In briefAuditing hand-written inputs to learned access control
SummaryThe paper examines two hand-built components of learned access control: a hard-deny set and a region map that decides which requests learned rules handle. Auditing these on five public ABAC Lab policies, the authors find that deny clauses faithfully transcribing explicit restrictions are often unsound, which would withhold many granted requests if shipped unchecked. The paper also analyses hybrid routing and loss evaluation issues, and releases an artefact that regenerates the reported numbers.
In briefAfterDeleteBench: Testing Whether LLM Agents Still Remember Deleted Secrets
SummaryMany LLM agents keep external persistent memory and create derived state, such as summaries, from past interactions, so deleting an original record may not remove information carried by its descendants. The authors introduce AfterDeleteBench, which compares an agent that was exposed to a synthetic secret and then deleted it against a matched agent never exposed to it. In the primary setting, a single query recovered about two thirds of deleted secrets from Qwen2.5-7B-Instruct, while controls recovered none, and reconstruction also succeeded from separately stored components. The paper argues that source deletion should be evaluated behaviorally at the level of the agent and its memory system.
WhyIntroduces a matched-control behavioral audit showing deleted secrets are reconstructed from components across several models, bypassing literal filters.
Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian et al.
In briefPractical auditing toolkit for differentially private graph data releases
SummaryThis paper presents a methodology and open-source Python toolkit for empirically auditing differentially private graph release mechanisms, addressing canary construction and witness statistic selection. The authors combine these components with a statistically certified testing procedure. Applying it to a published state-of-the-art node-DP mechanism, they obtain certified lower bounds on the privacy parameter ε that exceed the claimed value, falsifying the guarantee for the audited implementation. The violations persist even under stricter input restrictions, such as non-empty and connected graphs.
WhyProposes graph-specific DP auditing and certified lower bounds falsify a published Node-DP mechanism's claimed guarantee, with strong evidence.
In briefInput privacy leak via manipulated exits in cloud multi-exit networks
SummaryThis paper studies a privacy risk in cloud-hosted multi-exit neural networks. A malicious cloud provider can supply a manipulated model that routes inputs with a target sensitive property to a designated exit, then infer that property from per-query latency alone. Across four datasets and ten target properties, the attack reaches an average F1 score of 0.73, versus 0.25 for the strongest baseline, with main task accuracy dropping by less than 1.3%.
WhyIntroduces a new latency-based input-property leakage attack on multi-exit networks, validated on four datasets across ten properties with F1 0.73 versus 0.25 baseline.
In briefFederated density peak clustering with shuffler-based anonymization for one-shot learning
SummaryThe paper proposes eFDPC, a one-shot federated clustering method that combines evolving fuzzy data-stream clustering with density peak clustering. Each client builds micro-clusters from private data mini-batches and sends only selected density peaks rather than full local models. A shuffler layer between clients and the server anonymizes contributions before global peak selection. Experiments on synthetic and real benchmark datasets report that eFDPC outperforms recent federated clustering baselines in one-shot settings and scales to higher-dimensional, non-IID data.
In briefCritical review of structural attacks on Classic McEliece and their claimed costs
SummaryThis paper critically reviews recent structural cryptanalysis of McEliece schemes using binary Goppa codes, separating proven distinguishers, conditional cost estimates and actual key recoveries. It examines Saarinen's HOVER algorithm and his TII-254 challenge recovery, along with Weis's cost study of Holdout/Hermite key recovery. The authors find that the cost model is the main quantitative uncertainty and that none of the results is yet a demonstrated attack on the target parameters.
In briefBelT Block Cipher: A Full Description of Belarus's National Encryption Standard
SummaryThis paper describes BelT, a block cipher with a 128-bit block size and 256-bit key developed in Belarus and adopted in the national standard STB 34.101.31 for encryption and integrity control. It gives a complete description of the cipher and explains its design principles, which use an eight-round structure combining Feistel network and Lai-Massey elements. The paper also compares BelT's software performance and possible optimizations with candidates from the AES competition.
Sergey Agievich, Victor Galinskij, Nikolai Mikulich et al.
In briefWildFakeToolBench: A Benchmark Testing AI-Image Detectors Against Web-Sourced Image Tools
SummaryThis paper introduces WildFakeToolBench, a benchmark of 156 executable image-processing tools collected from 220 public web sources. The tools were used to process generated images, testing how well six state-of-the-art AI-image detectors hold up against them. The results show that attack effectiveness is sparse and varies by detector, and the work proposes the benchmark as a framework for evaluating detector robustness.
