In briefCombining weight extraction with label-based learning to reconstruct neural network parameters
SummaryThis paper studies reconstructing fully connected neural networks by combining cryptanalytic weight-direction extraction with learning from predicted labels, adapting an extraction method from ReLU to Leaky ReLU. On the largest synthetic architecture, Leaky ReLU recovers 51 to 57 neurons in the deepest hidden layer while ReLU recovers none, though this advantage does not hold uniformly across architectures and layers. The authors also note that high prediction agreement does not identify the network's parameters.
Biprarshi Biswas, Arya Anshuman Ojha, Yubaraj Das et al.
In briefCombining extraction and distillation: cryptanalysis-based recovery of neural network parameters
SummaryThe paper studies reconstructing fully connected neural networks by combining cryptanalytic weight-direction extraction with learning from predicted labels. It adapts a ReLU extraction method to Leaky ReLU and proves conditional bounds for direction recovery and sign selection. Experiments on synthetic architectures and two CIFAR-10 victims show high prediction agreement, and the authors argue that such agreement does not identify the network's parameters.
Biprarshi Biswas, Arya Anshuman Ojha, Yubaraj Das et al.
In briefLinear-communication asynchronous Byzantine agreement with almost-everywhere termination
SummaryThis paper studies binary Byzantine agreement in asynchronous networks against adversaries that can strongly adaptively corrupt parties and take back undelivered messages. Such adversaries were previously thought to force Ω(t²) messages. The authors relax termination so that at least a (1−ν) fraction of honest parties terminate, while agreement and validity still hold. The construction combines a recursively shared BLS signing key with certificate dissemination over a sparse graph, with expected total communication O(nκ²) bits, secure in the random oracle model.
WhyCircumvents the quadratic lower bound via relaxed termination, achieving linear communication; strong theoretical analysis but limited empirical validation.
Renas Bacho, Simon Holmgaard Kamp, Julian Loss et al.
In briefProbeID: Checking That an LLM Agent's MCP Tool Is the Real One When Registries Change
SummaryThe paper proposes ProbeID, which sends schema-valid probes to a tool and compares its canonicalized responses against a trusted admission reference, abstaining when results are ambiguous so that impostor tools must copy probe-observable behavior. It is evaluated on cached MCP-IdentityDrift cases, random probes from agent banks, and a prospective held-out study of 38 tools. In an MCP-Bench agent, verification reduced tainted tasks from 15 to 9 of 16 without changing task success. The authors conclude that verification depends on reference integrity, probe coverage, and response noise.
In briefExact Bit Security of Hash-Based Signatures
SummaryThis paper analyzes the security of hash-based signatures in Lean4, showing how different ways of counting an adversary's work produce different bit-security figures. Using two XMSS instances with 128-bit digests as examples, it finds about 127 bits of strong unforgeability under most counting modes, but only 122 bits under the most conservative mode that counts direct random oracle queries. The bounds are proven in the random oracle model without computational hardness assumptions, with matching attacks provided.
In briefWho Verifies the Verifiers? Accountable Consensus for AI-Based Web Fact Checking
SummaryThis paper argues that majority voting among several language models judging whether web evidence supports a claim has fundamental limits, even when their errors are assumed independent. It proposes Astral, which fixes all assessors to one committed web evidence snapshot and accepts a verdict only when a supermajority attests above a confidence threshold with no valid signed challenge. On five public benchmarks with adversarial assessors, Astral lowers attack success compared with majority voting, but many claims receive no binary verdict and are sent for audit.
In briefA faster way to split polynomials over finite fields by batching modular composition
SummaryThe paper addresses factoring a degree-n polynomial over a finite field F_q and presents a new algorithm for the modular compositions that form the bottleneck of the best known method. Because all compositions at one level share one argument, the relation matrices and remainder table are computed once, and the rest is rectangular matrix multiplication. In the algebraic model this lowers the operation exponent from 1.80535 to 1.5532 (to 3/2 if ω=2).
WhyBatched modular composition with random basis change lowers the algebraic factorization exponent from 1.80535 to 1.5532, with proofs covering all inputs.
