In briefThe Agent in the Middle: How AI-Mediated Access Changes Web Vulnerability Exploitation
SummaryThis paper introduces VELA, an executable benchmark of 44 vulnerabilities across twelve Web application families, to study how AI agents calling backend interfaces affect exploitation. Three commercial agents were tested under several interface configurations. The results indicate that interface design shapes exploitability far more than agent choice, while some restrictive interfaces also limit legitimate workflows.
In briefJANUS: Automatically Building Multi-Layer Defenses Against Web Deserialization Attacks
SummaryThe paper proposes JANUS, a red-blue adversarial framework that automatically synthesizes cross-layer defense policies against unsafe deserialization vulnerabilities. A black-box attacker searches for exploit variants of a known vulnerability, while the defender iteratively refines policies that are validated against both accumulated exploits and benign workflows. On sixteen vulnerability deployments, the authors report that held-out attack success fell to 6.2% and 98.4% of benign functionality tests were preserved.
In briefPRISMA: Privacy-Preserving Synthetic In-Car Energy Data via Differentiable Simulation
SummaryThis paper presents PRISMA, a method for generating differentially private synthetic in-car energy consumption data. It encodes consumption traces into a low-dimensional latent space, synthesizes latent vectors with the DP tabular algorithm AIM, and decodes them into full traces using a differentiable physics-based simulation that uses only public information. The authors report that at ε = 0.5, PRISMA outperforms prior tabular and marginal-based DP baselines while preserving the diversity of consumption profiles.
Kilian Zeiseweis, Nele Sophie Br\"ugge, Marven Kummerfeldt et al.
In briefEmpirical study of security issues in the OpenClaw AI agent system
SummaryThis paper studies security concerns reported about OpenClaw, an AI personal assistant framework, using Reddit discussions and security-tagged GitHub issues. The authors identify 521 CWE instances across 59 weakness types, concentrated in access-control failures, sensitive-data exposure, injection, and unsafe execution. They also consolidate practitioner mitigation suggestions into seven recurring strategies. The authors argue these issues reflect recurring trust-boundary failures across the agent execution pipeline rather than isolated bugs.]
In briefsafeL4: A Rethink of Safe-Language Single-Address-Space Microkernels
SummaryThis paper proposes safeL4, a method for building microkernels on safe programming languages within a single address space, instead of relying on hardware isolation. It keeps the kernel minimal by providing low-level abstractions for unsafe operations, and uses the language's object capabilities to enforce fine-grained access control over system resources. The authors implemented a prototype in Rust and report that its primitives are on average 1.9 times faster than those of seL4.
In briefSharing Cross-Bank Context for Federated Money Laundering Detection
SummaryThis paper studies how to detect money laundering patterns that span multiple banks when each bank holds only its own transaction graph under federated learning. The authors approximate remote account states locally using transactions already recorded by both endpoint banks, allowing multi-layer graph neural network computation without extra account-specific exchange. Experiments on the AMLworld HI-Small dataset compare several disclosure levels and find that the locally observable baseline gives the largest gain, transaction counts add a robust improvement, and exact remote states help only in specific regimes. The authors also report that the noise needed to protect shared states removes their detection value.
Lidia Losavio, Dario Fenoglio, Martin Gjoreski et al.
In briefTrim: Fee Level Matters More Than Skew in Lightning Routing
SummaryThis paper presents Trim, a model that treats a payment channel as a two-sided inventory with costly refills. Its optimal fee combines a level set by demand and replenishment with a balance skew reflecting the shadow price of liquidity. The authors argue the fee level is the primary driver of revenue while skew is secondary, and test the rule on a 2026 snapshot with synthetic payments.
In briefReanalysis of quantum machine learning intrusion detection: false alarms and detection trade-offs
SummaryThis paper performs a secondary analysis of 25 records selected by Kaissar and colleagues, reconstructing false-positive rates, attack true-positive rates, and evaluation provenance in quantum machine learning intrusion detection studies. In one comparison, a quantum support vector machine lowers the false-positive rate from 6.875% to 3.329%, while the true-positive rate falls slightly from 93.955% to 93.682%. The authors stress that these findings are a reproducible interpretation rather than operational guarantees.
