In briefBuilding standardized security metrics to automatically check compliance with security rules
SummaryAutomated compliance checking requires turning written security requirements into measurable technical properties. This paper proposes a data model for security metrics, built on a systematic breakdown of compliance requirements, along with a method for eliciting them. The method uses an ontology so that metrics are developed at a comparable level of abstraction. The authors also present initial work on an open-source effort showing that the approach supports collaborative metric development.
Immanuel Kunz, Nico Haas, Angelika Schneider et al.
In briefIdentity Amortization: How Shared Resources Lower the Cost of Sybil Attacks
SummaryMany Sybil defenses raise attack costs by requiring one resource per identity. This paper shows that when one resource can support several identities, an attacker pays less per identity than the defense assumes, a effect it calls identity amortization. It gives exact tests for when amortization occurs, where it begins, and its largest error. On published phone-verification prices, per-account estimates overstate provisioning cost by 1.6 to 4.3 times.
In briefA method that gradually learns a control system's behavior to carry out covert attacks
SummaryThe paper proposes a three-phase, data-driven framework for covert misappropriation attacks on closed-loop networked control systems. An attacker with only intercepted input-output data incrementally identifies the plant's behavioral subspace while staying under an infinity-norm intrusion-detection system. The authors show the identified subspaces are nested and projection error decreases monotonically, and simulations on a DC motor with PI control demonstrate full-rank identification and stealthy tracking.
Victor Mattos, Amit Bhaya, Daniel Sadoc Menasche et al.
In briefAquaSense-ICS: A Leakage-Aware Dataset for Water Quality Monitoring and Cyberattack Detection
SummaryThis paper presents AquaSense-ICS, an open dataset and benchmark for water cyber-physical systems that combines real sensor recordings from a Raspberry Pi edge node with EPANET-MSX simulations of a 13-node network. It includes labeled cyberattacks, sensor faults, and augmented or TimeGAN-generated sequences. The authors show that random row splits and labels derived from input features produce near-perfect but uninformative scores, and propose a leakage-aware protocol using chronological splits and held-out attack types. Under this protocol, the best detectors reach a mean AUROC of 0.64 on unseen attack types.
In briefDescent-PBS: programmable bootstrapping beyond the ring dimension, a faster way to refresh encrypted data while applying a lookup table.
SummaryThe paper proposes Descent-PBS, a programmable bootstrapping method for FHEW/TFHE homomorphic encryption that refreshes a ciphertext while evaluating a lookup table. It reduces the cost tied to module rank through a public functional key switch and shared keys for block one-hot secrets. In a TFHE-rs-based implementation, the authors report evaluating a 16-bit negacyclic table in 196 ms on one thread at 128-bit security, with speedups over Meta-PBS and WoP-PBS.
In briefPrivacy-preserving federated loss exploration for vehicle camera image classification with non-uniform data
SummaryThis paper studies privacy risks in federated learning of vehicle camera image classifiers. The authors show that gradient-guided federated methods share extra information that a malicious server can use to infer clients' label sets, with 50% to 84% accuracy in their experiment. They propose PPFLex, which replaces the central server with three secure multi-party computation servers. On traffic-sign datasets, PPFLex reaches accuracy comparable to plain-text FedLEx while preventing this leakage, with acceptable MPC overhead.
Nergiz Yuca, Christian Intern\`o, Nikolay Matyunin et al.
In briefFaster, smaller anonymous credentials built on standard signatures (GordieHowe system)
SummaryThe paper presents GordieHowe, a system with a language, a certifying compiler, and a zero-knowledge proof protocol for building anonymous credentials on standardized signatures such as ECDSA, RSA, and ML-DSA. It is described as the first system to combine provable security against quantum attackers, efficient proving and verifying for statements spanning multiple fields, and automatic batching of structured computations. The authors report that proving an ECDSA-signed mobile driving license presentation takes 64.8 ms on four cores with a 276 KiB proof, which they state is faster and smaller than Google's Longfellow.