In briefDistributed Producer-Consumer Model: A Compiler Approach to Asynchronous BFT
SummaryThe paper proposes the Distributed Producer-Consumer Model (DPCM), which separates payload-specific certified availability from payload-oblivious binary finalization, and proves it compiles qualifying producer-consumer pairs into an asynchronous BFT object log. The authors instantiate it as Octopus, combining parallel consistent broadcast with batched asynchronous binary agreement. In eight-region WAN experiments, Octopus stays within 6.5% of Dumbo-NG's fault-free throughput, outperforms it under maximum silent faults at n=8 and n=16, and achieves substantially higher throughput than Alea-BFT.
WhyProposes a compiler-style producer-consumer model separating availability from agreement, with proofs and WAN experiments showing throughput and latency gains over Dumbo-NG and Alea-BFT.
In briefA systematic comparison of ring-oscillator noise generators for side-channel protection
SummaryThis paper examines ring-oscillator-based additive noise generators, which add noise to hardware to counter side-channel attacks. The authors note that existing designs use different evaluation methods, so they cannot be fairly compared, and they analyze limitations such as noise filtering. They provide guidelines on inverter chain length, output amplification, and output frequency randomization. Applied to an example AES implementation, their tailored generator reportedly significantly outperforms existing ring-oscillator designs.
Florian Stolz, Dina Hesse, Julius Hermelink et al.
In briefFederated differentially private optimization using low-rank preconditioning
SummaryThis paper studies differentially private optimization in federated learning, using a private estimate of the feature covariance matrix as a Hessian approximation for generalized linear models. The authors propose a federated DP-PCA framework that has linear communication cost while providing central DP guarantees under secure aggregation. It includes error bounds for the covariance estimate and for the resulting preconditioned gradient descent. Experiments show the method matches a centralized baseline with quadratic communication cost at a fraction of the communication.
In briefSecLog-Bench: A scalable benchmark testing whether AI models can reason through cybersecurity logs step by step.
SummarySecLog-Bench is a benchmark for evaluating large language models on analyzing cybersecurity logs. It uses a scalable simulation platform covering 29 attack scenarios and combines audit, application, and network traffic logs, with each sample annotated by a structured step-by-step evidence chain. Eight mainstream LLMs were tested, and even with scaffolded evidence, the best model reached only 44.44% accuracy and 45.07% Macro-F1. The results also show that reasoning is often unreliable, and correct predictions can come with flawed reasoning.
In briefANNULAR: Post-Quantum Private Transactions via Isogenies and Recursive Batch Proofs
SummaryThis paper presents ANNULAR, a shielded transaction pool built on isogeny-based primitives, following the structure of Zcash Sapling with hidden amounts and nullifiers. Every component is post-quantum, and each transaction carries a STARK proof that is folded into a single recursive proof per block. The authors report measured proof sizes, verification times, and proving costs. They also state which security claims rest on existing proofs and which are not yet proved.
In briefReDence: A hybrid AI framework for fast, evidence-based detection of social engineering scams
SummaryThis paper presents ReDence, an open-source framework that combines two locally hosted models to detect social engineering scams on websites. An agentic investigator model plans investigations, interprets evidence, and writes reports, while a specialized decider model handles yes/no and multiple-choice decisions. The authors report that ReDence outperforms existing detectors across twelve scam categories and produces structured, evidence-grounded reports that analysts can audit.
Jaishnoor Kaur, Josef Hor\'a\v{c}ek, Ian Waskom et al.
In briefAdaptive Cryptographic Framework Linking Number-Theoretic Primality Testing and Algorithmic Optimization
SummaryThis paper proposes an adaptive, arbitrary-precision framework for primality testing, which public-key systems such as RSA, Diffie-Hellman, and ECC need to generate and verify very large primes. It combines classical number theory with machine learning and optimization methods, and analyzes deterministic and probabilistic tests, hardware-level optimizations, and quantum-secured entropy sources. The authors also provide mathematical proofs of security even when the prime distribution is biased.
