In briefStep-Zero Attack: Agent Safety Before Observability
SummaryThis paper argues that existing attacks and defenses for coding agents target the stage after content enters the model, while agents often must first process unknown files, network responses, or images to judge their safety, and that processing can itself cause harm. The authors call this initial processing "Step Zero" and test seven harnesses and six models. Most combinations exceeded a disk budget before the model saw any content, and the paper proposes a gate at the processing-primitive level that keeps extraction within budget.
WhyThe authors introduce Step-Zero attacks, where harm occurs before the model reads content, testing seven harnesses and six models with a byte-counting gate defense.
In briefCertClaim: A certified method for verifying model claims in coding-agent services
SummaryCoding-agent services are priced according to the model they claim to use, so verifying those claims matters to users. The paper argues that existing model auditing methods assume a fixed deployment, while providers may legitimately change sampling settings, reasoning mode, or system prompts without changing the model, causing false accusations or missed cheap substitutes. The authors propose CertClaim, which treats all authorized deployments as part of the claim and checks whether some authorized deployment explains the service's evidence. The paper provides theoretical analysis of its false-accusation rate and detection condition, and experiments show it is valid across settings and resistant to potential adaptive attacks.
In briefReddit community signals as a supplementary domain-reputation feature for spam classification, evaluated conservatively
SummaryThis study tests whether signals derived from Reddit discussions can serve as an extra domain-reputation feature for email spam classification. Using a 5,582-email corpus preprocessed from SpamAssassin, it compares a baseline, a version with urgency and action scores, and a version adding Reddit-based features. The Random Forest model with Reddit-enhanced features reaches 97.94% accuracy, a 0.55-point gain over the baseline that is not statistically significant in the primary split. The authors frame the results conservatively and call for further validation before deployment.
In briefGrading student reports with small language models using rubrics
SummaryThis study presents an automated grading pipeline that runs locally, using lightweight language models to assess student texts against predefined rubrics and a vision-language model to interpret images. It uses responses from 105 students across two semesters of an undergraduate cybersecurity incident response exercise. Small models in low-resource settings reached up to 97% accuracy on text-only assessments and up to 94% on rich-text assessments.
Sandesh Kumar Kafle, Jan Vykopal, Valdemar \v{S}v\'abensk\'y
In briefChain-of-thought monitoring needs separate evidence for faithfulness and monitorability
SummaryThis paper argues that a visible reasoning trace does not automatically make model behavior easier to monitor, since reasoning visibility, mechanistic faithfulness, mechanistic localizability, and behavioral monitorability are distinct properties. Two case studies across three open-weight reasoning models show that evidence for one property does not establish the others. The authors propose an evidential-chain reporting standard in which each claim states its target property, access tier, and artifact, and each required link is labeled as supported, unsupported, or assumed.
In briefStateGate: A prompt optimization method that keeps long-chain AI agents following all their instructions
SummaryLong-chain LLM agents often fail to carry out every step of complex tasks even when their prompts specify them. StateGate converts natural-language constraints into symbolic gates enforced by an external deterministic runtime, separating constraint effectiveness from its text. The design uses a state file, a validator, and an orchestrator, and was tested on a security vulnerability-discovery task, where it reported 100% execution closure and accurate vulnerability detection.
In briefDetecting Generated-Depth Injection Attacks on RGB-D Place Authentication
SummaryThis paper studies attacks in which an adversary uses monocular depth estimation to generate depth from public RGB images and submits forged RGB-D queries to place authentication. The authors evaluate a presentation attack detection classifier that relies on geometric consistency between enrollment and query views, across three stages depending on how accurately the attacker knows the camera intrinsics. They report that the original classifier falls to near chance when the attacker has exact intrinsics, while a retrained classifier still detects forgeries using the registration residual.