In briefRevisiting provable security of SHA-256-based LMS in the ideal-cipher model
SummaryThe hash-based LMS signature scheme is standardized by IETF, NIST and ISO. The paper argues that earlier proofs ignored the real structure of SHA-256, a chopped Merkle-Damgård construction, and shows forgery attacks that make those random-oracle bounds inapplicable to the concrete schemes. The authors give security proofs in the ideal-cipher model for additive Davies-Meyer abstractions of LMS_SHA256_M32 and LMS_SHA256_M24. They conclude that both schemes offer a moderate, though not full, level of security.
WhyRe-proves SHA-256-based LMS security in the ideal-cipher model and exhibits forgeries showing prior random-oracle bounds fail, with significant implications for standardized schemes.
In briefSecurity evaluation of 6G-oriented and O-RAN networks through targeted attacks
SummaryThis paper examines a targeted attack chain against a virtualized, 6G-oriented O-RAN testbed. The F1 midhaul interface is reachable by an attacker, and transport-layer protection is not enabled. The attack disrupts the legitimate O-DU association, introduces a rogue O-DU using observed configuration parameters, and intercepts user-plane traffic. Evaluation was performed on a fully virtualized testbed built with Open5GS, srsRAN Project, FlexRIC, and an EV charging infrastructure based on OCPP 1.6.
Apostolos Valiakos, Dimitrios Psaltis, Alexios Lekidis et al.
In briefPacifo: A Fast Encrypted-Data ResNet Framework for Trustworthy Cloud AI
SummaryThis paper presents Pacifo, a framework that adapts fine-tuning to run a ResNet20 model under Fully Homomorphic Encryption, so servers can make predictions without seeing raw client data. It uses a public-private layer partitioning scheme and an efficient ReLU approximation to reduce costly encrypted operations, and offers configurable security settings. Compared with prior FHE implementations of ResNet20, it reports runtime speedups of 3.7 to 21.7 times while retaining most of the original plaintext accuracy across downstream tasks.
In briefCan AI code reviewers catch security bugs before code is merged?
SummaryThis paper introduces SecPRBench, a benchmark for testing AI agents on security code review using real bug-introducing commits rather than later fixes. The authors collected 265 validated tasks from nine major systems such as Firefox, V8, and OpenSSL. Across eight frontier models, recall ranged from 32.5% to 78.1%, and in 68% of misses the agent flagged the flawed file but gave a different mechanism.
In briefDetecting malicious agent skills that mix instructions and code via program analysis
SummaryThe paper presents SCS, a static analysis framework for third-party skills used by LLM agents, which combine natural-language instructions with executable code. SCS compiles instructions into an intermediate representation and builds a cross-domain graph, then propagates security properties with a Trust-Sensitivity-Capability model to detect risks. On a benchmark of 117 malicious and 117 benign skills, it reports the highest average accuracy (85.6%), recall (95.2%), and F1-score (86.9%) among evaluated methods. Analyzing 66,157 real ClawHub skills, it produced 2,473 candidates, of which 627 were confirmed malicious after auxiliary dynamic validation and manual review.
WhyUnifies natural-language instructions and code into a cross-domain dependency graph, a novel approach. Evaluated on a 117/117 benchmark and large real-world data, with moderate evidence scale.
In briefUpper bounds on how well polynomials approximate discrete logarithms
SummaryThis paper revisits a classical result by Coppersmith and Shparlinski on how well low-degree polynomials over a prime field can match the discrete logarithm function. The authors improve the known bound to roughly the square root of Dp, matching the Johnson bound from list-decoding, and give nontrivial bounds even when the degree exceeds p/2. For degree one, they obtain an improved bound of order p to the power 2/5 using the sum-product phenomenon from additive combinatorics.
WhyImproves a classical Coppersmith-Shparlinski bound to the Johnson bound and gives an O(p^{2/5}) result for linear polynomials via sum-product, with rigorous proofs.