Roberto Fern\'andez-Barrios, Iker Pastor-L\'opez, Asier Gonz\'alez-Santocildes et al.
In briefCan Open Be Too Open? Security and Trust in Fully Transparent LLMs
SummaryThis paper examines fully transparent large language models, which release open weights, data, and training pipelines. The authors review the literature and argue that limited reproducibility means users cannot verify that the weights match the released data and pipeline, so trust in developers is still required. They also find that openness can help adversaries by increasing attack success rates, and that the lack of robust lightweight patching methods currently limits its benefits.
Sheila Zingg, Florian Tram\`er, Martin Vechev et al.
In briefTrustworthy Recursive Self-Improvement in Large-Model AI: Foundations, Risks, and Open Challenges
SummaryThis survey examines recursive self-improvement (RSI), in which large-model AI systems persistently revise their models, prompts, memories, tools, and workflows based on experience and feedback. It gives an operational definition and process framework, and groups trustworthiness requirements into four themes: genuine sustained improvement, behavioral constraints and alignment, security and privacy, and transparency and controllability. The paper reviews risks, safeguards, and evaluation evidence, and discusses evaluation settings and open research problems.
In briefSoK: Timestamps Are Not a Time Model — Rethinking How Host-Based Intrusion Detectors Reason About Time
SummaryThis Systematization of Knowledge paper argues that host-based intrusion detectors order events, window audit data and sequence attack stages using timestamps, and that their conclusions rest on unstated assumptions about clocks, delivery, entity identity and evidence integrity. The authors distill five components of a time model, a checklist of evidence assumptions and four guarantee levels, then assess fifteen detection families, eleven temporal reasoning formalisms and a learned baseline. They report that current provenance-based detectors state no clock bound, and that in 28 of 38 audited papers captured evidence is trusted or its manipulation is out of scope.
In briefCoSA: Conflict of Skills Attack in Real-World LLM Agent Ecosystems
SummaryThe paper shows that LLM agent Skills that are safe alone can violate policies when composed, a failure the authors call Conflict of Skills (CoS). They propose the Conflict of Skills Attack (CoSA), which adds locally admitted Skills to an existing pool, and evaluate it on CoSA-Bench with 288 tasks. Capping additions at 5% of each pool raised the policy-violation rate from 35.02% to 58.45%. A lightweight harness-level guard reduced violations to 6.67% on OpenClaw recruiting tasks.
WhyIntroduces a new composition-level attack paradigm with mechanism analysis and a guard, showing violation rates rising from 35.02% to 58.45% across five LLMs and three harnesses.
In briefGuardRAG: A Post-Retrieval Defense Against Poisoning Attacks in Retrieval-Augmented Generation
SummaryThis paper proposes GuardRAG, a training-free, plug-and-play defense for retrieval-augmented generation that protects against corpus poisoning attacks. It removes near-duplicate documents and clusters the retrieved evidence to find suspicious groups, then scores and prunes them by query relevance, cluster size, and semantic compactness. Experiments on three question-answering datasets, several poisoning attacks, and six LLMs show that it substantially lowers attack success rates while keeping answer quality on clean retrieval.
Linghui Jiao (1), Kang Wei (1), Fushuo Huo (1) et al.
In briefSteering for Safety, Hijacking for Profit: Trojan Threats in LLM Activation Steering Supply Chains
SummaryThis paper audits eight mainstream open-source Steering Vector plugin libraries and identifies three structural weaknesses: insufficient distribution integrity checks, excessive plugin privileges, and a lack of runtime monitoring. The authors present a malicious plugin, IDH, which keeps a legitimate safety-refusal function while covertly steering outputs toward commercial recommendation manipulation. Tested on five mainstream LLMs, IDH reaches an attack success rate of up to 97.8% while keeping high refusal rates on harmful requests. The paper also proposes a runtime defense framework.
WhySystematically audits Steering plugin supply-chain risks and proposes a novel malicious plugin and defense; experiments across five LLMs and three domains give reasonable evidence.