WhyIntroduces series-parallel IOPs with QROM BCS extension and simulation extractability, backed by benchmarks beating Longfellow in speed and proof size.
In briefTesting whether LLMs resist prompt injections that subtly alter correct-looking answers
SummaryThe paper argues that existing prompt injection benchmarks miss attacks that keep a legitimate-looking answer but make it incorrect or harmful. It introduces NTBench, which generates such near-target injections from legitimate tasks in existing datasets and evaluates seven LLMs on ten language datasets and two agent benchmarks. Under a common budget of three attempts per sample, near-target attacks achieve higher success rates than fixed-target baselines for every evaluated model.
In briefTighter post-quantum multi-key security bound for FX construction
SummaryThis paper studies the FX construction, a simple key-length extension scheme for block ciphers, in the quantum ideal cipher model. It improves a prior bound from Shiba and Iwata to approximately 2^((n+κ)/3) total oracle queries against fully adaptive adversaries, for all μ≥1 and 1≤κ≤2n. The authors note that a known offline Simon's algorithm attack matches this exponent, so the query complexity exponent needed to break FX does not depend on the number of keyed instances in this regime.
WhyImproves the quantum multi-key security bound of FX to match the known Simon-based attack exponent, with rigorous proofs, affecting a subfield.
In briefLearning with quantization and worst-case lattice hardness
SummaryMotivated by the MAMBA proposals, this paper studies the worst-case hardness of learning with quantization under public dither. Using the randomized polar lattice quantizer of Lyu et al., it constructs explicit families with polynomial power-of-two moduli. A search-version reduction yields quantum polynomial-time algorithms for GapSVP and SIVP, with approximation factors O(n log n) and O(n(log n)^2). The paper also extends the analysis to LWE with interval uniform errors, identifying obstacles but not establishing a complete worst-case reduction or hardness at the concrete MAMBA parameters.
WhyUses randomized polar lattice quantizers to give quantum polynomial-time reductions to GapSVP and SIVP, though MAMBA parameters remain unresolved.
In brief"For Thirty Pieces of Silver": a federated learning defense that audits client data samples with zero-knowledge proofs and forces attackers to counter their own backdoors.
SummaryThis paper proposes a new defense for federated learning against data poisoning and backdoor attacks, moving away from gradient-based detection. It uses zero-knowledge proofs to inspect clients' local data at the sample level, and a staking mechanism forces attackers to train on discovered malicious samples with flipped labels to neutralize them. Under the highly non-IID Dir(0.1) setting on CIFAR-10, the authors report that the scheme defends against distributed backdoor and edge-case attacks and suppresses attack success rates to a low level.
In briefCrypto-agile mixed-radix NTT accelerator for multiple post-quantum ring structures
SummaryThis paper presents a hardware accelerator that performs number-theoretic transforms over both negacyclic and trinomial rings on one datapath, supporting several post-quantum cryptography standards. It combines a unified butterfly unit, a conflict-free memory mapping, and a DSP-free modular constant division. Implemented on an Artix-7 FPGA at 141.5 MHz with 5,279 LUTs, 4 DSPs and 9 BRAMs, it supports ML-KEM, ML-DSA, HAETAE, SMAUG-T and NTRU+. For NTRU+, the authors report a 4.1 to 13.0 times improvement in area-time product over radix-2-only cores.
In briefComparing Methods for Fitting Large Post-Quantum KEMs into IKEv2
SummaryPost-quantum key encapsulation mechanisms have public keys much larger than IKEv2 was designed for, and IKEv2's initial exchange cannot be fragmented. The authors implemented eight proposed adjustments, including three of their own, on the same open-source codebase and tested them across varied bandwidths, latencies, and packet loss rates. They report that no mechanism fully offsets the impact of key size, with the QUIKE composite key exchange performing best overall.
Daniel Herzinger, Marco Thomas, Tobias Handirk et al.