In briefGenerating Code That Is Both Secure and Functional Through Self-Evaluation
SummaryThis paper presents SecGent, an inference-time framework that retrieves weakness context from the Common Weakness Enumeration (CWE) database to guide secure code generation, without relying on vulnerable or patched code examples. Functional and security tests are run on the generated code, and their execution feedback is used to repair implementations so they meet both goals. Evaluated on the CWEval benchmark across five programming languages with four open-source LLMs and Claude Sonnet 5.5, it achieved the highest joint functional-security success against four inference-time baselines.
In briefCombinatorial Lock: A Hardware-Friendly Defense Against Multi-Trigger AI Backdoor Attacks
SummaryThis paper addresses backdoor attacks in which several trigger types, such as patch, blend, warping, and latent-domain watermarks, coexist in one poisoned model. The proposed Combinatorial Lock method is training-free and trigger-agnostic, treating multi-trigger identification as a combinatorial problem over binary activation signatures. Tested on six models, it lowers attack success rate to as low as 0.1% while keeping 97.8% clean accuracy. ASIC and FPGA implementations show it is practical in hardware.
Soumita Chatterjee, Sudip Ghosh, Tamal Ghosh et al.
In briefCovering radius of RM(2,8) lies between 88 and 91
SummaryThis paper studies the covering radius of the second-order Reed–Muller code RM(2,8), which has length 2^8. The values for RM(2,6) and RM(2,7) are known, but the exact value for RM(2,8) is still open. Using a computer-assisted proof, the authors lower the previous upper bound of 96 to 91, and they provide code for verifying the computer search.
In briefA paper showing faster matrix multiplication can speed up lattice sieving
SummaryThe paper studies how the matrix multiplication exponent ω affects the efficiency of lattice sieving. It shows that if ω is at most 9/4 minus any fixed η > 0, then under the spherical heuristic used in the BDGL analysis, heuristic lattice sieving can be improved to (3/2 − δ)^(n/2+o(n)) time, where δ depends on η. With known matrix multiplication algorithms, the authors state the method already gives subquadratic search within BDGL buckets.
WhyLinks a new matrix multiplication bound to an exponential lattice sieving speedup, a substantive cross-area result; proofs rely on heuristic assumptions.
In briefStudy of AI-to-AI synthetic social engineering attacks on Web services
SummaryThis paper studies how one AI agent can use credibility, authority, or obligation cues to mislead another AI recipient into actions its user did not authorize. The authors define synthetic social engineering and present an operational framework, tested in a reproducible testbed called ASE-EC across 1,260 research episodes. Invoking a limited prior agreement raised unauthorized requests from 43.3% to 96.7%, although recipients kept supported decisions and permissions stayed unchanged. The results identify action selection as a distinct security concern.
In briefFrom CAV to COBA: Coordinated Attacks on Grid-Edge Smart Inverters in DER-Rich Power Systems
SummaryThis paper studies how a compromised coordination layer for distributed energy resources (DERs) could be used to attack a power grid through smart inverters. It introduces the Coordinated Optimization-Based Attack (COBA), which uses network information and location-specific active and reactive power setpoints to maximize thermal loading on a chosen transmission corridor. COBA is compared with low-information baselines that can only send one uniform command to the fleet, and tested on the Hawaii Synthetic Grid-37 Buses case. The results indicate that topology, target selection, and command capability determine DER-induced thermal risk, not just overall penetration.
Emad Abukhousa, Anna Raymaker, Animesh Chhotaray et al.
In briefUpper bounds on polynomials approximating discrete logarithms
SummaryThis paper revisits a classical result by Coppersmith and Shparlinski on how well polynomials can approximate the discrete logarithm function. The authors improve the univariate bound from √(2Dp) to (1+o(1))·√(Dp), using the Johnson bound from list-decoding of error-correcting codes. For degree one, they give an improved bound of O(p^{2/5}) based on the sum-product phenomenon from additive combinatorics.
WhyImproves a classical bound to the Johnson-bound form using list-decoding ideas, and gives an O(p^{2/5}) bound for linear polynomials via sum-product.