In briefCipherFlow: A compiler that builds fast, cryptographically secure AI inference programs
SummaryCipherFlow is a compiler framework that takes an AI computation graph, cryptographic primitives, and a target hardware and network setup, and generates a latency-optimized secure inference program. It profiles primitive costs on the deployment environment, jointly plans placement of homomorphic encryption and secure multi-party computation, and uses BlockFold to scale planning to Transformer graphs. On BERT-base and ViT, it reports speedups of up to 16.5 times and over 22 times, respectively, compared with static hybrid placement baselines.
In briefJ-Anchor: Defending Language Models Against Prefill Attacks by Restoring Refusal in J-Space
SummaryThis paper studies prefill jailbreaks, where an attacker supplies an unsafe assistant prefix that makes a safety-aligned language model continue generating harmful content. The authors observe refusal-state erosion: during prefilling, the refusal signal falls back to its benign baseline while the harmfulness signal stays elevated. They propose J-Anchor, a training-free inference-time defense that uses the pre-attack signals as an anchor to selectively restore refusal in J-space. The method reduces attack success across model families while largely preserving benign behavior and reasoning ability.
In briefBilinear Hulls for Faster Support Splitting in Code Equivalence
SummaryThe paper studies how replacing the standard inner product in Sendrier's Support Splitting Algorithm with a bilinear form can reduce its cost. It shows only a narrow two-parameter family of forms works, and the hull dimension drops by at most one, so the cost falls by at most a factor of q, the field size. The authors find that PEP-based SPECK benefits from this reduction, while LESS and PERK fall outside the framework, and a SageMath implementation confirms feasibility at length 252.
In briefWhen Benign Is Unverified: Label-Signal Mismatch in Graph-Based Memory Forensics
SummaryThe paper examines validation of a graph-based triage pipeline for Windows memory images. On the MalVol-25 dataset, a rule layer flags nearly all benign control captures, contradicting their benign labels and suggesting the benign class is unverified. The authors report similar defects in public corpora and propose seven reporting artefacts for learned triage on corpora with asserted ground truth.
Viraj Rajeshbhai Chudasama, Eduardo Palmieri, Dipo Dunsin et al.
In briefOptimal conversion from zero-concentrated to Gaussian differential privacy
SummaryThis paper examines the conversion between two privacy accounting frameworks, Gaussian differential privacy (GDP) and zero-concentrated differential privacy (zCDP). It shows that every ρ-zCDP mechanism satisfies μ_zCDP(ρ)-GDP and gives this optimal reverse conversion. Simplified bounds with sharp constants show the two frameworks are equivalent up to constants.
WhyThe authors give the optimal reverse conversion from zCDP to GDP, showing every ρ-zCDP mechanism satisfies μ_zCDP(ρ)-GDP, and report simplified sharp bounds √(πρ) ≤ μ_zCDP(ρ) ≤ √(8ρ) that clarify the
In briefLarge-scale check of cookie notice privacy and accessibility for blind and low vision users
SummaryThis paper presents the first large-scale evaluation of cookie notices across 2,061 domains, focusing on blind and low vision users. Using a crawler, a custom screen reader add-on, and accessibility tools, it measures UK GDPR/PECR compliance, tracker activity before and after consent choices, and screen reader accessibility. It finds that 51% of sites show a cookie notice, and at least 50% of those violate UK GDPR/PECR requirements. Accepting a notice produces a mean five-fold increase in tracker activity. Notices that fail legal privacy requirements also tend to be the least accessible to screen reader users.
In briefSHield: Watermarking 4D Gaussian Splatting via Spherical Harmonic Coefficient Perturbation
SummaryThis paper presents SHield, a watermarking method that protects 4D Gaussian Splatting (4DGS) model files from unauthorized copying. It embeds a zero-mean payload across the spherical harmonic coefficients of a key-selected subset of Gaussians, with a brief anchored optimization to preserve visual fidelity. Verification needs no neural decoder and recovers the payload in closed form. Across 30 scenes from D-NeRF, HyperNeRF, and DyNeRF, payload recovery reaches a Pearson correlation of at least 0.991 with a mean rendering penalty of at most 0.13 dB, and the image payload survives INT8 quantization and 30% opacity pruning.