In briefDeepAVR: Multi-Agent Deep Analysis for Automated Vulnerability Repair
SummaryThis paper proposes DeepAVR, a multi-agent framework for end-to-end automated vulnerability repair that splits the process into roles such as fault localization, patch generation, and validation. It uses patch-conditioned re-localization to treat intermediate repair results as clues for hidden root causes. On the VulnLoc dataset, the authors report correct patches for 92.3% of vulnerabilities, and results on SAN2VULN indicate generalization to vulnerabilities not seen in training.
In briefData-efficient backdoor attacks on code models via counterfactual sample selection
SummaryThis paper proposes TNCS, a method for choosing which training samples to poison so that a backdoor can be implanted in code models with few poisoned examples. It isolates a trigger's effect by comparing model outputs on triggered inputs and trigger-neutralized counterfactuals, applying to both classification and generation. According to the paper, TNCS achieves higher attack success than baselines at very low poisoning ratios across three CodeXGLUE tasks and five trigger families, without degrading clean-task performance.
Yu-Yu Lee, Ming-Feng Tsai, Tomohiro Morikawa et al.
In briefAutomatically finding multi-step attack chains after system compromise using a hybrid planning and tree-search method
SummaryThis paper presents APEX, a system that automatically explores post-exploitation attack chains, in which attackers combine benign operations, misconfigurations, and vulnerability exploits to reach goals such as privilege escalation. It frames chain discovery as a planning problem and solves it with a phase-guided hybrid of symbolic planning and Monte Carlo Tree Search, which generates multiple diverse chains. According to the paper, evaluations on a benchmark of 5 virtual machines, 30 synthetic problems, and 291 cloud instances found both known and previously unreported attack chains, including 9 novel privilege escalation vectors.
In briefAutonomous Cyber Weapons as AI-Enabled Digital Harms: A Platform Accountability Framework
SummaryThis paper notes that current rules such as the EU DSA, AI Act and UK Online Safety Act mainly govern AI-generated online harms on commercial platforms, leaving nation-state autonomous cyber weapons aimed at civilian infrastructure largely unregulated. The authors propose a digital-harm taxonomy, a Meaningful Human Control (MHC) model and a platform accountability architecture grounded in state-responsibility doctrine. Applied to eleven documented state-attributed operations, every documented case falls into an accountability vacuum, and the weights and threshold parameters are illustrative rather than fitted.
Mansi Ganga Nayak, Samarjeet Malik, Shaurya Pratap Singh et al.
In briefDemocratic Accountability for Autonomous Systems: A Legislative Notification Framework
SummaryThis paper examines who should oversee a state's decision to authorise autonomous cyber weapons. The authors add a non-legal fourth accountability level to an existing three-level attribution framework, proposing a 72-hour requirement to notify legislatures. Scoring six democratic oversight bodies on five adoptability dimensions, they find that statutes giving these bodies access to classified material often also withhold certain ongoing operations from them, so few could lawfully receive such notifications today. Case studies of Stuxnet, NotPetya, and Volt Typhoon show legal attribution was resolvable while domestic democratic review was absent.
Samarjeet Malik, Mansi Ganga Nayak, Mugdha Raje Ashiya et al.
In briefThe 3DS Oracle: A Paper on BIN Attacks via Pre-Authorization Signals in 3-D Secure
SummaryThis paper examines EMV 3-D Secure (3DS) as a protocol, integration surface, and governance issue, using standards analysis, architectural reconstruction, formal modeling, and a bounded live test. It finds that some client-visible 3DS responses can reveal routing and authentication state before financial authorization, which can be used to profile card and account status. The authors argue that the exposure persists because of systemic issues such as decoupled pre-authorization authentication and weak requestor-boundary assumptions, so remediation requires consortium-level reform.
