In briefConnection Escrow: Holding AI-Agent Pod Network Connections in the Kernel Until an Independent Verifier Decides
SummaryThe paper proposes connection escrow, which uses an eBPF program on a pod's cgroup to hold each outbound TCP connection inside the kernel's connect() path before any packet is sent. A node interceptor parks the agent's first bytes and releases the connection only on a signed verdict from a separate verifier that names that specific socket, while expired or late approvals are refused. The authors report a 36-check adversarial test suite on real cgroups and a Kubernetes evaluation, with a median added delay of 4.5 ms per released connection.
In briefMal-AAEGAN: A GAN that generates adversarial malware using a latent space and two critics
SummaryThis paper proposes Mal-AAEGAN, a method for generating adversarial malware that can evade machine-learning detectors. It uses an adversarial autoencoder to map high-dimensional binary API features into a continuous latent space, where perturbations are applied, and trains with a WGAN-GP scheme using two critics. The method preserves the original API calls of the malware, and across two datasets and eight detectors it reaches evasion rates on par with or higher than MalGAN, Mal-LSGAN, and Mal-D2GAN while training more stably.
In briefAdjusting how well differential privacy keeps relationships between variables
SummaryThis paper derives an exact formula showing how differential privacy via randomized response attenuates multivariate cross-moments. Under attribute-level randomization with Kronecker-product structure, cross-moments of the anonymized data equal the original values multiplied by attenuation parameters set by each attribute's share of the privacy budget. Identical total budgets can therefore preserve covariance very differently.
In briefExact compilation and resource laws for hidden integer feedback in privacy-preserving releases
SummaryThis paper studies how hidden randomized rounding couples privacy loss across successive integer releases, using a rational-feedback mechanism with predictable signed-unit participation. It gives exact finite-law point compilation, a monotone hierarchy quantifying calibration loss, and an unrestricted KL rate with an asymptotic frontier under physical-time and participation constraints. A matched static workload illustrates the resulting design tradeoff.
In briefReliable Privacy Audit Estimates Under Selection Bias
SummaryThis paper examines statistical privacy audits that check whether differentially private mechanisms meet their theoretical guarantees. The authors found that many prior audit implementations, which use membership inference attacks, introduce a selection bias that makes estimated privacy leakage lower bounds invalid and overestimated. They present several statistical correction methods and compare their advantages. Re-analyzing prior audit results, they show that uncorrected audits violate theoretical upper bounds up to four times more often than their claimed confidence level implies, while corrected bounds stay within the nominal violation rate.
In briefFake News, Real Crashes: Information Injection Attacks on LLM Trading Agents
SummaryThis paper presents a benchmark for attacks that inject fabricated information into the evidence used by LLM financial trading agents, rather than their instructions. Evaluated over about 10,000 decisions on 15 U.S. stocks across five injection vectors and seven event categories, fabricated news reaches a much higher attack success rate than prompt injection. Most attacks evade standard defenses, and only hierarchical aggregation reduces attack success.
WhyIntroduces an information-injection benchmark for LLM trading agents, validated over about 10,000 decisions, revealing fact-poisoning effects with broad implications.
In brief96-Day Study of SRT Streaming Protocol Behavior and Security in a Live Iraq–Turkey Link
SummaryThis paper reports a 96-day longitudinal study of the SRT (Secure Reliable Transport) streaming protocol on a production link between Iraq and Turkey, using over 262,000 transport metric samples and about 5 million system resource measurements. It finds that NAK rates vary notably by hour and day, but temporal period explains less than 4 percent of the variance, while CPU utilization is the strongest system-level correlate. Controlled UDP flood experiments changed SRT transport metrics by only about ±13 percent, and a Z-score anomaly detection method detected all 7 security events.
In briefConcrete attacks on LDVR with fewer signers
SummaryThis paper improves the concrete parameters of attacks on the low-dimensional vector representation (LDVR) problem from prior work by Rodríguez García and Tessaro. Combining a Chinese remainder theorem construction with a generalized birthday search, it reports an attack using 488 signers and 173 corruptions over the Curve25519 scalar field. It also gives constructions and query complexity analysis for both canonical and adversarially chosen evaluation points.
