In briefRerandomizable garbling for arithmetic circuits
SummaryThis paper studies rerandomizable garbling, which lets a garbled circuit be refreshed without changing its function while preserving privacy if at least one rerandomization step is honest. Prior constructions only handle Boolean circuits and have high communication costs. The authors present the first rerandomizable garbling scheme for arithmetic circuits, requiring 17 group elements per multiplication gate, with addition gates free. The scheme can be instantiated under standard subgroup-indistinguishability assumptions, including DCR.
Anasuya Acharya, Pierre Meyer, Claudio Orlandi et al.
In briefDo Flow-Generation Tools Matter? Comparing Tools for Analyzing IoT MQTT Traffic
SummaryThis paper studies MQTT traffic, a lightweight protocol common in IoT, at the flow level. The authors generated over 380K flows from four public datasets using three flow-generation tools and clustered them with several algorithms. They evaluated results with Silhouette score and Adjusted Rand Index. The study finds that the choice of tool changes flow structure and clustering results, and no single tool performs best across all datasets, algorithms, and metrics.
Mohammed Rashed, Carlos Garc\'ia-Rubio, Celeste Campo
In briefTrade-offs Between Location-of-Interest and Current-Location Privacy in Multi-Hop Wireless Networks
SummaryThe paper studies a multi-hop wireless network where nodes relay messages for each other. Even when message contents are encrypted, the fact that two radios communicated can reveal the physical locations of the origin and destination. The authors examine the trade-off between protecting a user's current location and their location of interest. They also consider how users should choose dummy destinations to obfuscate their queries.
In briefPrompt Injection via Forensic Evidence: Attacks on LLM-Assisted Digital Investigations
SummaryThe paper examines how large language models used in digital forensics can be attacked through the evidence they analyze, since that evidence is attacker-controlled. It extends anti-forensic models to cover manipulation of reasoning and proposes a taxonomy of such attacks, identifying a perception gap between tools, human examiners, and models. Three attacks against an LLM-assisted analysis pipeline are demonstrated, and mitigations are proposed.
Frank Breitinger, Jan Gruber, Christopher Hargreaves et al.
In briefBeyond Policy Engines: A Contract for Verified Execution Admission
SummaryPolicy engines decide whether a request is permitted, but an ALLOW result does not confirm that all governance sources participated, that context is exactly bound, or that execution should be admitted. The paper introduces the Binding-Complete Execution Admission Contract (BCEAC) and an architecture separating governance resolution, policy evaluation, independent admission verification, and execution mediation. Its evaluation combines a finite governance-source completeness study with an offline review of archived OPA and Cedar records, and the authors state the evidence is bounded and does not establish broader safety claims.
In briefAlgebraic methods for cyclic isogeny walks on genus-zero modular curves
SummaryThis paper organizes and completes the algebraic maps and relations for genus-zero modular curves X_0(N), which parametrize cyclic N-isogenies and are representable by a single field element. The authors propose a method to derive rational maps lifting j-invariants to X_0(N) and define, analyze, and compute non-backtracking modular polynomials using an extended Elkies method. They also give radical representations and apply the framework to obtain more compact R1CS encodings for isogeny proofs of knowledge.
In briefEras MPC: dynamic-committee MPC with granular preprocessing and abort recovery
SummaryThe paper proposes Eras MPC, a secure multi-party computation model that improves scalability by having small dishonest-majority computation committees run each epoch, supported by honest-majority preprocessing and checkpoint committees. Computation is organized into Eras, each starting with preprocessing that generates correlated randomness. The authors present a protocol using authenticated Beaver triples and the SPDZ online phase, with intermediate states verified and saved by checkpoint committees.
In briefVMSpec: A Decompiler-Based Method Against Virtual Machine Obfuscation
SummaryMalware often hides its code by translating it into bytecode for a custom virtual machine, which makes manual reverse engineering difficult. This paper proposes VMSpec, which automatically builds VM processor specifications so that existing decompilers can analyze the obfuscated code. Tested on 147 programs from an obfuscation benchmark and six domain generation algorithms from real malware, it removed VM obfuscation from nearly all samples. The output was comparable to Ghidra's decompilation of the original code.
