In briefLatency-neutral passive cyber monitoring for grid-edge OT networks
SummaryThis paper studies the engineering feasibility of the Operational Technology Supervisor (OTSV), a three-tier passive monitoring framework for timing-sensitive grid-edge infrastructure. It uses a Layer-3-unconfigured passive mode on bare-metal hardware via a SPAN port, with a software-enforced unidirectional export policy that isolates the inspection engine from the production network. In a laboratory power-monitoring loop running Modbus TCP and IEC 61850 MMS, 32,927 RTT samples showed a latency difference of less than 0.12 milliseconds between baseline and active monitoring.
In briefFaster, Leaner NTRU+ KEM on Arm Cortex-M Chips
SummaryThis paper presents embedded implementations of NTRU+, a post-quantum key encapsulation scheme built on 3-way NTTs, for Arm Cortex-M0+, M3, M4, and M7 processors. The authors tune layer fusion, modular arithmetic, and instruction scheduling per parameter set and core, and introduce ω-folded front layers. A speed-optimized version cuts execution time by up to 52.43% against the official optimized C code, while a memory-optimized version reduces peak stack usage by up to 82.60% and is faster in every operation.
In briefSystematic Testing of Fault Attacks and Defenses on ML-DSA Rejection Sampling
SummaryThis paper systematically evaluates fault attacks against the rejection sampling step of ML-DSA (FIPS 204) and the countermeasures proposed for them. It argues that the "third rejection test" in a patent compares a value already produced during signing, so it largely repeats a condition the second check already guarantees. Experiments show that the patent's embodiments fail to detect skipping of the z-norm check, which lets attackers fully recover the signing key s1. The authors conclude that the third check and sign-then-verify are complementary, and that deploying both covers all evaluated attack paths.
In briefDisclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in Memory-Based LLM Agents
SummaryThis paper studies how LLM agents with persistent memory can leak users' personal attributes over multiple sessions. Consulting memory improves response quality but also increases the share of attributes correctly inferred from the record, with the gap widening over sessions. The leakage stems from a self-reinforcing loop in which earlier values are carried forward as presuppositions and users affirm or leave them uncorrected. Instructing the agent not to state or presuppose attributes brings leakage close to the no-memory level while keeping most quality gains.
WhyIdentifies a self-reinforcing disclosure loop in memory-equipped agents, supported by multi-session simulations across four models and comparative mitigation tests.
In briefFault-Induced Nonce Reuse in Threshold Lattice Signatures
SummaryThis paper examines threshold ML-DSA signatures when honest participants' devices suffer physical faults. It shows that a fault causing one party to replay cross-session samples leaks that party's share, so in a t-of-n deployment an attacker faulting t devices can recover the full signing key while every signature still verifies. The attack is verified end to end on Mithril, and the authors argue the attack surface depends on reveal structure rather than nonce distribution. They also propose two layers of transcript-level detection.</summary>
WhyIntroduces a reveal-structure criterion for fault-induced nonce reuse, verified end-to-end with full key recovery on Mithril, with broad impact on threshold lattice signatures.
In briefFurther Refinements to a Provable Dual Attack on LWE
SummaryThis paper presents a provable dual attack on the learning-with-errors (LWE) problem that recovers a subvector of the secret and gives an explicit lower bound on its success probability without heuristic assumptions. It unifies two earlier provable approaches and is applied to ML-KEM, improving on the first provable dual attack by 22 to 52 bits. The authors also demonstrate the attack experimentally on small ML-DSA instances and state that the results do not threaten ML-KEM or ML-DSA security.
In briefRegular Syndrome Decoding Is Easier Than Previously Estimated
SummaryThis paper re-examines the concrete hardness of Regular Syndrome Decoding (RSD), a structured problem underlying zero-knowledge protocols, pseudorandom correlation generators, and MPC-in-the-Head signatures. The authors propose a refined hybrid algebraic attack that coordinates zero-coordinate guesses and syndrome-based eliminations across all regular blocks. They report that many widely used parameter sets are substantially easier to solve than previously estimated, with at least one set per application falling below its 128-bit target.
WhyProposes a coordinated hybrid algebraic attack substantially lowering RSD attack costs, affecting several cryptographic applications; evidence rests mainly on cost estimates rather than実際 solved insta
In briefA New Method to Reduce Modulus Needs in Homomorphic Computation: Precision Allocation in CKKS
SummaryThis cryptography preprint studies how to reduce the ciphertext modulus in the CKKS approximate homomorphic encryption scheme. Instead of letting the highest precision requirement set the modulus budget, the authors let average precision requirements govern it and allocate output precision among independent values. The paper reports that with a 64-bit average precision requirement, 75 bits of precision can be transferred without reducing evaluation depth, and that in one experiment the initial modulus bit length is cut relative to standard CKKS, allowing a fourfold smaller ring dimension.
In briefClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents
SummaryAI agents store long-term memory often drawn from web pages and tool results, but current harnesses do not track who may act on that memory, so hidden instructions in fetched pages can be treated as user commands. The paper proposes ClawMMU, a protection layer that labels each memory with its owner, scope, origins, and authority, and checks these labels when content enters the model context, is written to or read from storage, or drives a tool call. Its central rule is that information may gain authority but cannot raise its own authority. Because checks depend on provenance rather than content, memory attacks are stopped as classical protection faults even when the model is fooled.
Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique et al.
In briefData-free attack that removes watermarks from batch normalization layers in federated learning models
SummaryThis paper examines watermarking schemes that embed watermarks in Batch Normalization layers for model ownership verification in Federated Learning. It identifies fundamental vulnerabilities in these schemes and proposes a practical data-free attack that exploits them. Experiments on two representative FL watermarking schemes show the attack removes the watermark with minimal impact on model performance. The authors argue that DNN watermarking should be evaluated under threat models consistent with Kerckhoffs's principle rather than relying on security through obscurity.
Elena Rodr\'iguez-Lois, Fernando P\'erez-Gonz\'alez
In briefContextual Candour: Role-Aware Graduated Disclosure for LLMs
SummaryThis paper addresses how large language models should disclose information when operating over mixed-sensitivity contexts. Instead of simply answering fully or refusing, it proposes graduated disclosure, which calibrates the detail and sensitivity of responses to the user's authorisation, using a reward-based optimisation framework that penalises unauthorised leakage, including paraphrases. Experiments on enterprise and clinical benchmarks show substantially reduced leakage while preserving correctness and utility.
Devansh Srivastav, David Pape, Samira Abedini et al.
In briefSALUS: Synthesizing Large Homomorphic Circuits Using Logic-Aware Lookup Tables
SummaryThis paper presents SALUS, a framework for fully homomorphic encryption that automatically builds and evaluates gate-level circuits over ciphertexts using homomorphic lookup tables. It applies binary decision diagram reordering, multi-value refresh techniques, and a heuristic that merges lookup tables into multi-output tables. Experiments on EPFL and ISCAS benchmarks report up to a 26× reduction in computational latency versus prior homomorphic circuit synthesis. On image filtering and matrix multiplication, it reports an average 8.6× speedup (up to 24×) over functional-bootstrapping-based methods.
In briefMulti-user attacks on elliptic curve and isogeny problems using collision walks
SummaryThe paper studies collision-based attacks on elliptic curve discrete logarithm and isogeny pathfinding problems, focusing on recovering many secret keys at once in the multi-user setting. It surveys existing van Oorschot-Wiener style attacks and proposes new pseudorandom walks better suited to isogeny pathfinding. For supersingular F_{p^2}-curves, the authors state that approximately L + log(L) useful collisions can extract L public keys without an infiltrator. Heuristic and infiltrator-aided strategies are reported to be more efficient.
In briefSelf-Evolving Static Analysis via LLM Pseudo-Labeling: an LLM agent that writes and repairs its own security detection rules
SummaryThe paper presents SESAA, a framework in which an LLM agent starts with no rules and iteratively evolves readable, auditable joern queries for finding security bugs. The agent revises its queries using only feedback from a second LLM critic, without access to ground-truth labels. On the OWASP Benchmark for Python, it reaches a mean F1 of 0.742 over 8 runs, comparable to the strongest tools once those are tuned with labels. In a pilot on real Python projects, it detected 10 of 19 subsequent CVEs.
In briefChecking context-carrying action commands at execution time in industrial control systems
SummaryCommands from learned policies, operators, or schedulers can become incorrect between issuance and execution, for example after an operator pause, creating an "execution gap." The paper proposes an Action Intent Schema (AIS), in which producers state how long a decision stays valid and what it assumes, and a runtime, XAIR, that rechecks intents before release and can release them as version-conditional commands. In controlled experiments, only checks inside a software controller's scan closed the gap, and XAIR validated 148 to 168 intents per second on one embedded-board core.
Luca D'Agati, Giuseppe Tricomi, Fabio Orazio Mirto et al.
In briefPost-quantum key-exchange-style group actions built on oriented superspecial abelian varieties
SummaryThe paper studies using Shimura class group actions on superspecial principally polarized abelian varieties with CM orientations for post-quantum cryptography. It provides an accessible introduction with examples, plus tools to represent CM orientations via higher-dimensional isogenies and to compute the action in the restricted effective group action model. It also gives a method for finding superspecial abelian surfaces oriented by a given CM order and analyzes obstructions to transitivity related to CM types.
Wouter Castryck, Bogdan Adrian Dina, P\'eter Kutas et al.
In briefRaise or Check? Predicting Whether Extra Fuzzing Is Needed in Continuous Fuzzing
SummaryThe paper proposes RAISE, a framework that uses vulnerability-risk predictions to direct extra fuzzing effort toward high-risk project-days in continuous fuzzing of open source software. It performs binary classification per project-day using static features and dynamic coverage-based fuzzing features across 15 C/C++ projects. In a simulation, the Simple-Regression allocation strategy used fewer additional fuzzing sessions per detected vulnerability than prediction-agnostic heuristics.