In briefMIG-COW: Gradient-decomposition attack that transfers across deepfake detectors
SummaryThis paper proposes MIG-COW, an adversarial attack framework that creates generalizable, visually imperceptible examples to fool deepfake detectors. It combines momentum-integrated gradients with consensus-orthogonal decomposition to target both shared and model-specific weaknesses across CNN and ViT detectors. On the AADD-2025 benchmarks it reaches 99.96% white-box attack success with high SSIM, but only 7.16% against official black-box targets, showing transferability remains a challenge. The authors also find that adding low-performing but diverse models to the ensemble can reduce attack effectiveness.
In briefSlowing LLM inference and raising its cost through a Rowhammer attack
SummaryThis paper asks whether a Rowhammer-induced bit flip in CPU DRAM can slow GPU-based LLM inference while keeping outputs correct. The authors present LLVMhammer, which causes a bit flip in Triton's compilation pipeline so it generates a functionally identical but slower GPU kernel. Because the kernel is cached on disk, the slowdown persists across later inference runs. Tests on several LLMs and NVIDIA and AMD GPUs show latency increases of 4-16%, and the attack can also corrupt outputs.
WhyFirst Rowhammer attack slowing LLM inference via Triton compilation bit-flip, 4-16% latency increase across models and two GPU vendors.
In briefRadical isogenies of every degree: a way to compute class group actions via roots
SummaryThe paper studies how to evaluate chains of isogenies between supersingular elliptic curves over finite fields, as used in CSIDH. It proves a corrected compact formula for radical isogenies of every degree N≥4, odd and even, over fields of characteristic coprime to 2N, with one N-th root per step. The authors also give algorithmic costs and show how to evaluate these isogenies on points, so a class group action can be computed without sampling torsion points.
WhyProves previously conjectured radical isogeny formulae for all N≥4, including even N, and resolves the sign choice, a substantive theoretical advance.
In briefCan Loan Staff Detect AI-Edited Financial Statements? An Empirical Study
SummaryThree experienced loan processors and underwriters reviewed 134 forged PDFs, created by AI editing of 47 genuine financial documents supplied with consent, without being told the files had been altered. About 10.6% of their judgements (14 of 132) contained evidence-supported concerns, all tied to identifier inconsistencies, and no reviewer identified an actual edit from visual cues. With only three reviewers and no genuine-file controls, the results describe this exploratory setting only.
In briefAgentTriage: Replayable Security Diagnosis Across Different AI Agent Runtimes
SummaryAI agents that use tools to write files, run code, or send data often give final responses that do not explain the security events they cause, and different runtimes expose evidence in incompatible ways. The paper introduces AgentTriage, a contract requiring conclusions to cite standardized runtime events and to abstain when required evidence is missing. Given the same normalized trace, overlay version, and pre-run policy oracle, diagnoses can be recomputed and rechecked deterministically without language-model judgment. On 120 adjudicated cases, it reached 0.858 grounded joint diagnosis, improving on the strongest same-schema baseline by 0.175.
WhyProposes replayable cross-runtime security diagnosis contract, evaluated on 120 adjudicated cases with joint diagnosis gain of 0.175 over the strongest baseline.
In briefAIRO: A streaming machine learning system that detects and responds to threats in industrial IoT networks
SummaryThis paper presents AIRO, a framework for monitoring and responding to cyber threats in Industrial Internet of Things environments. It combines Apache Kafka streaming, attack-specific feature extraction, machine learning inference, confidence-based decisions, and risk reduction actions such as IP blocking and traffic limiting. The authors evaluate it on four datasets covering C2 beaconing, reconnaissance, SQL injection, and phishing. The best models, mainly Gradient Boosting and LightGBM, reach F1-scores up to 0.9229 with low latency from event input to mitigation.
Raima Deb, Pranav M Pawar, Mithun Mukherjee et al.
In briefCollusion-resistant registered functional encryption for circuits without obfuscation
SummaryThis paper studies Registered Functional Encryption (Reg-FE), where users generate their own keys and register them, so a transparent key curator can combine them into a compact master public key, avoiding key escrow by a central authority. Earlier constructions were insecure when multiple malicious users collude or relied on indistinguishability obfuscation. The authors present the first collusion-resistant Reg-FE without obfuscation, secure against a bounded number of colluding users, where the bound is either global or dynamically set by the encryption algorithm. Both settings use generic constructions from registered attribute-based encryption, instantiated from the standard k-Lin or succinct LWE assumptions.
WhyConstructs the first collusion-resistant Reg-FE without obfuscation, with dynamic collusion bounds, instantiated from k-Lin and succinct LWE assumptions.
