In briefFactually Correct but One-Sided: Stance Poisoning in RAG and a Balancing Defense
SummaryThis paper studies a retrieval-augmented generation attack in which injected documents contain correct facts but present a one-sided stance on a controversial topic, shifting the stance of generated answers. At about 18.9% poisoning share, all four generation models from different vendors shifted in the poisoning direction. The authors propose a Stance-Balancing Middleware between retriever and generator, combining stance detection, fixed balancing of supporting, opposing and neutral evidence, and a debiasing prompt, without extra LLM calls.
In briefUsing LLMs to Fix Broken Access Control in Web Apps: A Benchmark Study
SummaryThe paper introduces BAC-Bench, the first benchmark for repairing broken access control vulnerabilities, containing 46 real-world cases from six web applications in four programming languages. It evaluates eight base LLMs and two commercial LLM agents, finding that single-turn models repair 37.68% of vulnerabilities on average. Adding two minimal scaffolds raises the average to 66.03%, and some LLM-generated patches surpass official ones.
In briefNameTrap: Using Variable Names to Lead AI Coding Agents into Writing Vulnerable Code
SummaryThis paper presents NameTrap, an attack that only renames identifiers in third-party Python files to steer AI coding agents toward specific CWE vulnerabilities such as CWE-78, CWE-79, CWE-327, and CWE-502. Tests across six agents and ten underlying models show that the attack succeeds in a substantial share of cases, outperforming random and neutral renaming. The authors also report that several AI-based and static security analyzers did not flag the targeted weaknesses in the poisoned files.
WhyIntroduces identifier-renaming poisoning steering coding agents toward CWEs, evaluated across six agents and ten models against strong baselines.
Chieh-Yuan Chang, Guan-Wei Chen, Chia-Yi Hsu et al.
In briefHNSecW: A Logarithmic-Time MPC Protocol for Approximate Nearest Neighbor Search
SummaryThis paper proposes HNSecW, a secure multi-party computation protocol for approximate nearest neighbor search that achieves O(log N) search time for the first time. It redesigns the HNSW algorithm's control flow and data structures for fully data-independent execution, using offline reshuffling and partial database duplication. The protocol also supports multiple sequential queries and batch queries. Experiments report that it preserves plaintext HNSW accuracy and delivers over 20 times efficiency improvement on million-scale datasets.
WhyFirst MPC approximate nearest neighbor protocol reaching logarithmic search time via redesigned HNSW control flow; experiments on million-scale data show over 20x gains.
In briefRevisiting AES Key Wrap: Forgery Bounds and Recommendations for NIST SP 800-38F Revision
SummaryThis paper expands earlier technical comments to NIST on SP 800-38F, which is being revised and specifies the AES Key Wrap modes KW and KWP. It argues that the forgery probabilities in the standard ignore adaptive attacks, and gives corrected forgery probabilities for KW, KWP and TKW. The authors also show that checking the expected plaintext length can considerably raise KWP's security level, and conclude that KW lacks beyond-birthday-bound security.
WhyShows SP 800-38F forgery bounds ignore adaptive attacks, corrects KW collision conditions, and derives a distinguisher, with direct impact on the standard's revision.
In briefA Kelsey–Kohno attack variant on SHA-2 message digests in HSS/LMS and XMSS
SummaryThis paper presents a multi-target second-preimage attack on the message hashing of the stateful hash-based signature schemes HSS/LMS and XMSS, using SHA-256 and truncated SHA-256/192. The attack uses herding to merge chaining states from many signatures into one state, so a single search covers all of them and bypasses the key and leaf-index commitments meant to prevent multi-target attacks. The authors estimate the cost against SHA-256 with 2^64 signatures falls from the nominal 2^256 to about 2^166 for messages up to 4 GiB, and about 2^153 for SHA-256/192; the SHAKE256 parameter sets are unaffected.
WhyAdapts Kelsey-Kohno herding to a multi-target second-preimage attack, quantifying concrete cost reductions for SHA-256 in HSS/LMS and XMSS.
In briefNear-Optimal Hardness of Closest Vector and Nearest Codeword Problems with Preprocessing
SummaryThis paper studies the approximation hardness of the closest vector problem (CVP) and nearest codeword problem (NCP) in a preprocessing model, where an algorithm receives the lattice or code in advance, produces polynomial-size advice, and then solves any target in polynomial time. Assuming NP is not contained in P/poly, the authors show polynomial-exponent hardness bounds for both problems. They extend the moment method to the preprocessing setting and give a direct reduction from PCPs yielding a factor of M^{Ω(1/(log log M)^2)}.
WhyLifts preprocessing-model hardness for CVP and NCP from subpolynomial to polynomial factors via an extended moment method, a substantial theoretical advance with impact mainly in complexity and crypto
In briefPolicy Differences Across Programming Language Ecosystems: A Qualitative Study
SummaryProgramming language ecosystems such as CRAN speed up software reuse but also raise supply-chain risks. This paper examines the policies of popular ecosystems, with three authors reaching moderate agreement on 38 policy categories across eight policies. The policies generally diverge rather than converge. Categories like malware, intellectual property, and content removal are broadly shared, while finer areas such as package size limits, metric manipulation, typo-squatting, and binary uploads show more variation.