In briefRingTrace: Model-Free Detection and Core Tracing of Cache Side-Channel Attacks
SummaryThis paper presents RingTrace, a system-level monitoring framework that combines per-core and uncore telemetry to detect cache side-channel attacks such as Flush+Reload. Its Joint Spatio-Temporal Attribution method builds an interpretable joint-activity matrix to identify a suspicious core without training a model. The authors report that it detects flush activity before secrets leak, reduces false alarms under heavy memory pressure, and adds negligible application runtime overhead.
In briefMPIDetector: LLM-Reasoning-Based Detection of Multimodal Prompt Injection
SummaryPrompt injection attacks can hide malicious instructions in text or images to bypass model safety. This paper proposes MPIDetector, which uses few-shot in-context learning so that LLMs reason about the intent of inputs across modalities, without fine-tuning. Tested on textual and visual benchmarks with several leading models, it reports up to 90.91% text accuracy and 99.28% visual accuracy, and a detection rate of up to 99.80% on obfuscated web-agent injections.
In briefBit-level models for modular multiplication, applied to MSX cipher cryptanalysis
SummaryThis paper introduces two new bit-level models for modular multiplication on 32-bit words, used in the lightweight MSX block cipher. One supports monomial prediction under the 3SDP-woU, and the other supports impossible differential search with exact results for two operands. Using these models, the authors give the first independent cryptanalysis of MSX, including a 7-round integral distinguisher for MSX-128 and key recovery attacks on 8 and 9 rounds.
WhyPresents two exact bit-level multiplication models, first applied to MSX, yielding a 7-round integral distinguisher and key recoveries with substantial computational evidence.
Emanuele Bellini, Mohamed Rachidi, Sharwan K. Tiwari
In briefVerifiable post-quantum TLS handshake that exposes silent verification bugs
SummaryThis IACR ePrint preprint addresses implementation bugs in post-quantum TLS handshakes, where verification errors can go unnoticed while the system stays interoperable. The authors build confirmation-code constructions for ML-DSA, Falcon, ML-KEM, HQC and DAWN, and propose PQCD-TLS, which binds these codes into chained key derivation so that any verification fault causes handshake failure. They prove security properties and report that handshake latency overhead stays below 1% across 48 tested configurations.
In briefSide-channel attack recovering the secret seed of SLH-DSA-SHAKE
SummaryThis paper examines the side-channel vulnerability of the SLH-DSA post-quantum signature scheme when SHAKE is used as its pseudorandom function. The authors propose a correlation power analysis method that averages signature subtraces, uses a partial-then-total CPA strategy, and applies an efficient exhaustive search to recover a full secret seed. Experiments in simulation and on a 32-bit microcontroller require on average 280 to 559 signatures.|
WhyFirst systematic analysis of SHAKE-based PRF side-channel leakage, recovering full secret seeds on a real microcontroller.
Rafael Carrera Rodriguez, Jad Zahreddine, André Monthieu et al.
In briefCertMoE: Routing-Aware Robustness Certification for Mixture-of-Experts Language Models
SummaryThis paper presents CertMoE, the first robustness certification framework for Mixture-of-Experts large language models that accounts for input-dependent routing. Existing certification methods assume a fixed computation graph, which does not hold for MoE models where routing changes execution paths. CertMoE introduces a relaxed routing-containment criterion and certifies prediction consistency of the induced sub-network, yielding a joint probabilistic guarantee. Experiments show that certificates from existing methods are often violated under dynamic routing, while CertMoE reduces the empirical violation rate to 0.
In briefWhy AI Vulnerability Scanners Can Quietly Miss Real Security Flaws
SummaryThis paper examines how LLM-based vulnerability discovery harnesses, the tooling around the model that selects, filters, and merges code and findings, can miss reachable vulnerabilities without reporting that they did. The authors analyze their own two harnesses and 10 other open-source ones, identifying 13 points where such drops occur and organizing them into a taxonomy. They also discuss how attackers could exploit these rules to hide vulnerabilities, and propose design principles and tests for accurate harnesses.