In briefWhen public elliptic-curve proofs of semiprimality reveal the factors
SummaryThe paper examines public certificates that prove an integer has exactly two prime factors, which could be used to generate cryptographic moduli without revealing the factors. The authors formalize these certificates by adapting the Goldwasser-Kilian primality criterion and show that certificates built with complex multiplication allow factoring in expected polynomial time under stated conditions. Applying their method, they factor Reble's 1084-digit and Broadhurst's 5061-digit moduli, and they argue that several proposed repairs fail under the same hypotheses.
WhyAdapts Goldwasser-Kilian to semiprimality and gives polynomial-time CM factoring attacks that actually break two published moduli.
In briefFrom Hype to ROI: An Economic Model for Adopting LLMs in IT and Security Operations
SummaryThis paper presents a general economic model to help organizations decide whether investing in large language models for operational information systems will create value. Parameters are treated as random variables centered on authoritative benchmarks and evaluated through Monte Carlo simulation across pessimistic to optimistic efficiency assumptions. Applied first to Security Operations Centers, the results show that adoption economics depend on context and accuracy, and that most configurations are unprofitable, with profit limited to high-accuracy, low-uncertainty deployments.
Pellegrino Casoria, Andrea Araldo, Rosario Patan\`e et al.
In briefA deterministic security runtime that supervises LLM agents running parallel jobs on shared supercomputers, even if the control host is compromised
SummaryThe paper presents Enclawed, a security runtime that extends an AI agent sandbox to parallel HPC systems and agent swarms. A launch gate decides job launches by policy, while signed heartbeats and per-rank supervisors pause or kill processes when leases lapse or tampering occurs. The authors report that supervision left a 16-rank LAMMPS job's compute loop unchanged, added about 3 seconds of startup, and that all twelve attacks ended fail-closed. The core and benchmark are stated to be open source.
WhyExtends a single-user agent runtime to distributed HPC jobs with signed heartbeats and hardware-rooted supervision, tested against twelve attacks and 24 injected launches.
In briefSmaller shares for evolving secret sharing with general and threshold-three cases
SummaryThis paper studies how large each share must be in perfectly secure evolving threshold secret sharing, where participants can keep joining without changing earlier shares. For general thresholds, the authors share two secrets with adjacent thresholds using one polynomial and combine this with a prior scheme, reducing the leading coefficient from k-1 to ⌊k/2⌋. For threshold three, they give a separate construction that lowers the lower-order terms of an earlier scheme. Both constructions are correct and perfectly information-theoretically secure.
In briefAligning autonomous cyber defense agents through adaptive policy shaping at test time
SummaryThis paper studies how to align reinforcement learning-based autonomous cyber defense agents with human-specified operational goals without costly retraining. The authors formalize alignment as policy shaping, adjusting a pretrained policy at test time using predicted attributes of agent actions. They also propose an adaptive method that dynamically balances alignment and performance as priorities shift during an attack, evaluated in the CybORG simulator across Confidentiality, Integrity, and Availability objectives.
Dena Mujtaba, Bharadwaj Ravichandran, Brian Hu et al.
In briefHolo-NN: Privacy-Preserving Nearest Neighbor Search Using Compressive Sensing
SummaryThis paper introduces Holo-NN, a framework for privacy-preserving approximate nearest neighbor search over high-dimensional embeddings. It replaces branching tree or graph indexes with a single linear projection by folding the database offline into a compact holographic sensing matrix. At query time, encrypted search reduces to one non-interactive matrix-vector multiplication, avoiding fully homomorphic encryption bootstrapping and multi-round interaction.
In briefA-GE: Privacy-Preserving Age Assurance Using Fine-Grained Motion
SummaryThis paper presents A-GE (Age-Grounded Evidence), a system that derives age-related evidence from subtle motion captured by commodity inertial measurement units. It needs no identity or government ID and works at sampling rates as low as about 60 Hz, with minimum-age thresholds configurable from 14 to 21. Evaluated on more than 600 participants, it was tested with participant-disjoint cohorts and shown to run client-side on Android, iOS, and the web. The authors also examine unintended attribute inference and residual privacy risks.
In briefDeletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN
SummaryThis paper studies BARBICAN, a layered gateway that screens prompt injection for language-model tool use. It finds that an arbitration classifier received tokenizer-corrupted text for an entire evaluation, and that repairing it raised its AUC while slightly lowering system recall. The authors argue that ablation results for routed stages can only be interpreted alongside the class balance of the inputs each stage receives, and that deletion experiments should be paired with substitution experiments.
