Cryptography & Security · Mon, Nov 9, 2026

Brief introduction to post-quantum cryptography in industrial applications

In briefA short guide to post-quantum cryptography for industrial use

SummaryThis paper reviews how post-quantum cryptography (PQC) is being adopted in industries including IoT, healthcare, civil infrastructure, and defense. It gives a self-contained introduction to PQC and its market position, and reports implementation experiments on selected quantum-safe methods, including the quantum resources needed to break common schemes. The authors also discuss the quantum-attack resistance of different PQC classes and the status of PQC implementations across programming languages. Benchmark results for KEM and signature algorithms are provided to help choose an algorithm based on performance, data lifetime, and sensitivity.

Mateusz \.Zarski, Jaros{\l}aw Miszczak, C\'edric Crettaz et al.

Detecting Shadow AI: Unsanctioned LLM Agents on Enterprise Endpoints: A Taxonomy, an Open Detector and a Controlled Evaluation

In briefDetecting Shadow AI: Finding Unapproved AI Agents on Company Computers

SummaryThis paper examines unapproved autonomous AI agents used inside organisations, a problem it calls shadow AI. It proposes a taxonomy of nine agent classes and six layers of endpoint traces, and presents Agent Detector, an open-source Windows tool that combines service identity with configuration, installation and execution history. In a controlled test, behaviour-only rules flagged every benign look-alike program, while Agent Detector flagged none and detected agents in most runs.

Jeremy Canale, Fabien Soulis

An Agile Homomorphic Encryption and ML-KEM Scheme for Privacy-Preserving Health Data Processing

In briefA flexible encryption scheme combining homomorphic encryption and ML-KEM to protect health data during processing

SummaryThis paper addresses privacy concerns in storing and processing health data by proposing an agile cryptographic scheme that combines ML-KEM, a post-quantum key-encapsulation standard, with BGV, a fully homomorphic encryption scheme. The scheme is designed for efficient implementation in embedded use cases. The authors describe their parameter selection and demonstrate feasibility with a proof-of-concept implementation.

Daniel Resende (SAS-ENSMSE), Nadia El Mrabet (SAS-ENSMSE), Ulrich K{\"u}hne (IP Paris et al.

An Explicit Below Half Threshold Bound for the Local Leakage Resilience of Shamir's Secret Sharing Scheme

In briefA Explicit Bound for Shamir's Secret Sharing Under Local Leakage

SummaryThis paper studies how many shares Shamir's secret sharing scheme over prime fields needs to resist arbitrary 1-bit local leakage from each party. The authors show that for sufficiently large n and any prime p greater than n, the (n,t) scheme is exp(-Ω(n))-resilient whenever t/n is at least 0.489, for any distinct nonzero evaluation points. The proof refines dual-code list recovery analysis and combines complementary Fourier estimates based on the support sizes and biases of the leakage functions.

Cheng Zhang, Xin Wang, Xiangliang Kong

Public, Identifiable, and Effectively Immutable: Ethical Lessons from Research on arXiv

In briefPublic, identifiable, and practically permanent: ethics lessons from arXiv research

SummaryThis paper examines the ethical issues raised by research that analyzes arXiv source files, which arXiv distributes publicly, often to the surprise of authors. The authors identify four higher-level dilemmas researchers may face with such data. They distill four lessons: public availability is only the starting point of ethical reasoning, research should limit amplification of exposed information, disclosure should match the harm and actionability of findings, and effective immutability must be considered.

Jan Pennekamp, Johannes Lohm\"oller, Peter Mayer et al.

Lessons Not Learned: Why Cross-Chain Bridges Keep Losing Billions the Same Way

In briefLessons Not Learned: Why Cross-Chain Bridges Keep Losing Billions the Same Way

SummaryThis paper catalogues cross-chain bridge hacks from 2021 to 2026 and finds that security posture failures, involving people, code, controls, and off-chain infrastructure, account for 88% of reported losses since 2023, with nearly all repeating earlier failures. The authors propose a bridge security assessment rubric that scores each deployment from on-chain evidence and caps the score at the lowest value when a fatal risk exists. They also build analyzers that apply the rubric to deployed bridges and monitor them for changes.

Mohsen Ahmadvand (Monad Foundation), Piotr Dobaczewski (Monad Foundation), Camille Bouzerand (Monad Foundation)

SNAPRAG: Cost-Efficient Knowledge Extraction Attack on RAG Systems via Adversarial Perturbations

In briefSNAPRAG: A low-cost attack that extracts RAG knowledge bases using adversarial perturbations

SummaryRetrieval-Augmented Generation (RAG) systems pull information from external knowledge bases to improve LLM responses, but repeated querying can let attackers extract much of that private data. This paper proposes SNAPRAG, a cost-efficient extraction attack that generates adversarial queries algorithmically without external LLMs and under a configurable query budget. It uses a discrete token-mutation algorithm in a strict black-box setting and adaptive dissimilarity threshold calibration to reach unexplored semantic regions. The authors report needing up to 6.77 times fewer queries to extract half the knowledge base, recovering up to 96.9% within a fixed budget, and remaining the leading attack against four of five active defenses.

Melih Co\c{s}\u{g}un, Mehmet Emre G\"ursoy, Alptekin K\"up\c{c}\"u et al.