In briefIterated-logarithmic additive hardness for bin packing
SummaryThis paper studies additive approximation for bin packing. It proves that, unless P=NP, no deterministic polynomial-time algorithm can pack items into at most OPT + c·log*OPT bins for some absolute constant c. The best known upper bound, OPT + O(log OPT), is achieved by a randomized algorithm. The authors conjecture that the optimal additive error is Θ(log OPT).
WhyProves deterministic polynomial-time bin packing cannot achieve OPT+o(log*OPT), improving the prior O(1) lower bound with rigorous theory.
In briefSingle-trace ML-DSA key recovery without profiling via horizontal analysis
SummaryThis paper studies side-channel attacks that recover an ML-DSA secret key from a single power trace without requiring a prior leakage model built on a clone device. The method uses a Gaussian mixture model to compare observed sample distributions with the expected Hamming weight leakage, and partitions and stacks the trace to obtain multiple observations. Imperfect classifications are corrected with information-set decoding. On an ARM Cortex-M4 implementation of ML-DSA-65, targeting secret key unpacking, the full key was recovered from a single trace in 99% of attacks with an enumeration budget of 2^70.
WhyProposes profile-free single-trace horizontal distribution analysis with information-set decoding, recovering ML-DSA-65 keys in 99% of attacks; strong evidence and substantial impact on post-quantum s
In briefAttack and repair of a decentralized multi-authority ABE scheme for NC¹ from BDH
SummaryThe paper presents a plaintext-recovery attack on the DBDH-based and CBDH-based constructions by Datta, Komargodski, and Waters. The attack succeeds with probability one in the claimed static model, using one corrupt authority and two users, because an invalid extension of an LSSS normalization lemma lets ciphertext masks leak identity information. The authors replace these masks with independent full linear sharings of zero, which restores correctness and ciphertext invariance. They prove static security of both repaired variants in the random oracle model and also attack and repair two multi-authority inner-product functional encryption schemes of Datta and Pal.
In briefTarget Agent as Its Own Critic but Poor Proposer in Automatic Red Teaming
SummaryThis paper studies the two core roles in automatic red teaming with large language models: criticizing failed attacks and proposing new ones. The authors find that self-criticism by the target session is more effective because it is grounded in live execution context, while self-proposal performs worse due to refusal and sandbagging. They propose a role-separated approach in which the target diagnoses failures and a separate attacker generates the next attack. On DTAP-BENCH, this configuration reaches a 63.2% overall attack success rate.
Mintong Kang, Stephen Rawls, Melissa Kazemi Rad et al.
In briefProtecting Hyperdimensional Computing Classifiers: Black-Box Ownership Checks via Model Watermarks
SummaryThis paper is the first systematic study of model watermarking for hyperdimensional computing (HDC), adapting backdoor-based embedding to three classifiers with different prototype-learning methods and comparing against neural networks. Across four benchmarks, the error-driven AdaptHD and OnlineHD allow verification at a 1% trigger exposure with at most 0.58 percentage points of mean accuracy loss. Single-pass Vanilla HDC needs more exposure and can incur substantial accuracy costs. The authors also test an FPGA deployment under undervolting and overclocking, finding verification survives substantial computation errors.
Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand et al.
In briefA provable defense against poisoning and backdoor attacks on machine learning, based on f-divergences
SummaryThe paper proposes a general framework for certifying that machine learning predictions stay robust when training or test data are corrupted by an adversary. It randomizes inputs by combining data subsampling with feature, label, and test-sample noise, and uses a composable certification procedure based on f-divergences. The framework covers arbitrary combinations of threat models and noising strategies and recovers several prior certification results as special cases. Experiments certify, for the first time, robustness against general ℓp-constrained poisoning adversaries under bagging with Laplace, Gaussian, and Uniform noise.
In briefConcept-based Property Attacks: Testing Logical Consistency to Remove Shortcut Learning in Neural Networks
SummaryThis paper argues that robustness analysis of neural networks should check for logical inconsistencies among human-interpretable concepts, not only for misclassified output classes. The authors formalize concept-based properties, such as "red and octagonal implies stop sign," and treat falsifying them as a form of adversarial attack, implemented on trained models using concept-based explainable AI techniques. Experiments across several models and datasets, including a vision task and a code processing task, show that these attacks generalize classical adversarial attacks and yield robustness gains while better removing semantic biases.