Kunal Bhosikar, Prajas Wadekar, Venkata Sai Pranav Bachina et al.
In briefA stacked hardware security controller that detects anomalous behavior in Edge AI systems with low overhead and energy use.
SummaryThis paper proposes a stacked, hardware-based security mechanism for continuous, low-overhead detection of anomalous execution patterns in Edge AI systems. It uses hardware performance counters and physical sensors, isolated as a tamper-resistant root of trust. Experiments show that adversarial or malicious applications cause observable deviations in sensor and thermal readings, and that hardware-based detection remains effective with low overhead.
In briefDefending Post-Quantum Cryptography Against Side-Channel Attacks Using 3D Shielding
SummaryThis paper notes that post-quantum cryptography (PQC) algorithms, though resistant to quantum attacks in theory, remain vulnerable to side-channel attacks in practical implementations. The authors propose a defense based on 3D integration, which uses stacked hardware for physical shielding and introduces decoy keys to conceal cryptographic activity. The approach can complement masking and shuffling and involves moving Number Theoretic Transform (NTT) computations to dedicated chips. Its effectiveness is validated against a generic attack targeting intermediate computations within an NTT butterfly.
In briefUsing a Bounded Application-Security Ontology at the Point of Change to Identify Obligations for Code Changes
SummaryThe paper presents a use case for AppSec Core, a bounded application-security ontology, to make security guidance actionable at the point of code change. Scattered requirements from secure-development frameworks, verification standards, controls catalogues, and regulations such as NIS2 are organized into a typed working set of control objectives, practices, mechanisms, and evidence artifacts, each traceable to its source. The authors describe two entry points: starting from a code change, or from a normative obligation such as NIS2 compliance. The same working set serves both human engineers and LLM-based assistants.
In briefBlind spots of detection: attacks on watchdogs in distributed LLM inference
SummaryThis paper examines how a malicious node in decentralized large language model inference can sabotage generation while staying within the numerical tolerance used for verification. The authors introduce Hush-Up, which adds adversarial perturbations to output activations to raise the end-of-sequence token probability and force premature termination. The paper reports that this attack can also cause existing defenses to miss the sabotage or wrongly blame honest workers.
WhyThe authors report a stealthy attack that uses adversarial perturbations within benign error bounds to halt distributed LLM inference and evade watchdog detection across models and benchmarks.
In briefPop Goes the Verifier: A Stealthier Data Poisoning Attack on Voice Liveness Detection
SummaryThis paper examines data poisoning attacks against voice liveness detection (VoicePop) used in automated speaker verification systems. The earlier SyntheticPop attack leaves visible artifacts in waveform energy, making it easier to detect. The authors propose a stealthier phoneme injection method that uses FastSpeech 2 and a modified HiFi-GAN vocoder to insert pop bursts at plosive phonemes, with subtle Gaussian noise added to reduce visibility. Evaluated on ASVSpoof 2019, the approach achieves moderate poisoning while resisting signal-level inspection better than the original SyntheticPop attack.
In briefVeilFL: Two-Stage Accountability for Anonymous Federated Learning
SummaryThis paper presents VeilFL, a two-aggregator protocol that extends PINE (USENIX Security '24) with staged accountability for anonymous federated learning. It detects duplicate submissions within a round, and after confirmed faults, a threshold committee can link misconduct to a stable handle while accepted submissions stay unlinkable. The prototype reports a median of 2.11 ms to create a submission and 3.01 ms to verify it.
In briefTimestamp reliability in malware data: first-seen date estimation
SummaryThis paper examines whether machine learning can estimate when an executable was first seen, or detect unreliable PE/COFF compile timestamps, using the EMBER2024 dataset. The authors evaluate feature-based and raw-byte models and find that direct first-seen regression errors are large and cannot replace externally sourced metadata. Classifiers, however, can identify timestamps within set tolerances of first-seen dates and detect clearly implausible ones with high discrimination.