In briefEfficient laconic oblivious transfer secure against malicious parties
SummaryThis paper studies laconic oblivious transfer, where a receiver compresses a large database into a short digest, and a sender produces a succinct ciphertext that reveals only one indexed message. The authors present the first such construction secure against malicious adversaries that uses its underlying primitives fully in a black-box manner. It combines vector commitments with witness encryption, adding equivocal vector commitments and maliciously secure witness encryption. Instantiated from standard assumptions such as LWE, the scheme achieves efficiency comparable to existing black-box constructions that offer only semi-honest security.
WhyFirst fully black-box maliciously secure laconic OT via equivocal vector commitments and witness encryption; novel, but evidence is purely theoretical.
In briefOmni-UBench: A Benchmark for Testing Safety Guardrails on Multi-Format AI Models
SummaryThis paper introduces Omni-UBench, the first comprehensive benchmark for evaluating safety guardrails in omni-modal large language models that process text, images, audio, and video. It assesses guardrails on safety, utility, and reliability using over 183k samples from 35+ sources, labeled under a unified risk taxonomy. Testing 15 models, the authors find that modern models moderate content well even without guardrail-specific tuning, but existing guardrails struggle with cross-modal queries hiding harmful intent or using sophisticated jailbreaks, and show safety hallucination and over-sensitivity to text patterns.
In briefScaling Laws for Safety Probes: Predicting Monitoring Performance from Model Size and Labels
SummarySafety probes are classifiers trained on a language model's activations to monitor it in real time, but they must be retrained for each new model or harm area, and their performance is hard to predict beforehand. The authors build six new safety datasets and train two probe architectures on 20 base models from five model families, using 32 to 10^6 labels each, measuring error as 1 minus AUROC. They find two simple scaling laws: the lowest achievable probe error falls as a power law in model size, and error decreases toward a floor as label count grows. The laws hold across tasks, model families and architectures, with only the fitted constants differing.
WhyProposes two simple scaling laws for safety probe error across model size and label count, validated on 20 models and six new datasets.
In briefYour Token Is Gone: A Token-Draining Defense Against LLM-Based Scam Systems
SummaryThis paper presents TokenTrap, a defense that redirects suspected LLM-based scam systems toward benign, low-value computation while withholding credentials and payment details. It combines a token-task library, a router choosing among single-agent and multi-agent workflows, and a bounded anti-guardrail strategy. In 50-round traces, token consumption was amplified by 2,487.0x, 1,616.0x, and 567.8x relative to a baseline, and the router reached 85.67% accuracy on 300 labeled prompts.
In briefFVQKD: Machine-Checked Security Proofs for Quantum Key Distribution in Rocq
SummaryThis paper presents FVQKD, a Rocq library for machine-checking the security proofs of quantum key distribution (QKD). Its first result is a complete, end-to-end machine-checked proof of composable, finite-key security for the BB84 protocol, containing no admitted steps and relying only on the Rocq kernel and standard axioms. The authors report that the mechanization exposed necessary side conditions left unstated in the published argument, one of which revealed a missing proof branch.
WhyFirst end-to-end machine-verified finite-key composable BB84 security proof, admit-free, uncovering an omitted side condition and missing proof branch in the original.
In briefTraining-free fingerprinting of LLMs using weight-level spectral features
SummaryThis paper proposes a fingerprinting method for large language models that works directly on model weights, without input samples, generated outputs, or activations. It builds spectral scalar features from singular-value distributions of GATE projection weights in gated feed-forward networks, then pools them by depth into a model-level fingerprint compared via linear centered kernel alignment. Experiments reportedly separate source-related from unrelated models and remain stable under instruction tuning, quantization, pruning, and distillation-related modifications.
In briefHiMark: A Hierarchical, Controllable Multi-Bit Watermarking Method for LLM Text
SummaryThis paper proposes HiMark, a watermarking framework for text generated by large language models that embeds multi-bit provenance information to help trace content origin. During embedding, it uses a hierarchical candidate-control mechanism, and during detection, a model-agnostic evidence aggregation method extracts the watermark. The authors report that HiMark improves extraction accuracy while maintaining text quality, reaching 90.01% accuracy under paraphrasing attacks when embedding 32 bits in a 300-token text.