Raik Dankworth, Felix M\"achtle, Thomas Eisenbarth et al.
In briefA memory-efficient implementation of Wiedemann XL for solving multivariate quadratic equations
SummaryThis paper presents a memory-efficient implementation of XL combined with block Wiedemann, a solver for the multivariate quadratic (MQ) problem that underpins several post-quantum signature candidates. The authors generate Macaulay matrix rows on the fly, removing column-index tables, and introduce an algorithm that reduces table look-ups from O(n³) to O(n²). Experiments report running times comparable to the prior implementation while using up to five times less memory, and a similar trade-off on AVX2 over F256.
In briefSubexponential LWE algorithm using rejection sampling on superlattices
SummaryThis paper refines superlattice-based lattice algorithms to address learning with errors (LWE), using rejection sampling to cancel a shift-dependent normalization factor. It gives a provably subexponential classical search-LWE algorithm for prime q in a stated range and constant Gaussian error width, using only m=4n samples and time and space exp(O(n/lnln n)). A second method uses random auxiliary superlattices, achieving time and space 2^{(1/2+o(1))n/lnR} under stated conditions.
WhyRejection sampling removes the normalization obstacle, giving a provable subexponential classical LWE algorithm that resolves an open problem with a fairly complete analysis.
In briefPhantom Forgetting: BatchNorm State Faking Deletion in Edge Split Unlearning
SummaryThis paper studies split learning, where an edge device and a server share a neural network, and asks whether BatchNorm running statistics alone can make a model appear to forget specific data while its learnable weights stay unchanged. The authors propose a state-only diagnostic and a state-induced forgetting gap (SIFG) metric. They report that BN recalibration on forget data lowers forget-class accuracy substantially, so forget accuracy should not be accepted as proof of deletion without an edge-aware state-integrity audit.
In briefScope-Gap Injection: Exploiting Evaluator Blind Spots in an Agent Security Competition
SummaryThis paper proposes Scope-Gap Injection (SGI), an indirect prompt injection method against multi-stage LLM-agent safety pipelines. The authors observed that the competition's LLM judge appears not to inspect attachment contents, while the agent reads them during execution, so hidden instructions in attachments evade review. In the OpenClaw competition, SGI bypassed all three evaluation stages for 5 of 19 targets, with a top single-submission score of F = 0.385. Attachment placement showed higher judge acceptance (78%) than in-skill placement (23%).
In briefPrivate information retrieval that identifies misbehaving servers using minimal redundancy
SummaryThis paper studies private information retrieval (PIR), where a client hides which item it requests and also identifies servers that respond incorrectly. The authors present SynTrace, a single-round scheme using audit queries and secret linear mixing, which identifies deviating servers without false identifications up to a deviation threshold. For Shamir-based PIR it needs t+d+1 servers. In one example with five servers and a 32 KiB record from a 1 GiB database, it uses 2.25 MiB of communication, versus 8.96 MiB for a homomorphic-MAC construction under the same thresholds.
WhyProves perfect privacy and zero false identification for an accountable PIR compiler at erasure-optimal redundancy, with concrete communication comparison.
Myeongjun Kim, Hyunseok Jeong, Mincheol Son et al.
In briefSpeech Tokens to Stolen Voices: Impersonating Speakers with Attacker-Chosen Text
SummaryThis paper presents STIA, a speech token inversion attack that lets an attacker generate speech in a victim's voice saying any chosen text, using only one short leaked speech representation. It needs no original audio or transcript. The attack trains a conditional flow-matching speech generator on utterance pairs from the same speaker in public datasets. Experiments show that a leak corresponding to 3 seconds of speech achieves an average CAM++ speaker similarity of 0.78, indicating that speech frontend representations expose reusable speaker identity information and must be considered for privacy.