In briefNear-optimal early-stopping Byzantine agreement with optimal communication
SummaryThis paper studies the trade-off between round and communication complexity in synchronous Byzantine agreement. For t<n/3 without cryptographic setup, the authors give a deterministic protocol that terminates in f+O(√(f log f)) rounds with optimal O(n·t) communication, where f is the actual number of corruptions. Allowing slightly higher communication reduces the overhead to f+O(√f) rounds. For t<n/2, assuming a public key infrastructure and threshold signatures, they achieve f+O(√f) rounds with O(n·t·κ) bits of communication.
WhyAchieves leading coefficient one for early-stopping rounds with optimal communication, a significant theoretical improvement with rigorous analysis.
Fatima Elsheimy, Simon Holmgaard Kamp, Julian Loss et al.
In briefCHARRM: Automated verification of hardware leakage in masked circuits under the robust random probing model
SummaryThis paper presents a method for efficiently verifying the security of masked cryptographic circuits against side-channel attacks under the (g, t, c)-robust (p, ε)-random probing model. It extends the concept of leakage characteristics to compute leakage probability bounds for glitch-extended and transition-extended probing scenarios, and links them to the Set of Input Shares (SIS) function to support composability notions. In comparisons with IronMask, the authors report better performance and accuracy on larger circuits, and say their method enables exact verification of larger composed circuits for the first time.
WhyExtends leakage characteristics to robust probe extensions and links them to SIS functions, with comparisons against IronMask on larger circuits.
In briefQ-MALDetect: Quantum Image-Based Malware Detection and Its Adversarial Robustness
SummaryThis paper presents Q-MALDetect, a hybrid convolutional and variational-quantum detector that analyzes byte-image representations of x86-64 ELF binaries to detect malware. The authors test it against feature-space and Grad-CAM-guided, executable-aware evasion attacks. The model reaches 97.2% training accuracy, but its robustness drops as attack strength increases. Dynamic adversarial training was the most effective defense among those evaluated.
Walid El Maouaki, Mohammad Izen, Nouhaila Innan et al.
In briefSignature Knowledge Shielding: Protecting antivirus detection rules with robust embedding matching
SummaryAntivirus signatures hold detection knowledge that repeated black-box queries can expose for reuse or evasion. The paper proposes Signature Knowledge Shielding (SKS), which adds auxiliary shielding signatures combined by logical OR with original verdicts, and introduces Robust Embedding Matching (REM), a lightweight learned matcher. In a ClamAV-based prototype, REM raises the mean query count of state-of-the-art probing up to 282.57 times the unprotected baseline, with an observed additional test false-positive rate below 0.1% and 0.67% GPU scanning overhead.
In briefPrivacy of a key-refreshing scheme under leakage, based on falsifiable assumptions
SummaryThe paper studies privacy for symmetric-key cryptography under side-channel leakage and proposes a new model that focuses on the key-refreshing process. It defines "secure refreshing," a security notion that can be practically falsified by evaluation laboratories through a direct experiment rather than a simulator. The authors also introduce strongly protected secure refreshing and use these assumptions to prove privacy of the PSV encryption scheme. This is presented as the first privacy proof based only on falsifiable assumptions without assuming the strongly protected component is leak-free.
In briefPPGA: A Privacy-Preserving Framework for Running Custom Graph Algorithms Securely
SummaryThis paper presents PPGA, a framework for running graph algorithms under secure multiparty computation so that several clients can each contribute part of a graph without revealing it. Users can define custom message-passing graph algorithms through a high-level interface. Compared with the MultiCent implementation, PPGA significantly improves performance, running BFS on a graph with |V|+|E|=30 million in 23 minutes without leaking the graph topology.
Andreas Brüggemann, Simon Brunnauer, Thomas Schneider
In briefFirebolt: a fast, lightweight, malicious-secure non-interactive VOLE protocol
SummaryThis paper presents a new maliciously secure vector oblivious linear evaluation (VOLE) protocol, built on a recent semi-honest Paillier-based non-interactive VOLE construction. It is non-interactive, uses 535 bytes of communication per VOLE entry, and takes about 5 ms of single-threaded computation per party. The authors use it to build a new two-round, two-party ECDSA protocol and a modular framework for threshold ECDSA in the VOLE-hybrid model.