Jukka Ruohonen, Rahime Yilmaz, Krzysztof Sierszecki
In briefUsing an Agent's Own Development History to Secure Its Generated Code
SummaryCode written by coding agents can pass tests while omitting security checks. The paper presents TRACER, a workflow that uses the agent's edit trajectory and recorded assumptions to track changes at the symbol level and attaches an executable check to each accepted repair. On the SusVibes benchmark, symbol-level tracking places the vulnerable symbol in the review scope for 94.6% of agent patches, compared with 13.4% for the primary scanner warning.
Prateek Kumar Rajput, Shahzeb Khan, El-Hacen Diallo et al.
In briefBack to Basics: Formal Analysis Hints for Better Weak-to-Strong Monitoring
SummaryThe paper addresses monitoring of frontier agentic systems that may take misaligned actions causing serious harm. It identifies four failure modes in current monitors: complete detection failures, partial detections, accepting false benign framings, and suspicion score calibration errors. The authors report that adding supplementary hints, such as command provenance, security-sensitive action flags, and disallowed-effect markers, to transcripts substantially improves weak extract-and-evaluate monitors at minimal computational cost.
Daniel Ben-Levi, Judah Goldfeder, Mateusz Dziemian et al.
In briefReversible pseudonymisation of documents sent to external LLMs: an open bilingual benchmark and engine
SummaryThe paper addresses professionals sending working documents to external large language models, proposing reversible pseudonymisation that swaps personal data for placeholders before sending and restores them locally afterward. The authors publish a benchmark of five existing tools and a regex baseline on Russian and UK English, plus an open engine built on the two strongest tools. All evaluation data are synthetic and real documents were not tested. On the generator-based held-out sets, existing tools leak a whole value in 61% (Russian) and 58% (UK) of documents, while the engine does so in about 0.3% and 0.2%, though Russian name placeholder restoration reached only 94.6% against a 99% threshold.
In briefPaper note: Why residue-confined error attacks do not apply to CRT-FHE with non-degenerate errors
SummaryThis paper responds to a cryptanalysis claiming key and plaintext recovery against a CRT-based fully homomorphic encryption scheme. The authors argue that the attack relies on an artificially constructed error distribution supported in the kernel of the CRT encoding, which makes the effective encryption error zero. They conclude that under the intended centered-binomial error distribution, such errors occur with negligible probability at the reported parameters, so the attack does not compromise the concrete scheme.
In briefMapping vulnerabilities (CVEs) to attacker techniques (ATT&CK) with evidence-based ranking
SummaryThis paper addresses automatically linking software vulnerabilities (CVEs) to MITRE ATT&CK attack techniques, to help defenders infer adversary behavior. The authors propose TRACE, which first combines structural and semantic evidence from multiple sources to build a bounded candidate set, then reranks candidates using CVE-technique text interactions and frequency-aware scoring. Tested on six public datasets, candidate construction cuts the 201-technique search space by about 60% while keeping at least one correct technique for 95.11%–100% of CVEs.
In briefChosen-Vector Attacks on Threshold Schnorr Signatures: Bounding Forgeries via Decoding Regions
SummaryThe paper analyses the adaptive forgery attack on threshold Schnorr signatures by Crites and Stewart, asking whether a chosen rather than random coefficient vector helps the adversary. The authors prove that an adversary committing to fixed vectors and recovering witnesses only in certified decoding regions succeeds with probability at most QM/p, where p is the group order. For the original parameter pairs the bound is very small at realistic field sizes. The work also classifies the decoder theorems used, while the hardness of the underlying oracle and the adaptive security of threshold Schnorr schemes remain open.
In briefNon-malleability in incremental verifiable computation: definitions, attacks, and constructions from falsifiable assumptions
SummaryThis paper studies non-malleable incrementally verifiable computation (IVC), an area that has received little attention. It examines whether simulation-sound IVC can be built from falsifiable assumptions, proposes a new family of definitions, and shows that existing designs do not achieve simulation-soundness without modification. The authors prove that natural zero-knowledge versions of Valiant-style proofs are malleable and that the existing NP-IVC from falsifiable assumptions cannot satisfy any simulation-soundness. They also construct an IVC with a non-trivial form of simulation-soundness under subexponential iO and either subexponential LWE or bilinear-map assumptions.
WhyIntroduces new simulation-sound IVC definitions, a first construction from falsifiable assumptions, and proves malleability of Valiant-style designs, a strong theoretical contribution with a subfield-
In briefRanking Is Not Deciding: Shortcuts and Threshold Collapse in RAG Poisoning Defenses
SummaryThis paper examines defenses against poisoning attacks on retrieval-augmented generation (RAG). The authors find that the near-perfect detection reported on benchmarks depends largely on how the poisoned documents were constructed, such as prepending the target question to each passage. Removing that cue sharply degrades a published filter's AUROC and miss rate. The authors argue that detection results should be reported together with the poison set's construction profile and the false-positive rate at the deployed threshold.
