In briefPrivacy risks of quantized neural networks: do compressed models leak more training data?
SummaryThis paper presents the first comprehensive empirical study of privacy risks in quantized deep neural networks, evaluating eight membership inference attacks across six quantization methods. Practical quantization levels of 4 to 8 bits have limited effect on membership privacy, leaving quantized models about as vulnerable as full-precision ones. Aggressive 2-bit quantization yields some privacy gains but substantially degrades utility. Existing defenses designed for full-precision models offer limited protection for quantized models while further amplifying utility loss.
In briefWhen POST Becomes GET: How Interchangeable HTTP Methods Can Create Security Gaps
SummaryThis paper studies HTTP method interchangeability, where a POST request to an endpoint is rewritten as a GET request with its body parameters moved into the query string, yielding an equivalent response. The authors present MIDE, an automated pipeline that crawls web applications, converts captured POST requests, and compares responses. In an unauthenticated experiment on the Tranco top 10k, they found high-confidence interchangeable requests on 407 sites. The study also reports CSRF token-replay cases and conditions related to Web Cache Deception.
Matteo Golinelli, Seif Errahmane Hannachi, Bruno Crispo
In brief"Penny for Your Prompts": A Study of Chat Data Leaks on AI Platforms
SummaryThis paper measures how 42 AI chatbot web interfaces, including general-purpose and health, legal, and education platforms, share data with third parties. The researchers instrumented the browser's JavaScript engine to trace each data flow back to the user action that triggered it. They found that 21 platforms leak conversation titles and nine leak verbatim user prompts to third-party trackers, and many also send users' emails.
Paschalis Bekos, Billy Tsouvalas, Nick Nikiforakis et al.
In briefSecDMP: A Provably Secure Data Prefetcher Defense (Extended Version)
SummaryData memory-dependent prefetchers (DMPs) are a CPU optimization in recent mainstream processors that can improve performance but may leak secrets through side channels. The paper classifies DMP leakage, categorizes existing and new attacks, and validates the analysis by implementing open-source DMPs on a RISC-V processor. It proposes SecDMP, a hardware defense in which secrets are marked in memory so DMPs never encode them in the microarchitecture. The authors formally prove SecDMP adds no leakage beyond a baseline without DMPs.
WhyClassifies DMP leakage and proposes SecDMP, a formally proven hardware defense blocking all leakage classes while preserving public-data performance.
Jens Sprengers, Marton Bognar, Lesly-Ann Daniel et al.
In briefThe Envelope Layer: An Underestimated Defense Surface for LLM Agents
SummaryThe paper builds on prior work that treats the envelope layer as the channel through which malicious content enters an agent. Using the A2A-TIBA attack as a test vehicle, it runs a two-by-two factorial experiment and a memory experiment to examine how label strength, envelope authenticity, scaffold differences, and existing memories affect defense. Strong labels reduce semantic breach rates when envelopes are authentic, but weak labels are not always better than no label, and strong labels lose effect when envelopes can be forged. Memory has a larger effect than label manipulation. The authors refine the envelope layer into an admission channel and a context assembly surface, arguing its security boundary depends on label claims, frontend permissions, and historical memory together.
In briefCommit-boundary authorization guardrail for AI agents resolving entity identities
SummaryThe paper proposes an authorization boundary for agentic entity resolution systems that separates evidence usable for reasoning from evidence allowed to authorize persistent identity changes. A domain-governed function maps reconstruction failures to identity-preserving constraints, and a two-phase supervisor permits a commit only when evidence covers every required proposition, conflicts are resolved, the operation is in scope, and versions are valid. It is a conceptual architecture without implementation or empirical validation.
