges, used by Succinct Network, is insecure against preprocessing attacks, and demonstrates these attacks against KZG-PLONK. The authors give the first formal definition of provenance-binding ZK-SNARKs and a generic construction that adds provenance binding to code-based polynomial commitments such as BaseFold and FRI, with minimal overhead.
In briefWhen LLM Agents Decide to Follow Prompt Injections
SummaryThis paper studies when LLM agents that read untrusted content are hijacked by prompt injections. Using branching rollouts that resample each episode after the agent reads an injection, the authors split outcome variance into a part fixed at read time and a part decided later. With thinking enabled, the share fixed at read time falls from 0.91 to 0.62 for Qwen3, and single-run labels disagree with reruns up to 35% of the time, so benchmarks need repeated runs per task.
WhyBranching rollouts split outcome variance into read-time and later-decided parts, showing thinking shifts when injection decisions form, with broad implications for monitors and benchmarks.
In briefTUPLE-Bench: Measuring and Reducing Privacy Leaks in Decision Model Outputs
SummaryThe paper introduces TUPLE-Bench, a benchmark of paired synthetic cases for testing whether typed decision models leak fine-grained causes beyond a coarse category. Across nine models, instructing models to withhold the cause failed, with 91.88% to 99.93% of responses revealing it through selections or residual scores. The authors also propose workflow-constrained privacy quantization (WCPQ), which reduces secret recovery while preserving downstream workflow behavior and cost.
In briefCHAMP: A Cayley Hash Built from 2×2 Matrix Products
SummaryCayley hash functions map the bits of a message to elements of a semigroup and multiply them together, giving them useful homomorphic properties. This paper proposes CHAMP, a Cayley hash function based on products of 2×2 matrices over a finite field. It also discusses the scheme's security, implementation, and performance.
Alexander Demin, Alexey Ovchinnikov, Vladimir Shpilrain
In briefAnalysis of multi-key optimization for the SPECK code-based signature scheme
SummarySPECK is a code-based digital signature scheme that speeds up signing by replacing Gaussian elimination with vector-matrix multiplications. This paper revisits the multi-key optimization used to reduce signature size and examines its security concerns in detail. It identifies conditions and parameter constraints under which multiple keys can be safely used. The authors also design a ring signature scheme based on the same construction.
Marco Baldi, Michele Battagliola, Rahmi El Mechri et al.
In briefToken-level attribution of mixed-key LLM watermarks, with a new detector
SummaryThe paper studies which of several secret watermark keys (modes) produced each token in a document that may mix multiple modes and unwatermarked text. It derives an optimal reporting rule that maximizes correct-label power under a Type I error constraint, using prior-weighted alternative densities. The proposed BLADE detector estimates the mode prior from neighboring pivots and the density from reference token probabilities. Experiments on OPT-1.3B and other open-weight models report higher correct-label power than compared detectors.
WhyProposes an optimal multi-key watermark attribution rule and BLADE detector, with theory and experiments across several open-weight LLMs, substantial subfield impact.
In briefFully Homomorphic Encryption for Small Batches of Complex Numbers
SummaryThe paper proposes a new approximate homomorphic encryption scheme for processing small batches of complex numbers, using a shaped rounding that keeps error small on data slots and larger on unused guard slots. At ring degree 2^15 with 128-bit security targets, the authors report that bootstrapping a ciphertext holding 16 or 64 values restores 21 levels while keeping at least 22.6 bits of minimum precision. Security is reduced to Ring-LWE with the same parameters as CKKS.
WhyProposes a new shaped-rounding approximate HE scheme with guard bands and a native bootstrapping algorithm generalizing CKKS, showing clear novelty. Evidence is a specific-parameter comparison against
In briefSLEEK: A Key Encapsulation Scheme Using Sparse Quasi-Cyclic Codes with Closed-Form Decoding Failure Estimates
SummaryThis paper presents SLEEK, a code-based key encapsulation mechanism built on QC-MDPC codes, using a three-iteration parallel bit-flipping decoder. It provides a closed-form decoding failure rate estimate, allowing parameter selection with analytically bounded failure probability. Two variants are offered: SLEEK-LT for long-term keys with IND-CCA security and SLEEK-E for ephemeral keys with IND-CPA security. Reported benchmarks against HQC show SLEEK-LT ciphertexts 4.9 times smaller at 47% more runtime, and SLEEK-E 1.6 times faster with 2.1 times less bandwidth.
Alessandro Annechini, Alessandro Barenghi, Marco Gianvecchio et al.