Wasif Faisal (1), Suprava Saha Dibya (1) ((1) BRAC University)
In briefComparing Classical and Quantum Machine Learning for Intrusion Detection on Multiple Datasets
SummaryThis paper benchmarks classical and quantum machine learning models for intrusion detection on three datasets: NSL-KDD, UNSW-NB15, and MQTTEEB-D2025. It applies a unified preprocessing pipeline and compares Random Forest importance with a quantum-aware feature selection method combining Quantum Kernel Alignment and Mutual Information. Classical models perform consistently across datasets, while quantum models depend more on feature representation, and quantum-aware selection improves them, especially on cleaner data. Pegasos Quantum SVM is reported to offer a good balance between accuracy and computational cost.
In briefHow safety behavior varies by depth inside vision-language models, and how to steer refusals
SummaryThis paper presents a lightweight inference-time method for locating and manipulating safety-related internal representations in frozen vision-language models, without retraining or changing parameters. On Qwen3-VL-4B, the safety geometry differs across layers: early vision layers allow strong bidirectional refusal control through activation steering along a learned safety direction, while deeper layers are well separated along that direction but largely unresponsive to steering. The authors argue this reveals a white-box, representation-level refusal-bypass attack surface in vision encoders.<br>
Muhammad Zeeshan Karamat, Syed Talal Hassan, Christiana Chamon Garcia
In briefCurvature-aware clipping that reduces bias in private deep learning training
SummaryThis paper addresses the bias that gradient clipping introduces when training deep networks with DPSGD, a differentially private training method. It proposes CA-DPSGD, which uses approximate second-order information to build a curvature-aware clipping space. The method also pairs a rectified curvature estimator with anisotropic noise to preserve privacy. The authors report that it outperforms state-of-the-art clipping methods in extensive experiments.
Xincheng Xu, Thilina Ranbaduge, Thierry Rakotoarivelo et al.
In briefFinding unsafe combinations of individually safe agent skills by analyzing capability flows
SummaryThe paper shows that multiple individually benign third-party skills, when chained by an AI agent at runtime so that one skill's output feeds another's input, can form safety-violating chains that single-skill malicious detectors miss. The authors present KnotScryer, which abstracts skills into capability summaries, builds a cross-skill capability-flow graph, and uses search and two-layer verification to find insecure compositions. Applied to 13,598 clean skills from ClawHub, it identifies 612 insecure compositions.
WhyProposes capability-flow graph detection of compositional skill risks; large-scale evaluation on 13,598 skills with markedly higher exploitation rates shows strong evidence and impact.
In briefHidden backdoor attacks that disrupt deep contrastive image clustering
SummaryThis paper studies the security of deep contrastive clustering, a common method for unsupervised image clustering, against training-time poisoning. The authors propose HBDCC, which poisons only a small share of unlabeled training images so that a trigger causes distorted cluster assignments only when it appears at inference time. Clean inputs are clustered normally, and experiments on ImageNet-10, ImageNet-Dogs, and STL-10 show the attack degrades triggered performance while passing standard evaluations. The paper also examines poisoning ratio, trigger type and size, and a knowledge-distillation mitigation.
In briefAgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents
SummaryThis paper proposes AgentTrace, a method for identifying the foundation model behind a black-box LLM agent using observable execution traces. It injects structurally ambiguous probes that trigger tokenization-sensitive serialization failures at tool interfaces, then models the sequence of repair steps with lightweight Markov chains. The authors report 96.0% attribution accuracy under adversarial identity spoofing and distinguish intra-family variants that share the same tokenizer.
In briefProof That Ten-Round AES Is Nearly Pairwise Independent
SummaryThe paper proves that ten rounds of AES with independent, uniformly random round keys are within a very small statistical distance of pairwise independence, bounded by 3017/2^141, which is below 2^-129. For any two distinct plaintexts, the joint ciphertext distribution is therefore nearly uniform over pairs of distinct ciphertexts. The analysis keeps AES's round transformations, including the omitted MixColumns in the final round and input/output whitening.
WhyGives a rigorous bound on pairwise-independence deviation for ten-round AES, improving prior theory via exact finite recurrence evaluation.