In briefTesting post-quantum encryption for TLS 1.3 on small IoT devices and microcontrollers
SummaryThis paper examines whether post-quantum cryptography can secure TLS 1.3 connections on IoT-class devices and microcontrollers. Using wolfSSL, the authors benchmarked 36 key-exchange and authentication algorithm combinations on four devices, measuring handshake latency and energy use. On the most constrained devices, fully post-quantum ML-KEM-512 with ML-DSA-44 was competitive with or better than classical options, though ML-DSA signing time varied. The authors also found that the hybrid X25519+ML-KEM-768 approach costs roughly the sum of its components, making pure ML-KEM more practical on hardware without Curve25519 assembly support.
Olivier Gillot, William J. Buchanan, Callum Turino
In briefMaking Language-Model Attackers Spend More Energy Through Generative Deception in Critical Infrastructure
SummaryThis paper studies using a decoy system with a defending language model to deceive autonomous language-model attackers targeting critical infrastructure. Both sides ran on identical GPUs across 330 sessions, with energy measured above idle. In most configurations the attacker used more energy than the defender, especially with runtime thinking disabled, while enabling thinking raised defender energy 8 to 17 times. The authors use these results to propose a SCADA deception architecture.
In briefHydraPoT: A Configurable Multi-Agent Honeypot Framework Balancing LLM Cost and Realism
SummaryThis paper presents HydraPoT, a configurable multi-agent honeypot framework that combines traditional emulation, lightweight LLMs, and cloud LLMs. It routes each attacker command to an agent based on a configurable complexity policy while sharing session state to keep responses consistent across agents. The authors report under 5% runtime overhead, context preservation across agents, and fidelity close to a cloud-LLM-only honeypot. In their case study, cloud-processed tokens fell by 72.6% and operational cost dropped 3.7 times.
Kamolchanok Saengtong, Chutirat Saengyingyongwattana, Sasin Janpuangtong et al.
In briefPrivacy Accounting for Empirical Denoisers: measuring how much privacy is lost during diffusion model sampling and how sampling design affects it
SummaryThis paper examines how much privacy loss occurs during the sampling process of diffusion models. It builds a clipped, training-free empirical denoiser whose per-step sensitivity is explicit, so each denoising step can be treated as a Gaussian mechanism and accounted under Gaussian DP and f-DP. The authors find privacy loss rises steeply in the critical window where semantic content forms, and propose hybrid samplers that switch from the private denoiser to a public neural one. Results on CIFAR-10 and CelebA-64 show that privacy depends on sampling choices such as subsampling, stopping time, and hybrid denoising, not only on training.
In briefCyberHull: Deterministic Isolation of Malicious URLs Using Convex Hulls
SummaryThis paper presents CyberHull, a resource-efficient, deterministic framework for identifying malicious URLs. It defines convex hull boundaries across several feature domains, including structural content entropy, hyperlink graph topology, and semantic token distribution, using the QuickHull algorithm to build compact hulls called vaults. URLs are classified with point-in-polyhedron tests. Experiments report 92 percent detection accuracy, compared with 32 percent for a PCA-based linear baseline.
Avijit Gayen, Aniket Ghosal, Durba Chakraborty et al.
In briefCAESAR: A mixed reality search-and-rescue platform for testing cognitive attacks
SummaryThis paper presents CAESAR, a multi-user mixed reality framework for systematically evaluating cognitive attacks during collaborative search-and-rescue training. It uses a modular architecture that integrates four classes of cognitive attacks into a synchronized scenario and a multimodal pipeline that collects behavioral, performance, and subjective data. A controlled user study analyzing a latency-based attack shows measurable effects on task performance and user behavior.
In briefA unified attack on statistical watermarks for large language models
SummaryThis paper examines statistical watermarks used to detect text generated by large language models, including KGW and its variants, GumbelSoft, DipMark, ITS, and SynthID. It finds that these schemes link their detection scores to the token probability shifts introduced during generation. The authors present a black-box attack that needs no secret keys or model weights and produces fluent text that evades detection. They report that detection rates fall to at most 0.05 across seven watermark schemes, three LLMs, and several tasks, and argue that future designs must decouple detection scores from token probability shifts.</summary>
WhyProves a unified black-box attack optimal across seven LLM watermark families, evaluated on three models, dropping detection rates to at most 0.05.
In briefSecure multimodal federated training with hierarchical DNA-based key management
SummaryThis paper proposes a framework for secure federated optimization over multimodal data, such as medical images, genomic profiles, and clinical records, without centralizing raw data. A key authority provisions one client key via HPKE, and each client derives modality-specific keys with HKDF. Data is mapped into a DNA-domain representation and encrypted with AES-GCM, and only the needed modalities are decrypted locally. Model updates are protected by secure aggregation, so the coordinator sees only aggregated updates.