WhyExtends semi-honest Paillier-based non-interactive VOLE to malicious security and improves two-party ECDSA, with concrete efficiency results and broad threshold-scheme impact.
Michael Adjedj, Geoffroy Couteau, Nikolaos Makriyannis
In briefEvasive Inner Product Functional Encryption Is Broken Too: A paper showing a cryptographic assumption fails in full generality
SummaryThis paper shows that the Evasive Inner Product Functional Encryption assumption proposed by Hsieh, Lin and Luo (Eurocrypt 2024) is false in its full generality. The authors give a counterexample that extends Agrawal et al.'s attack on pseudorandom functional encryption to this notion. The original attack needed the scheme to compute pseudorandom functions, whereas this work shows that the weaker evasive inner product functionality is enough.
In briefiO from LWE with Structured Preimage: a post-quantum obfuscation paper
SummaryThis paper proposes a new lattice-based assumption, called LWE with Structured Preimage, and uses it to build indistinguishability obfuscation (iO) in the post-quantum setting. The assumption is instance-independent, falsifiable, and non-interactive, positing that LWE samples look random given a carefully chosen short Gaussian matrix. The authors provide a thorough cryptanalysis, drawing on prior analysis of the related evasive LWE assumption, while stressing that the two are superficially similar but fundamentally different.
In briefPhantomTac: Using Deploy-and-Forget Magnetic Tags to Hijack Robotic Touch Sensors
SummaryThis paper identifies a physical weakness in magnetic tactile sensors used by robots. An attacker can attach a thin, battery-free magnetic tag to an object to alter the magnetic field and spoof the forces the sensor reports. Spoofed normal force may crush the object, while spoofed shear force may cause a loose grip and dropping. Tests on real robots reported an attack success rate above 95% when grasp position offset stayed within 8 mm, and the authors propose a multimodal-consistency defense.
WhyUncovers a physical-layer loophole in magnetic tactile sensors with a hidden magnetic tag attack, validated on real robots exceeding 95% success.
In briefNew IND-CPA-D attacks on the BFV and BGV homomorphic encryption schemes
SummaryThis paper studies the BFV and BGV fully homomorphic encryption schemes under IND-CPA-D security, a model where the adversary knows the computation result, as in threshold decryption. The authors present three new attacks that exploit heuristic parameter assumptions, including extending bootstrapping failure attacks and skewing ciphertext noise or mask. The first two attacks recover the secret key, while the third breaks the IND-CPA-D indistinguishability game. Experiments using HElib and OpenFHE show that the OpenFHE noise-skewing attack fully recovers the secret key within minutes to hours, depending on parameters.
WhyExtends bootstrapping failure attacks to BFV/BGV and recovers secret keys via noise skewing, validated experimentally on HElib and OpenFHE.
In briefA Note on ECDSA Security with Presignatures or Biased Nonces
SummaryThis paper examines alternative ECDSA modes that speed up distributed signing and are used in public libraries and products but lack sound security foundations. The authors show that, in the generic group and random oracle models, the security of some of these variants is equivalent to a fine-grained complexity conjecture about the average-case hardness of the k-SUM problem. They also prove conditional lower bounds on generic group attacks against other standard modes.
WhyShows security of deployed ECDSA variants is equivalent to a fine-grained k-SUM average-case conjecture, with generic-group lower bounds, a novel theoretical link.
In briefLeakBench: Auditing Reward Hacking via Prediction-Time Leakage in Clinical AI Agents
SummaryThis paper introduces LeakBench, an executable audit suite derived from clinical guidelines that checks whether AI agents building clinical prediction models use inputs unavailable at prediction time. It tests a range of properties, including calibration, site-level evaluation, and decision-curve net benefit, on a synthetic task and on MIMIC-IV and multi-hospital inpatient data. The authors report that unconstrained agents often select leaking features to raise validation scores, while explicit admission-time constraints prevented leakage in their runs, and a deterministic provenance verifier removed it. The authors describe LeakBench as an audit testbed with known-failure controls rather than an expert-validated benchmark.