In briefInferring Protected Attributes from Split Multimodal LLM Features under Label Budgets
SummaryThis paper studies whether an honest-but-curious server in edge-cloud split inference can infer age, gender, and race from intermediate features sent by a device. The authors propose a label-budgeted recovery curve that measures how much unprotected leakage a server recovers as its labeled sample count grows. Results show that unprotected intermediate features leak all three attributes at any split depth, and that even with protections deployed, much of the information remains recoverable with limited labels.
In briefQuantum public-key encryption with classical keys without one-way functions
SummaryThis paper studies whether quantum public-key encryption with classical keys and ciphertexts requires quantum-computable one-way functions. The authors show a black-box separation: relative to a unitary, real, self-inverse oracle, such an encryption scheme exists while quantum one-way functions do not. They also construct it from quantum indistinguishability obfuscation for quantum circuits and efficiently verifiable one-way puzzles.
WhyProves a black-box separation between qOWFs and classical-key qPKE, plus a construction from quantum indistinguishability obfuscation, a significant theoretical advance.
In briefSPA: a structure-preserving way to approximate gated activations under encrypted computation
SummaryThis paper addresses the high cost of computing nonlinear activation functions in neural inference under fully homomorphic encryption (FHE). It observes that GELU, SiLU and similar activations share the form A(x)=xg(x) with g(-x)=1-g(x), and proposes SPA, which keeps the exact odd component x/2 and approximates only the even residual as a polynomial in x². Plaintext experiments on Gemma-4-E2B and Llama-3.2-3B report that downstream performance is largely preserved, and CKKS benchmarks on fixed intervals show favorable error-latency trade-offs.
In briefConcept Acupuncturist: precise concept erasure from diffusion image models using sparse autoencoders
SummaryThis paper proposes ConceptACP, a machine unlearning method that removes specific harmful or policy-violating concepts from diffusion image generators while preserving general capabilities. It maps semantic concepts to cross-attention blocks in the U-Net and fine-tunes only the most concept-relevant block, using Sparse Autoencoder features to build correction signals that address concept entanglement. On SDXL-Turbo in the one-step generation setting, the authors report an average forgetting success rate 36.34 percentage points above the best baseline, with image quality and prompt fidelity preserved.
In briefSynMark: Multi-bit watermarking for LLM code using semantic coordinates
SummaryThis paper proposes SynMark, a method that embeds multi-bit watermarks during LLM code generation. It replaces surface-token-based routing with learned semantic coordinates and uses reliability-weighted aggregation during extraction to reduce errors after code transformations. Under 100% identifier renaming, it retains 82.27% and 83.77% BitAcc on CodeLlama and DeepSeek-Coder, respectively.
In briefTRACE: Data-free attacks that reconstruct unlearned LLM training text
SummaryThis paper shows that approximate unlearning in large language models can leave traces in the pre- and post-unlearning model snapshots, which attackers may use to recover deleted training data. The authors propose TRACE, which needs no prior knowledge of the data: it narrows candidate tokens using embedding-level parameter differences and assembles sequences by scoring the perplexity gap between the two models. Experiments on TOFU, MUSE, and WMDP across several LLMs and six unlearning methods show high-fidelity reconstruction, exposing privacy risks in current deployments.
WhyIdentifies a parameter-difference side channel left by approximate unlearning and reconstructs data without priors, validated across multiple datasets, LLMs, and six unlearning methods.
In briefWADE: An LSTM-based engine that flags abnormal runtime behavior in WebAssembly apps
SummaryWebAssembly applications have limited built-in runtime protections, leaving them open to traditional attacks. The paper presents WADE, which learns each application's normal function-level execution behavior from benign runs using an LSTM network and flags deviations at runtime. Evaluated on 67 applications across ten vulnerability classes, it reports zero false negatives and a 0.42% false positive rate.