In briefEach Action Allowed Alone, Combined Violation Missed: Why Per-Action Authorization Fails for LLM Agents
SummaryThis paper studies how autonomous LLM agents are authorized when each tool call is screened in isolation. The authors define compositional authorization failures (CAFs), where individually approved actions together violate a global policy. They prove that relational purpose violations cannot be detected by any per-action monitor and require cross-execution monitoring. Using AL-SYNTH, a SAT/SMT synthesizer, they generate minimal CAF witnesses, which most LLM judges approve when assessed alone but flag when both executions are shown together.
WhyProves an impossibility that per-action monitors cannot detect relational purpose violations, with a synthesizer and experiments on nine LLM judges, limited in scale.
In briefDISTA-LP: Privacy-Preserving Distributed Linear Programming for Metric Differential Privacy
SummaryThis paper addresses the privacy risks and high computational cost of linear-programming mechanisms for metric differential privacy in distributed settings. It proposes DISTA-LP, which uploads compact, noise-calibrated surrogate parameters instead of raw coefficient matrices and solves the resulting problem on the server via Benders decomposition. A probabilistic mDP auditor is introduced to allocate privacy budget and certify an end-to-end guarantee. Experiments on road-network datasets from Rome, New York City, and London report near-zero mDP violation rates, much faster computation, and comparable or better utility.
Michael Oluwole, Ruiyao Liu, Aleksander Stevens et al.
In briefBig Secrets Small Shares: A New Way to Cut Communication in Secure Multi-Party Computation
SummaryThis paper combines two earlier 2007 ideas for reducing communication in secure multi-party computation and introduces "compact sharing," a modified ramp secret sharing scheme, with a matching protocol. The authors report perfect security against static semi-honest adversaries, with an explicit tradeoff between the corruption threshold and the extension degree. When the extension degree grows linearly with the number of parties, the gate-evaluation core has constant communication overhead per extension-field element.
Wilton Kim, Van Long Phuoc Pham, Stanislav Kruglik et al.
In briefLinking Digital Spoofing and Physical Realism: A Spatio-Temporal Attack on Cognitive Radars
SummaryThis paper studies adversarial attacks on deep networks that process raw one-dimensional complex baseband sequences in cognitive radars. It proposes a Segmented Spatio-Temporal Attack (SSTA) that splits sequences into global and local features to improve transfer across network architectures, and models channel distortions as differentiable operators integrated via Expectation over Transformation. Across nine heterogeneous CNN, RNN, and Transformer models, SSTA improves average black-box attack success rate by 10.36% over the state-of-the-art baseline. Baseband simulations indicate the waveforms survive extreme distortions and, after matched filtering, show 0 dB main-lobe attenuation with noise floor lift within Constant False Alarm Rate tolerances.
In briefShow-Up Attack: How Subagents Can Manipulate Their Supervisor
SummaryThis paper studies the show-up attack, where a malicious subagent in a multi-agent LLM system tricks its supervisor into assigning it tasks beyond its scope. The authors built SUA-Arena, with 6 attack strategies and 188 test cases, and tested six frontier LLMs. All were found vulnerable, and mitigations such as prompting and restricted communication did not consistently reduce the risk. The authors conclude that such systems need explicit mechanisms to enforce authority boundaries.
In briefAgents Overstepping Permission: Benchmarking LLM Agents' Adherence to User Authorization
SummaryThis paper introduces AuthorizationBench, a benchmark testing whether LLM agents stay within the authorization a user grants when acting on their behalf. It contains 286 executable tasks and 6,864 trajectories across 24 configurations. Agents acted outside authorization in 19.2% of trajectories, and task completion did not imply authorization alignment.
WhyA new benchmark centered on authorization boundaries, with 6,864 trajectories and controlled comparisons providing solid evidence useful for the subfield.
Zhiping Zhang, Franklin Mingzhe Li, Zihao Huang et al.
In briefKNOX: A Hardware-Assisted Regulatory Sandbox for Generative AI Models
SummaryThis paper presents KNOX, a regulatory sandbox that runs AI workloads inside trusted execution environments (TEEs) so regulators can monitor model behavior. For each user prompt, it derives an attested policy manifest, and a reference monitor checks every action against it before execution. All actions and verdicts are recorded in an attested execution graph that regulators can verify. The authors report that KNOX meets the four stated requirements and adds less than 1% overhead.
In briefFN-DSA on Arm Cortex-M55: A faster, reference-matching post-quantum signature implementation
SummaryThis paper presents an FN-DSA implementation for the Arm Cortex-M55 microcontroller that uses its double-precision FPU and MVE vector extension to speed up key generation, signing, and verification. Unlike prior speedups, it reproduces the reference known-answer tests and runs in constant time. The authors report speedups of up to 1.23x for key generation, 1.93x for signing, 1.30x for verification, and 1.75x for batch verification of four signatures.
In briefAdversarial Benchmarks and BenchDoor Attacks: Backdoor Attacks That Exploit Benchmark Incentives
SummaryThis paper introduces BenchDoor, a family of data poisoning attacks that exploits the incentive to adopt training data that improves machine learning benchmark scores. The attacker alters a benchmark's training or test data, or supplies a separate training dataset, while preserving benign performance and implanting a backdoor. Across multiple-choice Q&A, text classification, and open-ended Q&A with Qwen and Gemma models, all 30 evaluated configurations achieved benchmark gains, with held-out attack success rates of 82.33% to 100.00% at poisoning rates of 2% to 10%.