In briefClosing the Closed-World Gap: Interpretable Anomaly Detection with a Hybrid TSK-FCM Ensemble on BETH
SummaryThis paper addresses the problem that supervised cybersecurity models generalize poorly to new attacks, while unsupervised models separate anomalies poorly. The authors propose a hybrid fuzzy ensemble combining a gradient-optimized TSK fuzzy classifier for known insider threats with a Fuzzy C-Means module for geometric anomalies. They find traditional fuzzy membership degrades in high dimensions and introduce a Min Distance metric instead. On the BETH test set, the method reaches an AUROC of 0.9951, 17.1% above the Isolation Forest baseline.
Lohith Srikanth Pentapalli, Josette Riep, Justin Ouwerkerk et al.
In briefBeyond End-to-End Recovery: Rolewise Analysis of LLM Steganography
SummaryThe paper argues that end-to-end recovery, the usual metric for LLM steganography, cannot tell encoding failures from decoding failures or show how private messages appear in transmitted text. The authors propose a rolewise decomposition framework that separately examines the representation of messages in encoder text, what decoders recover, and what deterministic verification can establish. Across 7,200 encoder responses, they find 168 verifiable encodings missed by decoders and 706 responses that carry reconstructed messages through word-length or token-initial patterns not specified in the instructions.
In briefMembership inference attack on Private Evolution
SummaryThis paper studies Private Evolution (PE), a synthetic data method that uses only black-box inference with foundation models. The authors introduce the first white-box membership inference attack tailored to PE's voting-based algorithm. The attack exploits how iterative filtering biases synthetic candidates toward private instances. Results indicate private data leakage in PE applications across image, text, and tabular data.
In briefNot Where You Think: Defending Photo Location Privacy Against Reasoning-Based Geolocation
SummaryThis paper shows that large reasoning models can infer where ordinary photos were taken from visual content alone, posing location privacy risks even after metadata is removed. The authors introduce GeoTrace, a structured reasoning attack, and test it on 525 everyday images, localizing 25.71% within 1 km with Gemini-3-Flash and 16.95% with GPT-5-mini. They also propose GeoShift, a user-side defense that rewrites high-impact location clues before release, reducing street-level localization to 2.48% and 3.81% respectively.
WhyProposes a reasoning-based geolocation attack and a user-side defense, with evaluation on 525 images and adaptive attacks, giving broad privacy impact.
In briefAgent Mosaic: Detecting Confidential Information Leaks in LLM Agent Systems
SummaryThis paper studies how LLM agents can combine information from several accessible documents and disclose a sensitive conclusion, a risk the authors call the mosaic effect. They test 30 synthetic cybersecurity, medical, and military examples in controlled simulations and in two open-source agent frameworks. Even with benign queries, the best-performing model disclosed forbidden composite conclusions in 7.08% of simulated answers, and adding classification headers and aggregation rules did not eliminate unsafe disclosures.
In briefHAWC-Leak: Identifying Running Workloads on Heterogeneous Chips from Power Side-Channel Leakage
SummaryThis paper presents HAWC-Leak, a framework that uses non-invasive power analysis to identify which hardware accelerator task is running in real time on heterogeneous platforms combining processors and FPGAs. The authors captured power traces on a ChipWhisperer CW305 Artix-7 FPGA for AES-128, ECC P-256, SHA-256, a CNN, and an idle state. A hierarchical Random Forest classifier was used to identify the active workload. The authors report 100% classification accuracy in controlled mixed-activity scenarios.
Muhtasim Alam Chowdhury, Arthur Kim, Rozhin Yasaei et al.
In briefPaper overview: rank ceiling for twiddle-perturbation faults on the forward NTT
SummaryThis paper studies how static replacements of twiddle factors in the forward number-theoretic transform used by NIST-standardised ML-KEM and ML-DSA affect the map from a secret polynomial to the transform difference. For a single replacement, the rank equals the number of butterflies sharing that twiddle and halves by layer. The authors certify the relevant kernel equalities in Lean 4 and examine when a faulty released key allows reconstruction of secret information.
In briefData-void exploits: how attackers can steer web-searching LLM answers with planted pages
SummaryThis paper studies a new vulnerability in web-searching large language models, called a data-void exploit, in which attackers publish narratives in search areas where reliable content is scarce. The models retrieve, cite, or use these pages in their answers. Across tested prompt tones, models, and attacker strategies, attacker content appeared in responses 31% of the time, and a single controlled page could be enough. User prompt tone and model choice offered limited protection, so the authors call for defenses against such attacks.
WhyIntroduces a new data-void attack on web-searching LLMs, testing prompt tone, model, and attacker controls systematically, showing single-page success.