In briefBlame-aware recomposition for proving secure compilation of low-level compartment isolation
SummaryExisting formally verified compilers for compartmentalized C-like programs give security guarantees only at a high level, assuming a built-in protection mechanism and block-based memory. The authors show that Abate et al.'s proof technique fails at a low level because its recomposition step requires hiding each compartment's code, which is impractical there. They extend the technique to a setting where compartments can observe each other's code, modeling such observations as undefined behaviour through an overlay semantics and introducing blame-aware recomposition. The new proof is applied to a compartment isolation mechanism based on a programmable tag-based reference monitor.
In briefBlind-DLPA: An End-to-End Framework for Profiled Blind Side-Channel Analysis
SummaryThis paper studies a profiled blind side-channel setting where the attacker profiles a device with known inputs and keys but cannot see plaintexts or ciphertexts on the target. It proposes Blind-DLPA, a multi-task framework that processes full preprocessed trace windows and estimates soft Hamming-weight posteriors that are combined with theoretical joint distributions to rank key guesses. The authors report key recovery on unprotected AES and Kyber, robustness on protected AES, and the first reported profiled blind key recovery on ASCAD with guessing entropy zero using 39 traces. They also identify collisions in a previously used Ascon Hamming-weight joint-distribution model that prevent unique key recovery..
In briefSpanGuard: Lightweight Defense Against Indirect Prompt Injection by Separating Localization from Authorization
SummaryThe paper notes that LLM-based guardrails defend well against indirect prompt injection, but detection weakens substantially as the guardrail model gets smaller. The authors argue the difficulty comes from jointly locating injected instructions and judging their authorization, so they decouple the two: lightweight unsupervised segmentation localizes candidate blocks, and a small language model judges each block. The reported attack success rate is 0.32%, with negligible loss in benign utility.
In briefSPLASH: Using Contrastive “Audit Pressure” to Detect and Locate Security Hallucinations in AI-Generated Code
SummaryThe paper notes that code from large language models often passes functional tests yet remains insecure, and the models tend to produce these flaws with high confidence. The authors propose SPLASH, which computes an “audit pressure” by contrasting a program’s log-probabilities under security and style reviews, then uses it to pick the secure candidate and locate the vulnerable statement. On 63,684 programs, the method selected secure code in 74% of cases and ranked the vulnerable statement first in 58% of insecure programs, according to the paper.
Mirza Masfiqur Rahman, MD Ajwad Akil, Imtiaz Karim et al.
In briefNIOCIS: Typed next-step routing for tool-use agents that picks from a fixed set of options instead of re-reasoning each step
SummaryThis paper presents NIOCIS, a routing layer that turns execution logs into a loop-collapsed action graph and predicts which declared option, or a stop, to take next at a given state. On 1,615 production security-operations episodes, the typed encoder matches the logged next hop on 32.2% of 3,875 held-out decisions, taking about 10 ms, compared with 2.2 s per LLM hop. The authors also report limits, including that repeated states often disagree and that much of the gain comes from per-node candidate restriction.
In briefAuditor-assisted check on whether hosted LLM outputs really come from the claimed model
SummaryThis paper addresses hosted LLM services that may silently serve a different model than the one they claim. SUMMARK lets a trusted auditor enroll claimed identities before deployment, then verifies released outputs using only the claimed identity and the output, without internal access. It embeds a keyed watermark in user-visible reasoning summaries to detect cross-family and cross-scale substitutions at low false-positive rates while preserving answer quality. The authors also report robustness results and clear failure boundaries, including precision changes, post-processing, rewriting, and text-only spoofing.