In briefDefending Agentic AI: Decode-Time Provenance Binding for MCP
SummaryThis paper studies indirect prompt injection in agentic AI systems built on the Model Context Protocol (MCP), showing how instructions hidden in an email-signature image can bypass text scanners and enter a multi-agent workflow after a tool decodes them. The authors propose decode-time provenance binding, which combines HMAC-authenticated trust labels, a provenance ledger, and context-taint tracking to block critical tool calls influenced by untrusted content. In their testbed, the mechanism reduced attack success to 0%, while keyword and regex defenses each permitted 62.5% of attacks.
Eric Yocam, Varghese Vaidyan, Paris Kalathas et al.
In briefExploiting Gaps in Humanoid Robot Safety Filters
SummaryThe paper argues that safety filters for humanoid robots only guarantee collision avoidance when safety parameters are set correctly, and no general method exists to set them across tasks and environments. The authors introduce goal insertion attacks, which normal users can trigger without extra privileges. They built SIREN, a tool that finds vulnerable goals, and it found attacks in all vulnerable SPARK dataset scenarios and caused a real humanoid to collide.
WhyShows safety filter misconfiguration in humanoid robots can be exploited via normal user inputs, proposing SIREN which finds three times more attacks than baseline and is validated on a real robot.
In briefOn s-projected Goppa codes and their use in interactive oracle proofs of proximity
SummaryThis paper examines how error-correcting codes can be used in cryptographic proof systems. Goppa codes have remained secure in the McEliece encryption scheme for over 40 years, prompting the question of whether they can also support proof constructions. The authors propose a new way to obtain an interactive oracle proof system of proximity (IOPP) from Goppa codes.
In briefIncomparable minimal grants in agent tool authorization
SummaryThe paper examines how to decide which of two authorization grants is smaller when an AI agent needs a tool, and shows that for many tasks no single minimal sufficient grant exists. Analyzing Microsoft Graph and Google API authorization tables, it finds this incomparability in 29.8–33.3% of Graph tasks and 3.2% of Google tasks, and that different risk measures rank some pairs in opposite directions. Testing six frontier models, it reports they usually pick a minimal grant but often not one that is smallest on every measure, and it proposes reporting the chosen grant in benchmarks and showing alternatives to approvers.
WhyShows minimal tool grants often form antichains with no unique smallest answer, validated at scale on Microsoft and Google authorization tables; novel and well-evidenced, with impact mainly in authori
In briefMímir: A Stateless Private Search Engine for Dynamic Databases
SummaryThis paper presents Mímir, a cryptographic protocol for private semantic search that lets users retrieve documents similar to a text query from a public database. Its security relies on (Ring) Learning with Errors, and it needs no offline communication, trading more parallelizable server computation for low per-query communication. The authors compare it with Tiptoe and PACMANN, reporting differences in search quality, per-query communication, and latency.
In briefSEMPRE: Automatically reverse-engineering undocumented network protocol formats using LLM reasoning
SummaryThis paper presents SEMPRE, an automated framework for reverse engineering undocumented or proprietary communication protocols. It combines fine-grained dynamic program analysis with recursive LLM-driven search to split messages into fields, detect nested sub-protocols, and infer field types and roles. An iterative, EM-style refinement procedure improves boundaries and semantics until convergence. The authors report outperforming six state-of-the-art baselines on mainstream protocols and demonstrate practical utility in a case study on a real-world botnet.
In briefBalsamic: One-Round Threshold UOV Signatures Using GPU-Accelerated Fully Homomorphic Encryption
SummaryThe paper presents Balsamic, a complete homomorphic Unbalanced Oil and Vinegar (UOV) signer that runs under fully homomorphic encryption, and applies it to one-round threshold UOV signatures. It introduces a paired-pivot solver and pivot-success certificates to handle the encrypted linear solving and retry selection efficiently. In 2-out-of-3 semihonest threshold signing, each partial signature takes 10.7 seconds on an NVIDIA RTX 6000 Ada and 7.77 seconds on an NVIDIA GB300, with 5.25 MB per response.