\.Ipek Abas{\i}kele\c{s} Turgut, Edip G\"um\"u\c{s}
In briefQuantum-Resistant Perfect Zero-Knowledge Proofs for All NP Problems Using Any One-Way Permutation
SummaryThis paper shows for the first time that post-quantum one-way permutations suffice for classical perfect zero-knowledge arguments covering all of NP, with security against quantum adversaries. The authors prove that the NOVY bit commitment scheme, built from any permutation with interactive hashing, is sum-binding and collapse-binding against quantum polynomial-time committers when the permutation is post-quantum one-way. They also show that this collapse-binding property lets Blum's perfect zero-knowledge argument for HAMCYCLE remain secure unchanged against quantum adversaries.
WhyFirst shows post-quantum one-way permutations suffice for perfect zero-knowledge arguments for all NP, with proofs of NOVY commitment's quantum binding properties.
Fr\'ed\'eric Dupuis, R\'emi Ligez, Khaireddine Medhioub et al.
In briefSpoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agents
SummaryThis paper studies how attackers can manipulate tool descriptions to trick LLM agents into using malicious tools. It introduces TSA, a stealthy spoofing attack that iteratively refines malicious descriptions using LLM-based optimization so they are hard to tell apart from benign ones. Experiments on single- and multi-tool benchmarks show TSA outperforms four prior approaches, and a user study found human participants could not distinguish its descriptions from benign ones. The attack also remains effective against five tool-malware detectors.
In briefSTROKE: Simple Occlusion Shapes for Efficient Black-Box Image Attacks
SummaryThis paper presents STROKE, a black-box adversarial attack that uses simple oriented rectangular occlusions to perturb images and queries model scores to refine them. A lightweight greedy add-and-refine procedure optimizes these occlusions. The authors report high attack success with low query counts across diverse image classifiers, and reduced wall-clock attack time in matched comparisons. They conclude that simple structural occlusions form an effective and computationally efficient search space for such attacks.
In briefEVSEFuzz: A Tool for Automatically Testing EV Charging Protocol Implementations
SummaryThis paper presents EVSEFuzz, a tool that automatically builds fuzzers to test the security of protocol implementations used in electric vehicle charging infrastructure. It uses Python datatype validation tools to understand message structures and generate both compliant and non-compliant messages. The tool has been tested on several open and closed-source implementations and found vulnerabilities that led to two published CVEs.
Soham Gumaste, Michael Khan, Roland Varriale et al.
In briefEfficient bootstrapping for CKKS over the conjugate-invariant ring
SummaryThis paper addresses CKKS homomorphic encryption for real-valued data, which normally wastes capacity when stored in complex slots. It presents a real FFT algorithm that enables native bootstrapping of conjugate-invariant CKKS and develops real-valued functional bootstrapping methods. Implemented in Lattigo, the native bootstrapping achieves 1.14 to 12.86 times speedup for single-ciphertext bootstrapping, and the functional methods reach 1.16 to 1.68 times higher throughput than standard CKKS approaches.
In briefTrusting the Tool: How LLM Vulnerability Auditors Lean on Static-Analysis Evidence Unevenly
SummaryThis paper examines whether large language models auditing code for vulnerabilities can tell true from false static-analysis evidence. The authors ran 16,572 audits of PrimeVul functions across six evidence conditions that differed only in notes. False assurances that a check exists lowered detection of real vulnerabilities more than false alarms did, which were disputed more often. The authors suggest pipelines verify a tool's guarantees before the model relies on them.
In briefMutual Correlated Agreement and List-Decoding: Better Bounds and Their Limits
SummaryThis paper studies how mutual correlated agreement (MCA), a property of linear error-correcting codes, relates to list-decodability. It improves the error bound for MCA of polynomial generators and refines the known implication from list-decodability to MCA, while showing the two notions are generally distinct. The authors also build two families of codes showing limits on improving the 1-√(1-p) bound and on strong converse statements.