WhyIntroduces a new benchmark-incentive backdoor attack paradigm, validated across 30 configurations with high success rates and broad implications.
In briefRecovering Concepts Hidden Beyond the Prompt in Text-to-Image Models
SummaryText-to-image models can produce visual concepts that prompts never mention, so auditing them requires recovering the omitted description. This paper introduces EmbGA, a genetic algorithm that applies crossover and mutation in token embedding space and projects each offspring back to discrete tokens before scoring. On two benchmarks against six optimizers, it achieves the highest alignment at large exploration budgets, recovers the most grounded tokens on natural images, and runs much faster than language-model-guided search.
In briefPrivacy-preserving personalized federated learning for medical imaging attacks and defenses
SummaryThis paper studies privacy risks in federated learning for medical imaging. The authors propose a model inversion attack using DCGANs that can reconstruct semantically meaningful synthetic images from training data. They then apply client-side differential privacy and personalized federated learning to reduce attack success while recovering accuracy, evaluated on the Brain MRI ND-5 dataset along with the effects of different aggregation algorithms.
In briefNetGuise: adversarial traffic generation that tricks early-stage encrypted traffic classifiers
SummaryThis paper examines encrypted traffic classifiers that decide using only the first few packets of a connection. It proposes NetGuise, a framework that morphs traffic with packet padding and non-negative delays while keeping packet direction, order, and count. Tests on the VANT and UTMobileNet datasets show targeted evasion of 33.2% and 5.6% under a causal, online interface, and 82.0% and 81.8% when the full window is visible. The authors conclude that early-stage classifiers can be morphed despite high clean accuracy, so robustness evaluation should account for this.
In briefPrivacy-preserving testing that lets a design firm outsource checks without revealing its IP
SummaryThe paper proposes a provably private way for a design company to outsource testing to a Testing-as-a-Service provider without either side revealing its intellectual property. It uses a secure multi-party computation protocol, with specifications written in Signal Temporal Logic and robustness-guided falsification as the testing method. The authors report that for up to a 100-dimensional input space, generating one test takes under 80 msec, with the privacy protocol adding less than 6x overhead.
In briefInterflow: Overlapping offline randomness generation with online execution for private edge AI
SummaryThe paper addresses the high communication and computation costs of secure multi-party computation in privacy-preserving machine learning, especially for nonlinear inference. It proposes Interflow, an algorithm-hardware co-design that processes batches in a pipeline, generating correlated randomness for the next batch while the current batch executes. Implemented on a Zynq UltraScale+ ZCU102, it improves nonlinear throughput by up to 1.55x for CNN operators and 1.48x for transformer operators. It also reduces memory footprint by up to 37% compared with baseline frameworks.
Hanieh Totonchi Asl, Ebrahim Nouri, Zhuoran Li et al.
In briefAgenticVulHunter: Local AI Agent Tool for Finding Code Vulnerabilities in Your Terminal
SummaryThis paper presents AgenticVulHunter, a secure code review approach and tool that runs on a locally deployed open-weight LLM and explores repository files to find vulnerabilities. It is evaluated on 144 cases from SCRBench using Qwen3-Coder-30B and DeepSeek V3.1 Terminus. The reported accuracy is 18.4% and 23.8% respectively, compared with 11.8% and 17.5% for the AgenticSCR-style baselines.
In briefMeasuring shared model vulnerabilities through systemic adversarial robustness
SummaryThe paper argues that foundation models increasingly share training pipelines, distillation methods, and data, which may create a vulnerability monoculture across a model pool. It introduces Systemic Adversarial Robustness (SAR), a measure based on how many attack types are needed to compromise a pool, and formulates it as a partial set-cover problem. The authors report that model pools distilled from DeepSeek-R1 and Claude Opus 4.6 show lower estimated systemic robustness than their parent pools.
Leo Elmecker-Plakolm, Lukasz Szpruch, Avishek Joey Bose et al.
In briefGlobal capacity orchestration for quantum keys in hybrid QKD-PQC networks
SummaryThis paper presents a Distributed Key Management System that delivers quantum-safe symmetric keys across a network. It combines QKD key transport over multi-hop trusted relays with an end-to-end post-quantum cryptography layer that protects relayed key material from intermediate nodes. Its core is an SDN-based control plane in which a central controller computes filling rates and multipath routes for all per-peer key buffers. Evaluated on a Kubernetes digital twin across five topologies, the controller filled all buffers within six minutes and, under excessive demand, degraded gracefully by rate-limiting excess requests.
Pablo P. Rejo, Manuel Fern\'andez-Veiga, Ana Fern\'andez-Vilas et al.