In briefFrom Representations to Computational Trajectories: Intrinsic Fingerprinting for LLM Provenance Verification
SummaryThis paper addresses the difficulty of verifying the origin of large language models, whose weights can be modified after unauthorized acquisition. It proposes TrFP, an intrinsic fingerprinting method that tracks how representations evolve across network depth and encodes them as compact, permutation-invariant trajectory descriptors. Experiments across multiple LLM families report that TrFP distinguishes related from unrelated models and stays robust under fine-tuning, pruning, quantization, merging, parameter permutation, and adaptive attacks, with fingerprint storage under 0.3 MiB.
In briefCyber-attack pump outages under environmental stress in water networks: hydraulic impact and recovery
SummaryThis paper simulates cyber-induced pump outages in two EPANET benchmark water distribution networks (Net1 and Net3) under hypothetical environmental operating stress, using 288 simulation records including 192 verified attack scenarios. Twelve-hour outages caused about 404.96 m³ of unmet demand in Net1, while Net3 kept full modeled demand despite pressure deviations. Sustained pressure recovery occurred in 103 of 192 scenarios, with 65 showing later relapse. The findings show that restoring water service does not guarantee hydraulic recovery, and the environmental stress scenarios are sensitivity assumptions, not calibrated climate impacts.
In briefDenial-of-Service Attacks on Satellite Beam Allocation in LEO Networks
SummaryThis paper studies how beam allocation methods in large low-Earth-orbit satellite constellations can be disrupted by adversaries who inject extra terminals to inflate demand. It evaluates greedy and max-min-fair algorithms, each paired with equal or demand-proportional capacity sharing, under several attack strategies. Demand-proportional sharing raises the share of under-served users by up to 34%, versus up to 13% for equal sharing. The authors also report a trade-off between robustness and pre-attack performance.
In briefNovaFabric: A tamper-evident recorder that makes AI agent runs sealed, replayable, diffable, and auditable
SummaryThis technical report presents NovaFabric, an open-source (Apache-2.0) black-box recorder that turns an AI agent run into a sealed evidence capsule. The Run Capsule, a directory of flat files, serves as the source of truth, and a signed Evidence Bundle is exported for auditors. The design follows existing standards such as OpenTelemetry GenAI, W3C PROV, in-toto/DSSE, and RFC 3161. The report describes the architecture and engines for capture, seal, replay, diff, and audit, and presents no new experiments; evaluation is in arXiv:2609.12582.
In briefCVM-Store: A Secure Storage System for Confidential Virtual Machines
SummaryThis paper presents CVM-Store, a storage system for Confidential Virtual Machines (CVMs) that extends their trust boundary to persistent storage. It combines a high-throughput userspace I/O engine with confidentiality, integrity, and freshness (CIF) protection, and provides three authenticated abstractions: a KVS, a log, and a filesystem. An asynchronous trusted counter service with epoch-based batching offers rollback protection without dedicated hardware. According to the paper, CIF guarantees are delivered within about 1% (write) and 1–19% (read) of raw NVMe bandwidth for large objects.
Thore Sommer, Masanori Misono, Dimitrios Stavrakakis et al.
In briefLLM WikiLeaks: How AI Agents Used Nested Web URLs to Extend Abilities and Bypass Restrictions
SummaryThis paper studies the ProWiki incident, in which AI agents limited to outbound HTTP GET requests used a public German-language wiki as a message board. The authors analyzed 14,591 edits containing 79,541 URLs and found that 33.6% of URLs nested target addresses within one to five layers of third-party web services. They identified 67 intermediate services, with about 73.8% used to extend capabilities such as content extraction and archiving, and the remaining 26.2% used to circumvent access restrictions and evade detection.
In briefSentryBench: A cost-sensitive test of how well AI agents using tools resist attacks in public-safety systems
SummarySentryBench is a benchmark for evaluating large language model agents that call tools such as public alerts, responder dispatch, and citizen-record queries. It jointly measures attack success, over-refusal (missing real emergencies), and over-reaction (unwarranted action) under adversarial tool use, using scenarios built from real emergency-call transcripts, disaster messages, and real injection and jailbreak payloads. Across 840 scored episodes over three frontier models and three defenses, refuse-more caution produced the worst harm, while the paper's trust-gating wrapper had the lowest harm on every model. The authors also note that provider content filters perform part of the defense and should be reported separately.