In briefMASAR: A Framework for Analyzing and Reasoning About Multi-Stage Attacks on Telecom Networks
SummaryThis paper presents MASAR, a framework that links architectural threat models such as STRIDE with operational knowledge bases such as MITRE FiGHT. It works in three layers: strategic threat mapping, attack path decomposition using directed acyclic graphs, and synthesis of tactics, techniques, and procedures. The framework is evaluated on a 5G-ready IMS architecture, examining two signaling attack scenarios, and uses MiniZinc constraint models to analyze the reachability of unsafe protocol states.
In briefRounded Gaussians Are Discrete Gaussians: A Correction for Lattice-Crypto Sampling
SummaryThe paper addresses sampling integers from Gaussian-like distributions, which lattice-based cryptographic schemes often need. Rounded Gaussian samplers are efficient and easy to implement but are hard to analyze securely. The authors show that setting σ = s − 1/(24s) makes the rounded Gaussian close to a discrete Gaussian with parameter s, with Rényi divergence 1 + O(1/s^8). This lets practitioners use the corrected sampler for mild to large parameters while analyzing security as if using an ideal discrete Gaussian, at very little cost.
In briefDesign-level backdoors in block ciphers: taxonomy, detection, and key recovery
SummaryThis systematization paper reviews four published design-level backdoors in block ciphers and places them in one taxonomy. The authors give an algorithm that recovers partition trapdoors from S-box tables, proven to produce no false positives and to miss none below an explicit cap. They attack KG-DES, BEA-1 and LowMC-M, finding that whether a backdoor weakens ordinary cryptanalysis depends on the rest of the cipher, and that detectability depends on where the backdoor sits.
WhyUnifies four design-level backdoors, gives a provably sound detection algorithm, and attacks KG-DES, BEA-1 and LowMC-M with MILP and distinguishers.
In briefPost-quantum sublinear lookup proofs via polynomial preprocessing
SummaryThis paper presents plausibly post-quantum sublinear lookup arguments that avoid general-purpose SNARKs. It uses polynomial preprocessing and a Reed-Muller proximity test adapted to the Interactive Oracle Proof framework to certify preprocessing output directly. For size-N polynomials, the commitment scheme needs N^{1+ε}polylog(N) preprocessing and polylog(N) online prover time. The approach supports static tables with k·polylog(N) online prover time and updatable tables with amortized O(k(N^ε+polylog(N))) prover time, while keeping polylog(N) proof size and verification.
Adarsh Basumata, Chaya Ganesh, Varun Narayanan et al.
In briefTable-free constant-work BCH decoding via algebraic index elimination (cryptography preprint)
SummaryThis paper addresses BCH error-correcting decoding for lattice-based key encapsulation mechanisms, where variable work or table lookups could leak error positions. It proposes algebraic index elimination, which turns received-word-dependent selections into fixed circuits over public addresses, removing the need for tables. The authors prove bounded-distance correctness and implement length-511 subcodes, eliminating 5.2 and 7.2 KiB of tables compared with fixed-address WSR baselines and reporting decoder speedups of 35.7 to 82.4 times on an Intel i7-13700.
In briefProtection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint
SummaryThis paper surveys 118 defense studies for retrieval-augmented generation (RAG) systems, organizing them by the endpoint each study actually measures rather than its claimed goal. The survey uses a seven-family taxonomy covering content disclosure, privacy, access control, corpus-use detection, and pipeline integrity. It finds that most evaluations use general question-answering datasets and non-adaptive attacks. A controlled testbed shows that blocking verbatim copying does not prevent recovery of private facts, and the taxonomy, dataset, and testbed are released.