In briefContinued-fraction key-recovery attack on the GTLN knapsack cryptosystem
SummaryThis paper presents a key-recovery attack on the GTLN knapsack-based public-key cryptosystem using continued fractions. It exploits the fact that ratios of public-key differences closely approximate small-denominator rationals, allowing private-key integers to be recovered via gcd computations and bounded cofactor searches. The authors report that their Python implementation recovered the full private key in all 2,400 trials across 24 recommended parameter sets, each taking under 0.05 seconds.
In briefFrom if to Oops: Turning a conditional into a key-recovery oracle
SummaryThis paper examines deterministic versions of CSIDH, including Houben's deterministic CSIDH and OSIDH-LD, which remove randomness from the group action. The authors show that determinism places every secret-dependent step at a fixed public point in each execution, letting an attacker repeatedly fault the same step. By skipping one instruction, the attacker forces the mask that selects the next isogeny computation to zero, and whether the output changes reveals if a secret exponent exceeds a threshold. A binary search over these thresholds recovers the full key with one fault per execution. The attack was validated in software fault simulation and on a ChipWhisperer-Lite, and the authors argue that fault resistance requires giving up determinism in favor of randomized countermeasures.
WhyIdentifies a new fault attack surface in deterministic CSIDH, turning a conditional into a key-recovery oracle, validated by simulation and hardware.
In briefA provable lattice reduction method running in nearly QR-factorization time
SummaryThe paper proposes a deterministic lattice-reduction algorithm whose bit complexity matches QR factorization up to logarithmic factors, along with an implementation. In benchmarks against flatter (CRYPTO 2023), the implementation used fewer instructions in all 153 executions. The running time is expressed in terms of a tighter optimally column-scaled condition number.
WhyDeterministic lattice reduction nearing QR cost with tighter condition-number bounds, beating flatter across 153 experiments.
In briefRAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
SummaryThis paper proposes RAGLeak, a supply-chain privacy backdoor attack on retrieval-augmented generation systems. When triggered, the generator reversibly obfuscates retrieved private documents, which an auxiliary LLM can recover with high fidelity. Tested across three model families and three application domains, the attack reaches a high attack success rate with limited impact on benign utility and at most about a 10-point drop under detection-based defenses. The backdoor persists after clean fine-tuning and across model scales and versions.
In briefSecure coding agents guided by counterexample-based execution feedback
SummaryThe paper introduces FALCON, a verification framework that separates attack exploration from behavioral verification and links them via execution traces of the program under test. In test-time repair, FALCON gives substantially stronger held-out functional-security gains than alternative security signals on secure code generation benchmarks while preserving or improving functionality. As an RL reward, it also outperforms static-analysis and learned rewards on held-out functional security.
Tue Le, Anh Nguyen Hoang, Gabriel Sasseville et al.
In briefBudgeted attack scheduling for efficient LLM red-teaming
SummaryThis paper studies how to prioritize jailbreak attacks from a fixed library when only a limited number of attempts is allowed for red-teaming large language models. The authors formalize this as budgeted attack scheduling and compare three signals: historical attack success rate priors, semantic guidance from LLMs, and online feedback from earlier queries. They design four scheduling strategies and test them across three victim models and three defense settings. Historical success rates give a strong start but degrade under defense-induced shifts, while semantic guidance helps in cold-start settings and online feedback helps when transferred priors become stale.
In briefEfficient, compact high-order masked Raccoon for memory-constrained devices
SummaryThis paper presents the first efficient, compact implementation of high-order masked Raccoon, a lattice-based signature scheme, on the ARM Cortex-M4. It optimizes polynomial multiplication, switches sampling to one-shot SHAKE256 calls for at least a 1.80x speedup, and applies memory-saving techniques for IoT deployment. The implementation runs 1.85x to 2.25x faster than the Raccoon reference, and leakage tests indicate strong resistance to differential power analysis at second order once transitional leakages are mitigated.
In briefPost-quantum IPsec migration: a reliable composite key-sharing method for IKEv2
SummaryThis paper studies how moving IPsec to post-quantum cryptography affects network performance. Large post-quantum keys do not fit in one IP packet, causing fragmentation that can break IKEv2 security associations under poor network conditions. The authors propose sending classical and quantum keys as one composite key over TCP, and report that at 1% packet loss handshake time improves by at least 20%, reaching 30% at 10% loss, with 29% lower energy consumption at 10% loss.