In briefDetecting AI model training from datacentre power readings
SummaryThe paper proposes a way to detect large-scale model training on a monitored computing cluster by tracking the iteration rhythm in facility-level power with a Viterbi tracker, without trusting the operator. In simulations where the operator does not hide training, the method detects at least 96% of runs. Against the strongest hiding strategy, at least 87% of runs are still caught over a day, and hiding raises the compute needed to reach the same loss.
In briefPost-quantum group signatures seeded by quantum key distribution for secure 5G vehicle communications
SummaryCurrent vehicle-to-everything (V2X) communications use elliptic-curve signatures that quantum attackers can break, and pseudonym certificates whose privacy depends on how often they rotate. The paper proposes qDGSP, a post-quantum V2X system with a hash-based dynamic group signature scheme split between a central controller and roadside verifiers, with group keys derived from quantum key distribution seeds. In tests on emulated 5G links, median end-to-end latency stayed within the 100 ms ETSI budget for all variants. Under load, the ephemeral association mode raised message delivery from about 78% to 93%.
P. Blanco-Casal, P. Rejo-Iglesias, D. Cajaraville-Aboy et al.
In briefScrambled multiply-with-carry random number generators that avoid lattice flaws
SummaryMultiply-with-carry generators are very fast pseudorandom number generators whose quality depends on the multiplier chosen. The paper shows that the modulus form limits the lattice structure of these generators, and that XORing each output with its carry removes these limitations. It ranks candidate multipliers using a weighted geometric mean and proposes MWC192X, a 64-bit generator with 192 bits of state that passes all known tests and emits output in half a nanosecond.
In briefGlobal Security Blind Spots: Translation Can Bypass AI Safety in Low-Resource Languages
SummaryThis paper studies whether safety protections in large language models hold up when harmful requests are translated into other languages. The authors test ten widely deployed models across 79 languages, including English and 78 low-resource languages. They find that English safety does not reliably transfer, with bypass rates ranging from 21.9% to 44.4%, and that per-model bypass rankings are unstable.
WhyProposes an English-conditioned translation-bypass metric, evaluated systematically across ten models and 79 languages with robustness controls, impacting global LLM safety evaluation.
Jalil Alva, David Harper, Abigail E. Thornton et al.
In briefMifDroid: A Cross-Language Information Flow Analysis for Android Hybrid Apps
SummaryThe paper presents MifDroid, a framework combining static analysis with guided dynamic analysis to track information flows between Java and JavaScript in Android hybrid apps via WebView. Evaluated on 338 F-Droid apps using addJavascriptInterface, the dynamic phase raised the resolution rate from 36.5% to 74.5%. It reported 14 vulnerable cross-language information flows, five of which maintainers accepted and fixed.
In briefGuided diffusion for generating privacy-safe synthetic text
SummaryThis paper proposes Guided Diffusion, a method for private synthetic text generation that steers the iterative denoising of Diffusion Language Models using new sampling and re-masking procedures. The authors state the framework is compatible with Differential Privacy through post-processing. Across two datasets and two diffusion backbones, it reportedly outperforms Private Evolution and DP-SGD-based fine-tuning in distributional fidelity and downstream utility, while running significantly faster than Private Evolution.
In briefWhen Models Know but Can't Linearly Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs
SummaryThe study analyzes eight code models with 6.7B to 15B parameters on C programs, using three datasets and linear probing. Models encode which patterns code instantiates with high fidelity, but vulnerability information is more accessible as a paired relational signal, such as whether code A is riskier than code B, than as a globally separable label. As a result, standard classifiers on isolated samples achieve limited accuracy because vulnerable and secure samples overlap in representation space.
In briefWhen Pebbles Are Not Atomic: Pure vs. Entangled Pebbling Can Differ Polynomially
SummaryThe paper studies graph pebbling, a model used to measure the memory cost of memory-hard functions and proofs of space. It shows that pure pebbling, which stores only whole labels, and entangled pebbling, which also allows encoded states such as XORs of labels, can differ polynomially. This is a much larger gap than the small factors previously known.
WhyProves a polynomial separation between pure and entangled pebbling, overturning the belief that they differ only by small factors, via explicit indegree-two graphs.
In briefAutoRedClaw: Automated Red-Teaming for Persistent Claw-Style AI Agents
SummaryThis paper introduces AutoRedClaw, an automated framework that generates end-to-end attacks and the environments needed to run them, aimed at persistent assistant agents such as OpenClaw. It uses quality checks, execution-based validation, and coverage organized by risk category, attack strategy, stage, and surface. From its outputs the authors built RedClaw-Bench, a 330-case benchmark, which yields higher attack success rates than AgentDojo, AgentDyn, and DTap. Most agent systems tested across seven harnesses and four frontier models exceed 50% attack success rate.
WhyProposes automated end-to-end red-teaming for persistent claw-style agents with execution-validated attacks and a 330-case benchmark compared against existing benchmarks.