In briefBeyond Binary Labels: Prompt-Level Rubrics for Diagnostic LLM Safety Evaluation
SummaryCurrent LLM safety benchmarks mostly use binary safe or unsafe labels, which offer little explanation and show low agreement among automated judges. The paper introduces DiagSafe, which uses prompt-level rubrics to separately assess safety and usefulness, and builds a bilingual English-Chinese benchmark. The reported results include 95.34% agreement with human annotations and a Cohen's kappa of 0.864 for inter-judge consistency.
In briefAttacking and repairing a decentralized multi-authority NC¹ attribute-based encryption scheme
SummaryThe paper presents a plaintext-recovery attack on the DBDH-based and CBDH-based constructions by Datta, Komargodski, and Waters, using one corrupt authority and two users. The flaw stems from an invalid extension of the LSSS matrix-normalization lemma, which lets a corrupt authority remove identity binding. Replacing the ciphertext masks with independent full linear sharings of zero repairs both variants, and the authors prove static security in the random oracle model. Similar attacks and repairs are also given for two multi-authority attribute-based inner-product functional encryption constructions by Datta and Pal.
In briefAttacks on TPM 2.0-based full-disk encryption, both passive and active
SummaryThis paper revisits tamper attacks on TPM 2.0-based full-disk encryption and analyzes the security of current Windows and Linux implementations. The authors demonstrate passive and active attacks on systems using discrete TPMs connected via SPI, using a mini PC and a notebook as case studies. They also show a prototype attack in a virtualized QEMU environment that targets UEFI firmware, affecting firmware TPMs, and report that it breaks BitLocker on Windows and all current Linux implementations.
In briefUnified Framework for Testing Edge Vision-Language Models Against Physical Adversarial Attacks
SummaryThis paper evaluates how robust edge-deployed Vision-Language Models (VLMs) are against adversarial patches worn on a person, and compares them with conventional object detectors. The authors introduce a unified metric, conditional attack success rate (cASR), and split failures into omission, substitution, and displacement. They find VLMs can be as vulnerable as detectors, with failure mode tied more to output format than architecture. Under distribution shift, VLMs that mainly failed by omission shift toward substitution and displacement failures, which return confident boxes and may be more dangerous.
In briefStudy on Correlated Failures of AI Approval Monitors
SummaryThe paper examines the risk that multiple AI monitors approving an agent's consequential actions, such as payments or code changes, may fail together because they share a base model or a poisoned input. The authors measured small open-weights models and several closed frontier models on payment approval. They found that a rule counting evidence sources instead of votes blocked fewer correct payments at equal safety, and that adding a non-persuadable rule engine restored a safe and live rule under the measured attacks.
In briefRegular Syndrome Decoding Is Easier Than Previously Estimated
SummaryThis paper revisits the concrete hardness of the Regular Syndrome Decoding (RSD) problem, a structured variant used in zero knowledge protocols, pseudorandom correlation generators, and MPC in the Head signatures. The authors propose a refined hybrid algebraic attack that jointly balances zero coordinate guesses and syndrome based eliminations across regular blocks. They estimate that at least one parameter set in each of Ferret, Wolverine, and committed VOLE falls below its 128 bit security target.
WhyA refined hybrid algebraic attack coordinating block guesses and eliminations substantially lowers estimated RSD security across several applications.
In briefHAETAE on a Diet: a lower-memory, faster HAETAE for small microcontrollers.
SummaryThis paper presents an implementation of the HAETAE post-quantum signature scheme that reduces stack and SRAM usage on low-end microcontrollers. It stores polynomials in 16 bits, shares buffers with non-overlapping lifetimes, and caches Gaussian sampling results in unused signature-buffer space to avoid recomputation. The authors report that a C firmware on an ATmega2560 runs key generation, signing and verification within 8,070 bytes of total SRAM. Compared with Low-Stack HAETAE, they state stack usage drops by up to 34% and key generation and signing are 1.18 to 2.51 times faster.