Rahul, Manjesh Kumar Hanawal, Sameer G. Kulkarni et al.
In briefPractical predicate encryption for branching programs without fully homomorphic encryption
SummaryThis paper presents a lattice-based predicate encryption scheme for branching programs that avoids fully homomorphic encryption and can combine heterogeneous conditions, such as a range check and a regular-expression check, in one predicate. The authors claim it is the first implementation of predicate encryption for a predicate class as expressive as branching programs. On a single NVIDIA A100 GPU, for a 10-bit attribute, encryption, key generation and decryption take about 4.06, 4.70 and 4.23 hours, with 342.25 GB ciphertexts.
In briefMoving Hazardous Knowledge into Removable Experts in Mixture-of-Experts Models
SummaryThis paper proposes REX, a method that adds physically removable experts to a Mixture-of-Experts language model and relocates hazardous knowledge into them. Removing these experts sharply lowers accuracy on the WMDP-Bio benchmark while MMLU changes by under 3 points. The authors report that this removal persists after further fine-tuning, unlike the nine unlearning baselines they compare against.
WhyRelocates hazardous knowledge into removable MoE experts, unlike suppression-based unlearning. Multi-model experiments and post-finetuning rebound tests give fairly strong evidence.
In briefFaster HQC key establishment on GPUs via parallel binary polynomial multiplication
SummaryThis paper presents an end-to-end GPU implementation of HQC, a code-based key encapsulation mechanism. It introduces two techniques to speed up binary polynomial multiplication over GF(2): a parallelized Frobenius additive FFT and a mapping of the cyclic product onto one-bit integer tensor cores. On an RTX 4090, the Coarse-Grained variant reports 1.55 to 2.03 times higher end-to-end throughput than the HIGH implementation, and the tensor-core BMMAw variant reaches a single-shot latency of 254 microseconds.
In briefAs Care Grows, Control Shrinks: A Study of Digital Privacy at the End of Life
SummaryThis study interviewed 21 terminally ill patients, 11 family caregivers, and 8 physicians about digital privacy in end-of-life care. Thematic analysis identified five structural challenges, including continuous data collection without meaningful consent and involuntary proxy control of accounts due to cognitive decline. The authors describe three patient attitude profiles and call for privacy-by-design, granular permissions, and institutional governance tailored to dying patients.
In briefTheoretical limits of secure aggregation when users drop out in federated learning
SummaryThis paper studies secure aggregation in federated learning, where a server computes the sum of users' gradients without seeing individual values, even when some users drop out. The authors propose an adaptive framework whose communication adjusts to the actual number of dropouts and derive converse bounds on key randomness, key-distribution communication, masked-gradient communication, and mask-elimination communication. The proposed scheme is reported to achieve optimal communication rates for these resources in almost all feasible regimes.
WhyProposes an adaptive framework with converse bounds on four resources and a near-optimal scheme matching them across dropout scenarios.
In briefSAT and Neural Network Filters Removing Misinjections in Fault Attacks
SummaryThe paper addresses misinjections in fault attacks, where an injected fault misses the assumed target and can cause an elimination attack to discard the correct key. It proposes a key-free SAT filter that rejects misinjections one at a time, a neural network filter, and a combined filter. Experiments with clock glitching on GIFT-64, GIFT-128 and BAKSHEESH show the SAT filter rejected none of the intended faults and removed at least 0.940 of misinjections in one attacker setting. The combined filter raised the ToFA success probability on BAKSHEESH from 5.2% to 96.2%.
In briefHow Well Security Skills Guide AI Coding Agents in Finding Linux Kernel Bugs
SummaryThis paper empirically studies 37 security skills used by Claude Code with four large language models on 100 real Linux kernel vulnerabilities, totaling 14800 runs. About 24.4 percent of runs located the correct function and 15.7 percent correctly classified the vulnerability. The authors analyze failure causes and propose SKILL-SIF, a self-improving framework that evolves skills by learning from missed vulnerabilities. On unseen vulnerabilities, it raised fully correct detection from 2 percent to 16 percent.)