Michele Guerra, Wuyeh Jobe, Sanjana Nambiar et al.
In briefThe Psychology of an AI Hacker: Steering Emotion Directions to Improve Cybersecurity AI
SummaryThis paper tests whether emotion-like representations inside language models can improve cybersecurity AI. Using the 4B-parameter CT0 model, the authors extract 171 emotion directions and steer them across 415 cybench-subtask campaigns, finding that steering toward calm, serene, or desperate raises performance by 1.6 to 2.1 points. They also introduce a lightweight router that selects emotion directions during execution, adding about 4.2 points with roughly 80 ms overhead per decision.
V\'ictor Mayoral-Vilches, Hugo Osuna, Aitana Cornago
In briefMirage: Targeted jailbreak attack on post-generation safety checkers in multimodal diffusion models
SummaryThis paper presents Mirage, a multimodal jailbreak attack that can bypass post-generation safety checkers used in diffusion-model pipelines. It hides an adversarial target, either a reference NSFW image or a malicious text description, inside an imperceptible perturbation on a benign input image. The authors evaluate Mirage on Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2, reporting strong targeted evasion across diverse checkers with limited black-box queries.
In briefAdversarial Weaknesses of Neural Receivers with Unrolled LDPC Decoders
SummaryThis paper examines how robust neural receivers for 5G New Radio are to adversarial perturbations at the receiver input. The authors find that standard gradient attacks through an unrolled LDPC decoder barely outperform random Gaussian noise, due to gradient masking from tanh saturation in belief propagation. They propose two loss functions that restore attack strength, raising block-error rate by one to four orders of magnitude at matched perturbation power.
Aakash Saini, Jafar Aco Mohammadi, Wolfgang Gerstacker
In briefScreening medical AI models for patient privacy risk before training
SummaryThe paper shows that medical AI models shared without training data can still reveal whether a given patient's records were used, via membership inference attacks. The authors measured each patient's vulnerability across 7,789 models on six clinical datasets, finding that training choices change how many patients are exposed but the highest-risk patients largely stay the same. They developed a lightweight screening tool using four small models to flag high-exposure patients before production training.
Konstantinos Vrettos, Eleftherios Tzanis, Haridimos Kondylakis et al.
In briefPhishGen: Assessing LLMs for Automated Phishing Website Generation
SummaryThis paper presents PhishGen, a framework that evaluates how faithfully and functionally large language models can generate phishing pages from natural-language prompts. It tests 14 LLMs against 64 real-world phishing kits using similarity metrics, a crowdsourced user study, and execution-based checks of the credential-harvesting pipeline. The authors report that GPT 4.1 achieves the highest functional success, while uncensored models rarely exceed 45.4%, and they identify generator fingerprints that similarity-based defenses miss.
In briefVX-One: Real-Time Network Attack Triage with Calibrated Decision Heads
SummaryVX-One is a small multi-head network of 100K to 10M parameters that outputs calibrated decisions: a binary gate, a closed-set classification with an unknown option, and an ordinal score, with about 0.7 to 1.7 ms CPU latency per event. The authors compare it against XGBoost, Random Forest, MLP and Kitsune baselines on UNSW-NB15, CIC-IDS2017 and EMBER2024, and measure a Suricata cascade. Results are mixed: the gate matches the best baseline on UNSW and wins on temporal CIC detection, but loses multi-class attribution to XGBoost, and calibration degrades under temporal drift for all methods.
In briefA post-quantum vector commitment scheme supporting efficient insertions and deletions
SummaryVector commitments let users commit to a tuple and later prove facts about its entries. Most existing work assumes the vector length never changes, but this paper studies efficient updates to commitments and proofs when entries are inserted or deleted at arbitrary positions. The authors formalize "multiparty dynamic vector commitments" and a matching security notion, dynamic multiparty binding. They also present a construction that they show satisfies this notion under standard lattice assumptions.
In briefLightweight language model with latent cross-attention for IoT intrusion detection
SummaryThe paper proposes a compact Transformer that compresses inputs into a small latent space before a minimal Transformer core, targeting intrusion detection on resource-constrained IoT devices. It is compared with SecurityBERT on Edge-IIoTset and CICIoT2023 datasets. The model uses far fewer parameters and runs faster on a simulated edge device, with higher macro F1 on Edge-IIoTset and comparable results on CICIoT2023.