In briefBack to the Bits: GPU and Tensor-Core Acceleration of MAYO Using Bitsliced Representation
SummaryThis paper presents a GPU implementation of MAYO, a multivariate quadratic signature scheme and third-round NIST additional signature candidate, that keeps data in a bitsliced representation instead of the nibble-sliced form used by prior work. On an RTX 4090, it reports higher throughput and lower single-shot latency than the existing cuMAYO implementation across KeyGen, Sign, and Verify. For same-key batches, the authors add a path that maps matrix products onto Tensor Cores.
In briefReverse-Engineering Estonia's IVXV Internet Voting System: Specification and Security Analysis
SummaryEstonia's IVXV is one of the longest-running, largest-scale internet voting systems, but it lacks a precise public protocol specification, making independent audit difficult. The authors reconstruct a detailed specification of its setup, voting, tallying, and audit phases from public source code, documentation, and configuration examples, and add an executable TLA+ model. They analyse security across several verifiability and privacy properties, compare IVXV with Belenios and Swiss Post, and report previously unknown vulnerabilities, with proof-of-concept tests and proposed mitigations.
WhyReverse-engineers Estonia's e-voting protocol, models it in TLA+, and finds unknown vulnerabilities validated by proof-of-concept tests, giving high real-world impact.
In briefRDK-CKKS: A Rigorous Error Analysis Framework for CKKS Computation
SummaryThis paper presents a framework using randomization keys (RDKs), encryptions of zero injected during key-switching and rescaling, to enable rigorous probabilistic analysis of error in CKKS homomorphic encryption computations. The authors claim it is the first fully rigorous error analysis framework for CKKS, and apply it to a complete analysis of binary CKKS bootstrapping and a rigorous parameter set for the bootstrap-and-clean technique. RDKs add evaluation material costing a 27% communication overhead over bootstrapping keys for one evaluation, plus 8% for each additional evaluation.
WhyIntroduces randomization keys enabling rigorous probabilistic error analysis of CKKS, applied to a complete rigorous bootstrapping parameter set.
Taeyeong Noh, Aimad Chabounia, Guillaume Hanrot et al.
In briefLattice-based broadcast with traitor tracing that resists collusion and allows public tracing
SummaryThe paper presents a broadcast and trace scheme that adds traitor tracing to broadcast encryption, even when a pirate decoder is built by arbitrary collusion of users. The ciphertext size is √N·poly(λ, log N), while public keys and secret keys are poly(λ, log N). The construction relies on the decomposed LWE assumption and is described as the first to achieve public tracing using a simple, instance-independent lattice assumption.
In briefBeyond Tokens: NumAnchor, a Method for Representing Numeric Operands in Assembly Models
SummaryThis arXiv cs.CR paper observes that token-level interfaces in assembly language models often obscure numeric-like operands, which make up 45.7% and 40.9% of operand occurrences in two corpora. The authors propose NumAnchor, an input-boundary adapter that represents recoverable numeric operands as typed, canonicalized entities with compact structural descriptors for code, data, and stack context. Across several model families, it improves Recall@1 by up to 35.0% and MRR by up to 31.7% on 10k-candidate function retrieval, and raises execution-aware type recovery by up to 5.2 F1 points.
In briefOptimal Privacy-Utility Tradeoffs for Diffusion Models via Exact Sensitivity and Strong Duality
SummaryThis paper studies differential privacy for diffusion models, arguing that loose sensitivity bounds and isotropic Gaussian noise cause unnecessary estimation error. It shows that worst-case sensitivity over datasets of any size can be exactly characterized using only two records, enabling tighter noise calibration. The authors also derive exact privacy guarantees under Rényi, approximate, and Gaussian differential privacy, and compute the minimum weighted mean-squared error via a semidefinite program with a proof of strong duality.
In briefAgentPolicyForge: Building Policy Benchmarks and Adaptive Guards for AI Agents
SummaryThis paper introduces AgentPolicyForge, a framework that uses executable environments to build policy benchmarks and iteratively train policy guards for AI agents. The authors built PolicyGym, covering ten policy families with 698 training scenarios and 254 held-out, human-reviewed test scenarios. The trained guard reduces attack success rate by a relative 40-44% and causes fewer benign rejections than policy prompting alone.