In briefIISFA: Ineffective instruction-skip fault attacks on bitslice implementations
SummaryThis paper presents IISFA, a fault attack on bitsliced cipher implementations protected by redundancy countermeasures. It exploits injected instruction skips that leave the computation result unchanged, using the resulting constraints on intermediate values to recover keys. The authors evaluate five bitsliced implementations of GIFT, SKINNY and PIPO on an 8-bit AVR microcontroller, and report that all measured key-recovery campaigns succeeded.
In briefQuantum State Search with Classical Advice: A Separation of QMA and QCIP
SummaryThis paper studies whether a quantum verifier can find a hidden quantum state by exchanging classical messages with an unbounded prover who knows it. For a Haar-random n-qubit target, the authors show that reaching constant average fidelity requires (q+1)^2(B+1)=Ω(2^n), where q is the number of queries and B the communication. This extends Aaronson and Kuperberg's bound to arbitrary classical interaction and yields a unitary oracle separating QMA from QCIP, even for UniqueQMA.
WhyExtends Aaronson-Kuperberg's lower bound to arbitrary classical interaction and yields a rigorous QMA versus QCIP quantum-oracle separation.
In briefFormal verification of Rényi differential privacy in Isabelle/HOL
SummaryThis paper presents an Isabelle/HOL library that formalizes Rényi differential privacy (RDP) for continuous distributions in a general setting. It formalizes properties of convex functions and f-divergences, basic RDP properties, conversion from RDP to DP, moment accountants, and the Gaussian mechanism with its RDP. The authors also formalize a rough evaluation of the RDP and DP of stochastic gradient descent with Gaussian noise.
In briefCircular Dragon: Adaptively secure distributed randomness and key generation with optimal resilience
SummaryThe paper presents the first strongly adaptive common coin protocol under a PKI setup without a trusted dealer, achieving optimal resilience t<n/2 in synchronous networks. Its core is a special-purpose distributed key generation protocol producing an elliptic-curve secret, with near-quadratic communication and logarithmic rounds. The authors also give applications to parallel broadcast and a general-purpose DKG for field-element secrets. The design method, called Circular Dragon, extends the earlier Dragon approach by reducing round complexity.
WhyFirst strongly adaptive common coin achieving optimal resilience with near-quadratic communication and logarithmic rounds, plus parallel broadcast applications; evidence is largely theoretical.
In briefOff-Key: Inconsistent MAC Keys Leak Secrets in SPDZ-Family MPC
SummaryThis paper presents Off-Key, a privacy attack on SPDZ-family secure multi-party computation protocols that exploits inconsistent MAC keys. A corrupted party using different keys across batches, threads, or process runs can recover a shared secret from one authentication check or test guesses via selective failure. The authors demonstrate the vulnerability in evaluated versions of MP-SPDZ, SCALE-MAMBA, and FANNG-MPC. They also show how preserving and reusing the key-consistency state prevents the attack.
In briefHERMES: Faster Private Multi-Token Decoding for Large Language Models
SummaryThis paper studies privacy-preserving inference that generates full multi-token answers from large language models without revealing user prompts. The authors identify two bottlenecks: nonlinear operations needing many communication rounds, and attention protocols that underuse ciphertext capacity and repeatedly send the growing key-value cache. They present HERMES, which uses fewer-round nonlinear alternatives and a homomorphic-encryption matrix multiplication protocol that keeps the cache encrypted on the server. On Llama 3.1 8B Instruct, HERMES reduces time per output token by up to 2.7 times and total latency by up to 2.1 times.
MohammadHossein Olyaiy, Cora Shao, Dingqing Yang et al.
In briefTRACER: A Trajectory Recovery Framework for Cyberattack-Resilient Adaptive Cruise Control
SummaryConnected adaptive cruise control (ACC) systems can have their vehicle-state data manipulated by cyberattacks, leading to irrational car-following and unsafe longitudinal motion. This paper proposes TRACER, which triggers trajectory recovery when observed driving states violate calibrated rational driving constraint (RDC) bounds, and uses cross-branch robust imitation learning with fine-tuning to handle corrupted observations. Experiments across six cyberattack scenarios report that TRACER outperforms state-of-the-art recovery baselines in accuracy, stability, and safety.