Frederic Adjewa, Moez Esseghir, Leila Merghem-Boulahia et al.
In briefGhostFaceMPC: Face Recognition That Protects Privacy Using Secure Multi-Party Computation
SummaryThis paper presents GhostFaceMPC, described as the first end-to-end privacy-preserving face recognition system that runs a deep convolutional neural network for feature extraction and matching under secure multi-party computation. It processes facial data from feature extraction and storage through matching without exposing raw images or biometric embeddings at any stage. The authors introduce an MPC-friendly quantization of the GhostFaceNet model and circuit optimizations to make the approach practical. The code is publicly available.
Davide Carnemolla, Dario Catalano, Mario Di Raimondo
In briefFree-XOR TFHE via Lazy Bootstrapping: an improved gate bootstrapping method for encrypted Boolean logic
SummaryThis paper addresses TFHE-style fully homomorphic encryption, where gate bootstrapping is costly because of blind rotation. The authors propose a framework in which XOR gates are evaluated for free by simply adding two input ciphertexts. Using two blind rotations, it evaluates all eight symmetric binary Boolean gates. The construction is presented as broader in gate support and simpler, both conceptually and in implementation, than the prior free-XOR approach.
In briefJANUS: Agentic generation of cross-language fuzzing harnesses for Android native libraries
SummaryAndroid apps call C/C++ native libraries through JNI, and this cross-language interface can expose the system to attacks. The paper presents JANUS, the first agent-based approach to synthesizing JNI-aware fuzzing harnesses for Android native libraries, resolving cross-language call dependencies and building complex argument objects bottom-up. In an evaluation on 44 real-world apps covering 21,386 JNI methods, JANUS produced 6,094 valid harnesses, over 5.9 times as many as state-of-the-art tools. It also found 6 previously unknown vulnerabilities in pre-installed apps from five mainstream vendors.
WhyFirst agentic JNI-aware harness synthesis; 5.9x more valid harnesses across 44 real apps and six previously unknown vulnerabilities found.
In briefSotto Maschera: masked, side-channel-resistant sampling of sparse fixed-weight vectors
SummaryThis paper turns the Sota-Voce sparse fixed-weight vector sampler into a version that resists power side-channel attacks, targeting embedded devices. It speeds up core steps such as sorting, merging, and compaction through bitslicing and performs masking only in the Boolean domain. TVLA tests show no power leakage, and for HQC the authors report a speedup of up to 45x over previous masked implementations.
Ben Brooksnieder, Dina Hesse, Markus Krausz et al.
In briefAttacking and Defending Instruction-Data Selectors via Utility-Hijacking
SummaryThe paper studies the security of selectors that choose instruction-tuning data for fine-tuning language models. It introduces utility-hijacking, an adaptive supplier-side attack that crafts harmful records to score well with the selector while keeping their malicious payload, so top-k selection concentrates the poison. The authors also propose CONCERT, a defense that flags over-selected suppliers and re-selects using two dissimilar selectors, reducing poison concentration and downstream harm.
WhyFirst systematic study of adaptive supplier-side attacks on instruction-data selectors, with utility-hijacking evaluated across selectors, payloads, and victim models plus a defense.
In briefCompaction Laundering: How Coding Agents Can Lose Track of Who Said What
SummaryCoding agents compress their long conversations into summaries to keep working. This paper finds that some popular open-source agents flatten typed messages into plain text, erasing which message came from the user. An attacker can forge a user instruction that survives this compression as if it were genuine. The authors show this can lead agents to run attacker-chosen commands, and they propose a code-level provenance check to detect it.
WhyIdentifies a new attack surface where flattening role labels during context compaction destroys provenance, validated by end-to-end execution experiments across several real coding agents.
In briefLinear self-symmetries of inverse-based S-boxes and their generic rigidity
SummaryThis paper studies how often nontrivial linear self-symmetries of inverse-based S-boxes survive when the outer invertible linear transformation varies over GL_n(F_2). Using the classification of two-sided linear equivalences of inversion, the authors reduce the problem to semilinear conjugacy and centralizer estimates and obtain matching upper and lower bounds. The decay rate is governed by the smallest prime divisor of the extension degree. The work also gives a practical rigidity criterion and proves that the full AES S-box has no nontrivial linear self-symmetry.
WhyReduces inversion's linear self-symmetry to semilinear conjugacy, gives matching bounds determining the exponent, and proves the full AES S-box lacks nontrivial self-symmetry.