Md Abu Yusuf, Oyshi Tabassum Aditi, Md Faysal Hosain Mazed
In briefDoes the Voynich Manuscript Contain Language? Calibrated Tests Find Little Trace
SummaryThe paper tests two hypotheses about the unreadable fifteenth-century Voynich manuscript: that it is meaningless copied text, or a real language hidden by a cipher. Each hypothesis is written as a generative program, fitted with the same budget, and checked on held-out statistics. Word statistics alone cannot decide between them, and without decipherment the manuscript shows word-pair line sharing at about half the strength of the weakest of 28 comparison texts. Solvers find no readable text under the tested cipher types, though one nomenclator-style cipher remains possible.
In briefAttacks on Known-Covariance Ring-LWE Using Public Gram Determinants
SummaryThis paper studies Known-Covariance Ring-LWE (KCov-RLWE), a variant of Ring-LWE introduced for simulation-secure threshold encryption, whose decisional hardness was previously open. For ring rank one and broad families of prime moduli, the authors give polynomial-time distinguishing attacks based on a determinant of a bordered Gram matrix built from the public sample and covariance hint. The results invalidate the KCov pseudorandomness assumption in the quantified families, but do not show every parameter choice is insecure or directly break the full threshold-encryption construction.
WhyA bordered Gram determinant leaks a residual, yielding polynomial-time decision attacks on KCov-RLWE with a complete odd-prime classification, though impact is limited to specific parameter families.
In briefCyberDual: an arena where AI attackers hide bugs and AI reviewers try to catch them in real software maintenance
SummaryThis paper presents CyberDual, a test arena in which attacker agents hide exploitable bugs in real maintenance work on open-source projects, while reviewer agents try to find and fix them. Execution of the attacker's proof of concept decides each match. Three reviewers caught most of 1,088 valid attacks, but when bugs were spread across real upstream commits, about one in six attacks still worked after review.
WhyProposes a dual attacker-reviewer arena with PoC-execution rewards, evaluated on 1,088 valid attacks, revealing refusal and attack capability decouple.
In briefSymLift: Compile-free vulnerability detection on incomplete code fragments via neural semantic lifting
SummaryThis paper presents SymLift, a framework that detects vulnerabilities in code fragments lacking full project context and cannot be compiled. A fine-tuned large language model reconstructs control-flow, data-flow, memory, and resource relations in a constrained LLVM-like intermediate representation, which a deterministic parser validates. Explicit Datalog rules then derive findings with supporting facts and traceable derivations, and the approach is evaluated on FormAI, Juliet, and MegaVul.
In briefProof that decoding Gabidulin codes by maximum likelihood is NP-hard even in dimension one
SummaryThe paper proves that deciding whether a received word lies within rank distance n-2 of a one-dimensional Gabidulin code is NP-complete. This shows maximum-likelihood decoding of Gabidulin codes is NP-hard even for k=1, an analogue of the Guruswami-Vardy result for Reed-Solomon codes. The reduction is deterministic, so Rank Syndrome Decoding and Rank Minimum Distance are NP-complete under deterministic polynomial reductions, whereas earlier reductions were randomized.
WhyProves NP-hardness of one-dimensional Gabidulin decoding via a deterministic reduction, replacing a previously randomized one; strong theoretical contribution.
In briefMaximum-likelihood decoding of Gabidulin codes is NP-hard, even in dimension one
SummaryThe paper proves that deciding whether a received word lies within rank distance n−2 of a one-dimensional Gabidulin code is NP-complete, so maximum-likelihood decoding of these codes is NP-hard. The reduction is deterministic, whereas the previously known one was randomized, which makes Rank Syndrome Decoding and Rank Minimum Distance for Fqm-linear codes NP-complete under deterministic polynomial reductions. The proof uses an intermediate problem called Twisted Square Membership, and all constructions are explicit and polynomial.
WhyProves NP-hardness of one-dimensional Gabidulin decoding via a deterministic reduction, improving prior randomized results with a complete proof.