In briefPerMIT: Protecting LLM agents' persistent memory with machine-verified integrity proofs and community trust
SummaryPerMIT is a memory architecture for LLM agents that aims to prevent injection and poisoning of persistent memory. Under the assumption that only user-typed inputs and gate-confirmed values are trusted, the authors prove two integrity theorems that are machine-checked in Lean 4. The paper reports zero observed attack success on Trojan Hippo and describes community endorsement that lets confirmed items accumulate across users, with tests on τ²-bench using up to 90 agents.
WhyProposes machine-checked integrity theorems and community trust co-scaling for agent memory, with solid evidence on two benchmarks, but impact is limited to agent memory security.
In briefBlack-box red-teaming of multi-agent systems using reinforcement learning
SummaryThis paper introduces ReMAS, a reinforcement learning framework for red-teaming multi-agent systems built on large language models. It fine-tunes attacker models to create adversarial prompts that extract system prompts, using a rewrite stage and a template generation stage. Experiments show higher attack success rates than existing black-box methods, with transfer across different backend models and system structures. The results highlight vulnerabilities in multi-agent systems and the need for stronger defenses.
In briefQuantum algorithm for hidden parabolic subgroups of GL_n over finite chain rings
SummaryThe paper presents a bounded-error quantum polynomial-time algorithm for finding hidden parabolic subgroups of GL_n(R) over any effectively presented finite chain ring R. It first recovers the complete flag modulo the maximal ideal using probes, then lifts it digit by digit, and for residue field size two it lifts a conjugate parabolic subgroup via the congruence filtration. The algorithm outputs generators with probability at least 1-ε in time poly(n, log|R|, log(1/ε)).]
WhyExtends hidden subgroup quantum algorithms to parabolic subgroups of GL_n over all finite chain rings, with a detailed multi-case construction and complexity bound.
In briefTricking LLM safety guards into judging the wrong text
SummaryThis paper studies an attack on LLM safety guards that check content before an application acts on it. By appending a forged task structure and a harmless decoy after a harmful request, the attacker makes the guard judge the decoy, letting the harmful request pass. The authors evaluate this across several guards and propose training the guard to score content by its most harmful part, which sharply reduces attack success; whether clean performance is non-inferior remains inconclusive.
WhyProposes target rebinding, a new attack exposing guard grading flaws, validated by pre-registered tests, multi-guard benchmarks, and a trained defense.
In briefLEAN: Reshaping how sensitive a trained network's weights are to bit flips, to make models more tolerant of memory errors
SummaryThe paper observes that a trained network's weights differ widely in how much they affect accuracy when a bit flips, with the most sensitive 1% carrying about a fifth of the damage. It proposes LEAN, a composite regularizer with a range term and a tail term that shifts the sensitivity distribution. Across nine vision models, the sensitive tail shrinks 5 to 13 times while accuracy stays within 0.5 points.
WhyNovel regularizer reshaping weight sensitivity distributions, validated on nine vision models against several defenses; impact mainly limited to bit-flip robustness and quantization.
In briefAI Security Literacy: An Ecosystem-Based Competency Framework and K-12 Learning Platform
SummaryThis paper proposes an AI Security Literacy (AISL) framework with six dimensions covering the school ecosystem. Its technical dimensions draw on public AI-safety benchmarks and a reproducible multi-seed adversarial evaluation, while its attitudinal dimensions use nationally representative survey data from U.S. teachers and adults. The authors report that only 34.5% of teachers say their school has an AI policy. They also present NeuralFortify, a browser-based K-12 platform built on real AI models, as an illustrative implementation.
In briefLong-term memory in LLMs raises risks: from prompt injection to persistent compromise
SummaryThis paper examines "memory injection," a vulnerability where persistent memory in conversational AI lets malicious instructions carry over across sessions. The authors propose a general threat model and show that ChatGPT, Claude, and Gemini can be manipulated to spread disinformation, generate harmful content, or simulate unresponsiveness, even in fresh sessions. They also derive defenses from the model and find that nearly half remain unimplemented across the evaluated services.