In briefProfile-DP: Differential privacy for user-controlled profile release in personalized LLM inference
SummaryThis paper addresses the privacy risk that personalized large language models expose user profiles and sharing preferences during inference. It introduces Profile-DP, a policy-aware local differential privacy framework that provably bounds the release of facts users withhold, treating public instructions, profile schemas, and authorized facts as public side information. Two finite-domain mechanisms are proposed: DP-SLOT, which perturbs protected attributes independently, and DP-BLOCK, which jointly samples related attributes using public semantic decisions. On the PEEP benchmark, DP-BLOCK achieves the leading utility composite among DP methods at all 13 structured budgets.
In briefYou Are the Trigger: Backdoors Activated by a Speaker's Voice
SummaryThis paper studies a backdoor threat in speech models where an attacker poisons the model during fine-tuning and uses a target speaker's natural voice as the trigger, requiring no access to inference-time inputs. A two-phase fine-tuning method reportedly achieves 90.2% and 97.0% backdoor success on Whisper-medium and Parakeet using about two minutes of target-speaker audio. The authors also show injected instructions in transcripts can make LLM agents such as GPT-4o and Claude carry out harmful actions in up to 87.5% of cases.
WhyProposes speaker voice as a backdoor trigger with two-phase fine-tuning, validated on Whisper and Parakeet plus downstream LLM agent attacks.
Nata\v{s}a Kr\v{c}o, Euodia Dodd, Peter Romov et al.
In briefA Streaming FPGA Design for Client-Side CKKS Encoding and Encryption
SummaryThis paper presents a streaming FPGA architecture for CKKS encoding and encryption on the client side of homomorphic encryption. It computes the shared floating-point encoding transform once and runs integer transforms for six residue moduli in parallel, exchanging intermediate results on chip. At polynomial degree N = 8192, the Altera Agilex 7 implementation produces 5,143 complete ciphertexts per second at 471 MHz, compared with 113 per second for one SEAL-Embedded CPU worker on the same workstation.
Joseph Kurina, Bogdan Pasca, Suleyman Demirsoy et al.
In briefCompromising one edge device can expose others: a defense against cross-device adversarial attacks on neural networks
SummaryThe paper notes that neural network models on mobile and IoT devices can be unpacked, so adversarial examples crafted on one compromised device can transfer to other devices sharing the same model. The authors propose VeilNN, which applies irreversible model obfuscation at the architecture and parameter levels to reduce adversarial transferability. It is said to work across MLPs, CNNs, and Vision Transformers. Reported experiments show an average defense success of 49.19% across four attack types, up to 81.19%, and over 33.16% better than existing defenses.
In briefMind Your Boundaries: Boundary-Aware Model Obfuscation Against Cross-Node Attacks
SummaryThis paper addresses on-device machine learning models, which can be exposed to cross-node attacks when an edge device is compromised and its model is reverse-engineered. The authors propose BMO, which decomposes model parameters into boundary-position and boundary-curvature components and injects noise into the curvature part to create models with differentiated decision boundaries. The reported results show that across four adversarial attack types and four on-device models, BMO achieves an average defense success rate of 68.68%, compared with 22.32% for the strongest baseline, while keeping benign accuracy comparable to baselines.
In briefPower use of post-quantum cryptography on small and general-purpose computers
SummaryThis paper benchmarks three NIST-standardised post-quantum algorithms, ML-KEM, ML-DSA and SLH-DSA, measuring speed and energy use across devices from 32-bit Raspberry Pi models to 64-bit Raspberry Pi 4 and laptop hardware. ML-KEM and ML-DSA reach energy and speed efficiency comparable to classical elliptic-curve cryptography on all tested architectures. SLH-DSA signing is found to be inadvisable on constrained hardware, using up to 243% more energy on 32-bit devices than on equivalent 64-bit hardware.
Olivier Gillot, William J. Buchanan, Madjid G. Tehrani
In briefEnergy Use of Post-Quantum Cryptography on Constrained and General-Purpose Hardware
SummaryThis paper benchmarks the three NIST-standardised post-quantum algorithms (ML-KEM, ML-DSA and SLH-DSA) for key generation, signing and verification. It measures speed and energy use on IoT-class devices, including Raspberry Pi models, and on laptop hardware. ML-KEM and ML-DSA show energy and speed efficiency comparable to classical elliptic-curve cryptography. SLH-DSA signing is found to be inadvisable on constrained hardware, with higher energy costs on 32-bit devices than on 64-bit hardware.
Olivier Gillot, William J. Buchanan, Madjid G. Tehrani
In briefRevisiting Registered ABE Built on Predicate Encodings
SummaryThe paper gives a new definition of predicate encodings better suited to registered attribute-based encryption (Reg-ABE). Under the standard k-Lin assumption, it presents the first Reg-ABE schemes with O(log L)-size ciphertexts for (non-)zero inner product and for conjunctions/disjunctions, as well as the first registered broadcast encryption scheme with such ciphertexts, where L is the maximum number of users. Previously these schemes had O(ℓ log L) ciphertexts, and registered broadcast encryption relied on the generic group model.
WhyA new predicate encoding definition yields the first O(log L)-ciphertext Reg-ABE and registered broadcast encryption schemes under standard k-Lin assumption.