Jaehyung Kim, Charles Gouert, Jean-Luc Watson et al.
In briefUlysses: A Security Harness for Synthesizing Verifiable Web Exploits
SummaryThis paper presents Ulysses, a multi-agent security harness that synthesizes verifiable vulnerability exploits for web applications. It turns candidate vulnerability findings into verified Proofs of Exploitability by iteratively testing exploit hypotheses and confirming success through independently observed execution effects. Evaluated on WebExploitGym, a benchmark of 25 real-world web applications, Ulysses produced verified proofs for 10 of 25 real-world advisories and discovered 4 new proofs of exploitability never previously reported.
Aditya Oke, Andr\'e Vicente Duarte, Rui Melo et al.
In briefToolContractGate: Versioned trusted contracts that stop agent tool calls from drifting away from approved API specs
SummaryThe paper presents ToolContractGate, a deterministic runtime evaluator that checks agent tool calls against versioned contracts derived from OpenAPI specifications, binding each request to a stored fingerprint and access, schema, and behavioral declarations. On a synthetic benchmark of 45 cases, the full pipeline detected all 35 unsafe cases and produced no false blocks on the 10 safe cases. The archived run reports a mean gate latency of 0.18 ms. The results characterize contract-decision coverage, and enforcement depends on the host honoring the returned decision.
In briefProving PPAD is hard using the SIS lattice problem
SummaryThis paper shows that the complexity class PPAD is hard on average, using the Short Integer Solution (SIS) lattice problem rather than the LWE problem used in prior work. It gives two conditions: polynomially hard SIS with a quasi-polynomial norm bound plus a fine-grained average-case assumption, or subexponentially hard SIS alone. The main technical contribution is a succinct, incrementally updatable proof system for exponentially large circuits with short descriptions, which keeps the unambiguity guarantee of the underlying scheme.
WhyGrounds PPAD hardness on SIS instead of LWE and builds an incrementally updatable succinct proof system, a substantial theoretical advance with strong rigor.
In briefA probabilistic extension of the division property for integral attacks on block ciphers
SummaryThis paper addresses integral cryptanalysis of block ciphers, noting that existing division-property methods only rule out zero-sum properties holding with probability one and say nothing about their actual probability. The authors combine MILP-based trail search with a recursive evaluation of constant-input assignments to estimate the probability that no valid trail remains, and use a heuristic to predict the zero-sum probability. Applied to PRESENT, GIFT and ASCON, the tool yields probabilistic integral distinguishers covering 4 to 9 rounds, and the authors show these can reduce data and time complexity for key recovery on PRESENT and GIFT-64 compared with deterministic variants.
Jules Baudrin, Christina Boura, Patrick Derbez et al.
In briefA classical client uses an untrusted quantum server as a virtual quantum computer
SummaryThe paper shows that a classical client with no quantum hardware can use an untrusted, possibly malicious quantum server as if it were its own trusted quantum computer. The client can privately run quantum computations, prepare and process quantum states, and keep hidden quantum memory on the server across rounds. The construction rests on a maliciously secure two-party protocol assuming only post-quantum hardness of learning with errors. The authors use it to resolve two open problems: classical verification of quantum sampling and remote state preparation.
WhyClassical client gains virtual quantum computing via untrusted server, resolving two open problems using a maliciously secure LWE-based protocol construction.
In briefOP-Print: Tracing Membership Leaks in On-Policy Self-Distillation
SummaryThis paper studies whether on-policy self-distillation, where a student model supervises itself using its own outputs plus extra context, leaks whether a training example was used. The authors present the first membership inference attacks against this method and propose OP-Print, a unified framework for gray-box and black-box access. Across diverse models and distillation schemes, baseline attacks stay near random guessing even in the gray-box setting, while OP-Print is validated as effective in both settings.