WhyProposes a general cross-session memory injection threat model, validated on three major services across multiple attack goals, with broad impact.
Pedro H. Barcha Correia, Matheus Azevedo de S\'a, Paulo H. Gomes de Senna et al.
In briefDISCO*: Distributed, scalable oblivious joins and primitives for secure databases
SummaryThe paper presents DISCO, a scalable, distributed, fully oblivious database system that combines hardware enclaves with oblivious primitives to resist side-channel and leakage-abuse attacks. It introduces distributed frameworks and optimizations that reduce inter-server communication. On non-foreign key joins with N = 2^25 elements, the authors report speedups of 88× over Jodes and 180× over SODA, and they are the first to report results at the terabyte scale.
Apostolos Mavrogiannakis, Xian Wang, Ioannis Demertzis et al.
In briefHow much the agent harness and context matter for LLM vulnerability discovery across models
SummaryThis paper studies how an agent harness and its prompt and context affect LLM-driven vulnerability discovery, testing 24 model-runner configurations on a production codebase with non-public vulnerabilities. Across 265 confirmed security root causes, no single configuration covered all findings, and the best two-run combination covered 60.4%. In a four-model experiment, an engineered prompt and CodeQL-derived call graph improved yield for smaller and mid-tier models more than for the frontier model.
In briefCALLIOPE: Private AI-usage insights via LLM-driven topic discovery without embeddings
SummaryThe paper introduces CALLIOPE, a top-down framework for discovering topic hierarchies in large unstructured corpora such as LLM conversations, with differential privacy support. Unlike approaches that cluster vector embeddings, it uses LLM capabilities directly across the whole pipeline. Experiments reportedly show better utility than existing embedding-based methods under differential privacy, especially at high privacy levels. Output quality is evaluated with standard clustering metrics and novel utility metrics introduced by the authors.
In briefSign Here: Source Attribution for a More Trustworthy Software Supply Chain
SummaryThis paper studies malicious packages in the npm and PyPI registries, testing whether they tend to omit a traceable source repository to avoid visibility. The authors built a dataset of about 47,066 malicious packages and analyzed them alongside a sample of benign packages. They report that simply checking for an attributed source could prevent malware in a large share of cases, depending on the level of source vetting. However, only 47.4 percent of benign packages attribute a source that an end user could build from.
WhyProposes source attribution as a malware prevention signal, validated empirically across large npm and PyPI datasets with strong practical implications.
In briefA spectral theory of how local leakage builds up into global leakage in secret sharing
SummaryThis paper studies how leakage from individual shares determines total leakage in additive secret sharing over a finite abelian group. It shows that local mutual information alone is insufficient, because a structural spectral alignment parameter also matters, and two channels with identical local mutual information can produce exponentially different global leakage. The authors also show that automorphism-weighted sharing can achieve perfect leakage cancellation with finitely many shares, which ordinary additive sharing cannot do under the stated conditions.
WhyIntroduces a spectral alignment parameter beyond local MI, proving separation theorems and exponential gaps in global leakage decay for additive sharing.
In briefProof-Carrying Contracts: Agreements That AI Agents Cannot Violate
SummaryThis paper introduces Proof-Carrying Contracts (PC2), a framework requiring AI agents to supply a machine-checkable proof before running an operation, showing the agreed constraints hold in every case their model allows. An execution system called the Airlock checks these proofs and controls access to the operation. The authors prove the constraints hold at every instant during execution, even for an adversarial agent, and identify when this implies real-world safety.
In briefAttacks Inferring Database Membership in Private Vector Search
SummaryThis paper studies membership-inference attacks that exploit distance geometry leaked by protected vector databases. The authors break the prior Scale-and-Perturb scheme and introduce Rotate-and-Perturb, proving perfect membership privacy for uniform data on the sphere with no known plaintexts. They also evaluate ideal distance-comparison-revealing encryption and an encrypted HNSW index, and test shuffling and secret projection as mitigations.