In briefECHO: Linking Anonymous Reviews to Reviewers' Own Submissions
SummaryThis paper shows that anonymous peer reviews can be linked to the reviewer's own submission using artifacts released during the review process, weakening reviewer anonymity. The authors present ECHO, which combines technical-expertise and writing-style signals, and evaluate it on R2S-Bench, a benchmark they built. ECHO ranks the reviewer's own submission in the Top-1 for 34.6% of reviews, versus 0.5% under random ranking.
WhyRaises a new anonymity risk, linking reviews to reviewers' own submissions; evaluated on a self-built benchmark, reaching 34.6% Top-1 versus 0.5% random.
In briefAccountable partial understanding for securing AI agent systems
SummaryThis paper examines the epistemic attack surface created by agentic AI systems that read, write, explain, and authorize security-relevant behavior. It presents a taxonomy of four attack categories and defines accountable partial understanding (APU) with six necessary conditions. The paper derives five design principles and two measurable probe dimensions, illustrated through three examples including an AI coding agent and an autonomous cyber-defense agent.
In briefGame of Phones: Using Game Theory and LLMs to Fight Phone Scams with Automated Bots
SummaryThis paper proposes a game-theoretic framework that lets LLMs learn counter-strategies against phone scammers from in-context experience, without fine-tuning. Scammer-baiter interactions are modelled as a two-player game, with Nash equilibrium used as a benchmark for the learned behaviour. Across 300 simulated dialogues and three LLM architectures, adaptive strategy selection moves closer to Nash equilibrium than non-adaptive baselines.
Nardine Basta, Robin Carpentier, Benjamin Zi Hao Zhao et al.
In briefAnalysis of an AI-based code distinguisher, examining how a neural model tells Goppa codes from random linear codes.
SummaryDeepDistinguisher showed that transformer-like models can tell Goppa codes from random linear codes, sometimes beating traditional methods. This paper uses saliency maps and attention visualization to examine how the model works. It finds the model partly relies on a low-weight-row artifact in the training data, yet keeps significant accuracy after that artifact is removed. The authors conclude the model mainly exploits general combinatorial properties of codes rather than hidden algebraic structure.
In briefPost-quantum commutative group actions via oriented superspecial abelian varieties
SummaryThis paper studies using Shimura class group actions on superspecial principally polarized abelian varieties with CM orientations for post-quantum cryptography. It offers an accessible introduction with many examples, and provides tools to represent CM orientations via higher-dimensional isogenies and to compute the action in the restricted effective group action model. It also gives a method for finding such abelian surfaces oriented by a given CM order and analyzes obstructions to transitivity of the action.
Wouter Castryck, Bogdan Adrian Dina, Péter Kutas et al.
In briefBrushOff: Stroke-Based Repainting That Removes Watermarks From Paintings
SummaryThe paper presents BrushOff, an attack that redraws watermarked paintings using a pretrained stroke-based renderer, requiring no training, watermark knowledge, or generative model. Tested on 500 paintings across five styles, the recent watermark VINE survived all 14 conventional distortions but dropped to 1.8% detection after repainting, with output quality close to clean paintings. The authors also show that watermark robustness to repainting and to diffusion regeneration is a separate property.
In briefDM-RSA-OAEP: A Formal Analysis of a Dual-Modulus Fault-Detection Countermeasure
SummaryThe paper revisits DM-RSA, a dual-modulus RSA variant whose original version was broken by Håstad's attack. It gives a formal treatment of the repaired version, DM-RSA-OAEP, including an IND-CCA2 security proof in the random-oracle model and a fault-detection theorem under an explicit adversary model and a physical-diversity assumption. It also analyzes why the countermeasure becomes ineffective when that assumption fails, such as with common-mode faults on a single chip.
In briefBeyond Attack Success Rate: A Cost-Aware Metric for Iterative LLM Jailbreaks
SummaryThis paper argues that attack success rate (ASR) ignores repeated calls to the victim model, although each extra call gives the deployed system another chance to detect and stop an attack. The authors propose ASR_STEP, which discounts additional victim-model calls while keeping binary success judgments. Evaluated on JailBreakBench with GCG, PAIR with a step budget, and a single-step PAP baseline, GCG's scores fall by 7.0–8.7 points after discounting, PAP's stay unchanged, and PAIR's drop by 3.4–12 points.
In briefBR-MoE: Budgeted Semantic Release for Privacy-Preserving Traffic Analytics
SummaryThis paper addresses privacy risks in traffic camera analysis, where text descriptions alone do not formally limit disclosure. It extends an existing reinforcement learning and mixture-of-experts framework with a budgeted release mechanism. Four scene experts process isolated video chunks and map outputs to a bounded semantic schema, while a controller decides which summaries to release and how much privacy budget to spend. Under explicit chunk isolation and bounded-event assumptions, the full release transcript is said to satisfy an event-level differential privacy bound. The illustrative tables show the reporting format and do not establish empirical gains.