WhyShows high detection of query-time RAG poison filters stems from construction cues like prefix repetition and length, verified by prefix deletion and padding experiments across corpora.
In briefEdgeDeID: A Local 0.6B Clinical De-identifier Trained Without Real Patient Data
SummaryThe paper presents EdgeDeID, a 0.6B-parameter decoder-only model that removes identifiers from clinical notes locally and was trained only on synthetic notes generated by three LLM teachers and re-annotated under one convention. On a 100-note synthetic in-domain benchmark it reaches 0.994 micro-F1, versus 0.857 for the strongest of eight off-the-shelf systems, and runs on CPU in 615 MB when quantized. On MIMIC ICU nursing notes, however, F1 falls to 0.48.
Sina Daneshgar, Raya Namazi, Amirali Khosravi et al.
In briefExact Error Bootstrapping and Comb Bootstrapping for FHEW/TFHE Encryption
SummaryThis paper proposes bootstrapping the error instead of the decryption function in FHEW and TFHE, using a blind rotation to lift the error exactly so the message modulus is limited mainly by noise. It also introduces comb bootstrapping, where one blind rotation refreshes several ciphertexts at once. Implementations built on TFHE-rs report faster refresh and multiplication for 8-bit integers. Evaluating other functions still requires programmable bootstrapping.
In briefVeilDNS: Post-quantum DNS privacy starting from the first UDP packet
SummaryThis paper proposes VeilDNS, a DNS-native protocol that uses a post-quantum KEM and AEAD to encrypt DNS queries and responses and authenticate the resolver in a single UDP exchange. It keeps the DNS wire format and runs on standard UDP port 53, with stateless and stateful modes. The authors report higher cold-session throughput, lower latency, CPU time, bytes and packets than ML-DSA-authenticated DoT, DoH and DoQ. Tamarin is used to verify query confidentiality, response authentication and forward secrecy.
WhyProposes single-UDP-exchange post-quantum DNS encryption and authentication, verified with Tamarin and showing large throughput, latency, and byte savings over ML-DSA-based DoT/DoH/DoQ.
Aditya Singh Rawat, Mahabir Prasad Jhanwar, Rei Safavi-Naini
In briefImproving LLM vulnerability detection by combining different code representations
SummaryThis paper studies how large language models detect vulnerabilities in C source code using raw source, abstract syntax trees, and control flow graphs. The authors find that different representations are better suited to different vulnerability types. They propose the Representation-Aware Logical Ensemble (RALE), which combines models trained on each representation using explicit logical rules and majority voting. The reported F1-score rises from up to 73% for single-representation models to 78% for the integrated approach.
Francesco Crescenzo Grasso, Pietro Liguori, Roberto Natella et al.
In briefRing-0 by Default: Treating LLM Agents as Operating Systems
SummaryThe paper argues that LLM agents already perform core operating system duties, such as file access, process and subagent control, and extension loading, yet lack the protections OSes built over decades. The authors map 116 standard OS mechanisms across 19 subsystems to agent counterparts, finding only 11 isomorphic and 65 missing, mostly protections. Thirteen experiments on Claude Code, Codex CLI, and Gemini CLI test whether the map's verdicts hold.
WhyMaps 116 OS mechanisms onto LLM agents and tests 25 on three CLIs, finding most protections missing and forged resume records accepted.
In briefA paper on a Rowhammer attack against Fil-C's software capabilities
SummaryThis paper studies how Rowhammer, a DRAM hardware flaw where repeated row accesses can flip bits in nearby rows, affects program behaviour. The authors propose a probabilistic small-step operational semantics for an idealised imperative language subject to Rowhammer-style faults. Using physical separation as a case study, they prove that the protected projection of the faulty semantics equals the fault-free execution.
In briefTrust Mechanisms for Offline Edge Generative AI: A Connectivity Framework and Raspberry Pi 5 Study
SummaryThe paper addresses running large language models on IoT devices with intermittent or no connectivity, proposing a C0–C4 connectivity-regime framework, a taxonomy of inference-time trust mechanisms, and signed, versioned knowledge packs for disconnected updates. The authors tested fully local retrieval-augmented generation on a Raspberry Pi 5 under network isolation across several model sizes and context sizes. They found that verifying a signed pack is far faster than embedding its passages on-device, but a validly signed poisoned pack passes all pack checks, and none of the evaluated mechanisms establishes whether the evidence is true.
In briefVulDec: Detecting Binary Vulnerabilities via Neural Decompilation
SummaryThe paper introduces VulDec, a large, curated dataset pairing real-world assembly and C functions with CWE vulnerability annotations across multiple architectures, plus an end-to-end framework using neural decompilation for binary vulnerability detection. The authors report that LLM-based neural decompilers tuned on the dataset recover source code with about 56% edit similarity and 43% BLEU-4. Their tuned LLM-based detectors reach a macro F1-score of 0.61 on an in-distribution realistic test set with a 3% vulnerability rate.
Francesco Crescenzo Grasso, Pietro Liguori, Roberto Natella et al.