WhyProves perfect membership privacy for RAP on uniform sphere data, derives a known-plaintext lower bound, breaks SAP, and evaluates several schemes with substantial experiments; practical scope is narr
Georg Fuchsbauer, Carter Luck, Adam O'Neill et al.
In briefA Digital Twin for Assessing Cyber-Social Impact
SummaryThis paper proposes a framework combining Digital Twin technology with a Cyber-Social Security model to simulate and quantify cyber threats to critical infrastructure such as industrial control systems. It uses virtualized ICS environments built with Mininet and MiniCPS, and introduces the Cyber-Social Vulnerability Scoring System (CSVSS), which extends CVSS with a social impact dimension to produce a single reproducible severity score. A Large Language Model performs a first-pass analysis, while a human analyst validates the findings with explainable AI feedback and keeps decision authority over critical cases.
Vita Santa Barletta, Danilo Caivano, Gabriel Cellammare et al.
In briefAfter the Attacker Leaves: A Benchmark for Carryover Attacks on LLM Agents
SummaryThe paper studies how LLM agents that keep memory files or run scheduled tasks can be hit by a one-time prompt injection that fires again in later sessions. The authors introduce CarryoverBench, with 12 personal-assistant scenarios and 101 attack tasks across instant, autonomous, and latent trigger channels. Across five frontier models, planted payloads re-fired over five rounds without measurable decay, and the paper suggests runtime-layer controls are needed beyond prompt-level defenses.
WhyIntroduces cross-session carryover attacks and a benchmark separating planting from triggering, a new gap, though experiments across five models and two runtimes are moderate in scale.
In briefSPECTER: Covert Exfiltration of Data From Air-Gapped Systems via USB Power Changes
SummaryThe paper presents SPECTER, a covert channel in which a compromised host with admin rights encodes bits by controlling USB power and device-state operations, leaking short secrets from air-gapped or segregated systems. Experiments on Windows 10 and Ubuntu 22.04 with commodity hardware show low-rate signaling recovered via phone charging states, peripheral behavior, and near-field radio. The authors conclude that USB power-management and device-state events should be treated as security-relevant telemetry.
In briefMAS-Guard: A unified framework that protects single and multi-agent LLM systems
SummaryThis paper introduces MAS-Guard, a unified framework for protecting AI applications built from single or multiple agents, including both instrumentable and opaque agents. It combines local task-specific expert checks on individual agents with system-level structural and semantic checks, enforced through allow, reflection, confirmation, and block interventions. Evaluated on six benchmarks with three agent LLMs, it reduces overall attack success rate by 71.5% to 86.3% relative to unguarded agents while meeting a utility criterion on benign tasks.
In briefOptimal Proofs of Sequential Work: tight bounds and a cheaper construction
SummaryA proof of sequential work lets a verifier be convinced that a prover performed T sequential computation steps. The authors show that any efficient graph-labeling-based construction must send Ω((λ log T)/δ) labels, so the 2018 Cohen–Pietrzak construction is asymptotically optimal in communication and verifier cost. They also present a new construction with maximum in-degree two that matches these bounds up to constant factors. It reduces the honest prover's total hash-input complexity from Θ(T log T) to Θ(T).
WhyProves a communication lower bound for graph-labeling PoSW matching prior constructions, and gives a max-indegree-two construction cutting prover hashing from T log T to T.
In briefSmall-model guard that flags malicious instructions hidden in retrieved text for RAG systems
SummaryThe paper presents nokast-secureRAG, a roughly 0.5B-parameter small language model placed between retrieval and generation to classify query-context pairs as safe, suspicious, or malicious. Trained with a teacher-judge-student pipeline, it reaches 0.994 recall at a 0.026 false-positive rate on an in-distribution test set. The authors report that recall falls to near zero on the external PoisonedRAG benchmark, indicating that fluent fact-poisoning attacks fall outside the detector's threat model.