In briefHigh-Precision CKKS with Focal Units: a method for raising CKKS precision by concentrating accuracy on fewer slots
SummaryCKKS homomorphic encryption needs a larger scaling factor for higher precision, which consumes more modulus. This paper introduces Focused CKKS, which trades unused SIMD slots for precision using focused rescaling and key-switching based on cyclotomic units. The authors also build a bootstrapping procedure for it that reduces the base modulus by about the same factor.
In briefAdaptive Cyber-Defense Against Evolving Attackers Using RL and Behavior Trees
SummaryThis paper studies how defender policies learned in the CAGE Challenge Scenario 2 enterprise network benchmark can adapt to an extended network with new attacker actions. The authors propose adversarial reinforcement learning with behavior trees (ARLBT), which uses reward behavior trees to define progression-based rewards and condition attacker policies on their execution. Results show higher attacker success than using the original CC2 reward and improved defender robustness against attacks using the new actions.
Nicholas Potteiger, Ankita Samaddar, Xenofon Koutsoukos
In briefLiability spectrum: forensic capture of wireless evidence for maritime cyber-physical incident reconstruction
SummaryThis paper proposes a forensically sound method for capturing raw multichannel wireless signal data alongside time-aligned receiver and instrument metadata, such as decoded AIS/GNSS outputs and NMEA sentences. The samples and metadata are packaged into an append-only envelope, cryptographically linked through hash chains, trusted-time anchors, and periodic checkpoints so third parties can detect tampering and verify the recording window. A prototype shows the integrity mechanisms add negligible storage and modest compute overhead at operational capture rates.
Giacomo Longo, Alessandro Cantelli-Forti, Alessio Merlo et al.
In briefSEAL: A Persistent Tool Poisoning Attack on LLM Agents Using Prefix-Eliciting Triggers
SummaryThe paper shows that existing tool poisoning attacks on LLM agents, which assume effects within a single interaction round, weaken considerably in realistic multi-round settings. It attributes this to agents not consistently surfacing attack-relevant reasoning as their planning context changes. The authors propose SEAL, a two-stage method that first optimizes context-specific triggers to elicit attack-relevant reasoning prefixes, then aggregates them into a universal trigger. Experiments across seven multi-round scenarios and several models report effectiveness, transferability across models, and resistance to some defenses.
In briefGreenNIDS: a benchmark workflow and dataset linking NetFlow intrusion detection accuracy to computational cost.
SummaryGreenNIDS links benchmark runs on public NetFlow datasets to a reusable analysis dataset that records predictive metrics alongside timing, memory, and TDP-based energy estimates. A CPU-only demonstration of 216 runs across four dataset families, three versions, and binary and multiclass tasks is reported. Multiclass ROC-AUC is missing for 36 PyTorch runs, and applying resource limits retains 25.0% of runs. Conclusions are subject to the recorded preprocessing, execution profile, and approximate energy accounting.
In briefEquivalence of Espresso's Shift Register Designs
SummaryThis paper examines whether the Espresso stream cipher's 256-bit non-linear feedback shift register is equivalent to an alternate version with only two feedback taps, a claim that underpins existing security estimates. The authors identify and correct a flaw in a foundational proof by Dubrova, and unify the transformation frameworks of Dubrova and Yao and Parampalli. Using this analysis, they transform an Espresso-equivalent LFSR design into the alternate NFSR and derive a non-linear output function that preserves output equivalence.
Anirban Ghatak, Kaushik Sarkar, Anupam Chattopadhyay et al.
In briefAlgorithm to compute endomorphisms of superspecial abelian surfaces in time and memory p^{4/5+o(1)}
SummaryThe paper presents an algorithm for computing endomorphisms of superspecial principally polarized abelian surfaces over finite fields. Under a standard heuristic, it obtains a non-scalar polarized endomorphism in expected time and memory p^{4/5+o(1)}.