In briefEfficient, optimal learning of discrete distributions under person-level privacy
SummaryThis paper studies estimating a discrete distribution when each of n users contributes several samples, under person-level differential privacy. The goal is an estimate with total-variation error α. The authors give polynomial-time algorithms under both pure and approximate privacy, with the pure-privacy guarantee matching the information-theoretic optimum up to logarithmic factors. Their method uses a new degree-6 sum-of-squares estimator for untrusted batches, analyzed via semidefinite-programming duality and Grothendieck's inequality.
WhyGives polynomial-time pure and approximate DP learners matching information-theoretic optimal sample complexity up to logs, via a new SoS estimator and Grothendieck-based analysis, with a matching SQ
In briefSocial-HUMINT: An LLM framework for measuring how exposed people are on social media
SummaryThe paper merges social media intelligence and cyber human intelligence into one 38-capability taxonomy, validated by domain experts (Fleiss' κ = 0.92). It implements the core profiling path as an LLM-based multi-agent pipeline tested on real participants' public data. The pipeline reaches 97.3% F1 for extraction and scores 4.73/5 for inferred attributes, outperforming rule-based and NER baselines. The authors aim to help defenders assess their own exposure to social engineering.
In briefInteger coordinate families and threshold RSA signatures for any prime exponent
SummaryThe paper shows that integer coordinate families for threshold RSA signatures always exist and gives an efficient construction method for small parameters. It shows the Ng-Lau threshold signature scheme allows trivial forgeries and has a flawed proof. The authors propose a repaired scheme, PiIC, and an integer secret-sharing scheme, PiZ, for any prime exponent, proving both are TS-UF-CMA secure under the standard RSA assumption.
In briefHigh-precision bootstrapping for the GCKKS homomorphic encryption scheme
SummaryThis paper constructs a high-precision bootstrapping algorithm for GCKKS, a variant of CKKS that trades slot count for lower modulus consumption, using low-precision overflow extraction followed by iterative precision enhancement. It introduces a ciphertext-conversion framework that changes the decryption factor and slot count, and combines precision doubling with ciphertext splitting so two error-cleaned outputs need only one evaluation of the cleaning polynomial. For target precision p and 2N/k useful slots, the precision-dependent stages use O(k) homomorphic operations and consume O((p/k) log k) modulus bits.
In briefLinear Cryptanalysis of the TFHE-Friendly Cipher FRAST in the Average Key Setting
SummaryThis paper revisits a linear attack by Bak et al. on the TFHE-friendly stream cipher FRAST, whose flaw of letting wrong guesses pass was left open by its authors. The authors compute the trail correlation exactly and bound the success and false-alarm rates of their statistic. With known XOF inputs, their algorithm Contract recovers round-branch classes for 15 rounds and the master key for 10 rounds. A cost model extends the results to 26 and 38 rounds. The authors note that independent branch S-boxes remove the cheap classes, at a cost in TFHE.
WhyExact trail correlations and proved false-alarm bounds resolve an open problem, extending linear attacks on FRAST to full-cipher advantage on weak keys.
In briefHomomorphic encryption that packs several message symbols into fewer ciphertext vectors
SummaryThis paper extends a homomorphic encryption scheme built on scalar message codes by using coset codes to pack k message symbols into one ciphertext vector of length n. This reduces how many ciphertext vectors are needed to send a message record. A compatible family of evaluation codes supports public addition and multiplication up to a set degree. The authors prove bounded chosen-plaintext security under a coordinate-label distinguishability assumption.
In briefAgentPhishing: Benchmark Testing Email AI Agents Against Adaptive Phishing
SummaryThis paper introduces AgentPhishing, a benchmark testing whether persuasive phishing emails can evade detection and get LLM email agents to comply with malicious requests. The authors developed PhishOpt, which optimizes reusable email-generation skills against individual agents, and analyzed the emails using Cialdini's persuasion principles. Agents handled pre-existing phishing emails safely but remained vulnerable to attacks adapted to their behavior, and the study highlights the limits of conventional phishing evaluations for judging agent safety.