GPU-Accelerated Non-Interactive Encrypted Neural Network Training with Batched Diagonal Packing

In briefGPU-accelerated encrypted neural network training using batched diagonal packing

SummaryThe paper presents a Rust implementation of CKKS homomorphic encryption for training neural networks, with training and bootstrapping ciphertext arithmetic running on the GPU. On the main MNIST model over 100 updates, training time falls from 14,268.295 to 293.075 seconds, a 48.68 times speedup over the authors' CPU implementation, with identical decoded parameters and predictions. A separate GPU run of ten passes over 4,800 images reaches 90.35% test accuracy against 90.41% for the plaintext twin. Parameter agreement is verified only at 100 updates, and comparisons with the ReBoot baseline are conditional.

Kentaro Mihara

FALC: An Artifact-Centric Life Cycle Model and Research Agenda for AI Forensics

In briefFALC: A model of AI forensic evidence across the AI life cycle and a research agenda

SummaryThe paper introduces the Forensic AI Life Cycle (FALC), a model that focuses on the forensic artifacts produced during an AI system's life cycle rather than on the life cycle stages themselves. From it, the authors derive a reference list of artifacts useful to investigations and collect crime examples involving AI along with likely investigative questions. They also propose a taxonomy of forensic fields based on whether established techniques can currently analyze these artifacts.

Adrian Johannes Staeves, Mayur Rattan Jaisinghani, Rebekah Overdorf et al.

A Privacy-Preserving UAV-Assisted Secure Wireless Communication and Computing System Based on Fully Homomorphic Encryption

In briefA UAV-assisted system that performs encrypted computation on wireless data to protect privacy.

SummaryThis paper proposes a UAV-assisted secure computing framework that combines CKKS fully homomorphic encryption with multi-party secure computation to protect the computation process over wireless channels. The UAV separates key distribution from encrypted computation, supporting encrypted weighted aggregation, encrypted matrix multiplication, and encrypted decision tree inference. Experiments report better time and space efficiency than BFV, BGV, and SHE schemes for certain operations, along with high numerical precision for weighted aggregation.

Quanxi Zhou, Wencan Mao, Ye Tao et al.

Harness Matters: Measuring and Dissecting Security Resilience in Web Agents

In briefHarness Matters: Measuring How Execution Frameworks Shape Web Agent Security

SummaryThis paper studies how the execution harness of web agents affects their security. The authors divide harnesses into four stages (goal interpretation, webpage perception, reasoning and planning, and action execution) and build WebTrap Farm, an evaluation framework covering malicious user prompts, malicious prompt injection, and deceptive web design. The results show that existing harnesses remain vulnerable to typical attacks, and that both the harness and the backend model significantly influence security outcomes.

Xinyi Wu, Jiagui Chen, JiaYi Dong et al.

Spectral Unlearning: Transformer Structure-Preserving Updates for Language Models

In briefSpectral Unlearning: Structure-Preserving Weight Updates for Language Models

SummaryThis paper addresses machine unlearning in large language models, which aims to remove specific knowledge or behaviors while keeping the model useful. The authors propose spectral unlearning, which combines standard unlearning objectives with matrix-structured optimization that respects the matrix form of transformer weights. They show that the spectral update matches the steepest-descent direction for transformers built from linear layers with normalized inputs and outputs. Evaluated on memorization, privacy, and utility via their harmonic mean, the method consistently outperforms baselines and closes most of the gap to a retain-trained reference.

Sung Il Choi, Junhao Cai, Dohun Kim et al.

Scaling Adaptive Prompt Injection Attacks with Agent Swarms

In briefResearch on scaling adaptive prompt injection attacks using agent swarms

SummaryThis paper studies prompt injection attacks against AI agents. The authors build a synthetic evaluation dataset that uses random non-malicious actions as adversarial goals, to measure whether models respect instruction hierarchy. They show that a more capable agentic attacker can reliably get models to follow instructions embedded in tool output, including models previously considered robust on public benchmarks. The authors argue that frontier defenses may need proactive, automated red-teaming.

Alexey Kurakin, Vishal Karande, Alex Bie et al.

VeilTune: Secure Fine-Tuning of Private LoRA Adapters on Public Pretrained Language Models

Explanation and summary in progress

Huiyu Xie, Tanping Zhou, Tao Hu et al.

Ultrasound-Assisted Biometric Watermarking Against Face Video Deepfakes

In briefUltrasound-based biometric watermarking to defend facial videos against deepfakes

SummaryThis paper proposes UltraGuard, a biometric video watermarking method that protects facial videos from deepfakes in real time. It uses a smartphone's built-in speaker and microphone to emit ultrasonic signals and capture biometric features, which are fused with spatio-temporal dynamic features of the video and embedded as a watermark. The authors report that the approach can defend against forgery and editing attacks both at the source and during propagation, and suggest it could be deployed on users' mobile devices.

Guodong Liu, Lei Wang, Dongxu Liu et al.

Advantage Distillation in Paired-State Quantum Key Distribution

In briefAdvantage Distillation for Paired-State Quantum Key Distribution

SummaryThis paper studies advantage distillation for paired-state Loop-Back quantum key distribution, linking a fixed optical station with a portable terminal. It uses two independent public parity checks on a minimal connected graph to select consistent blocks of three two-bit records, and derives acceptance probabilities, residual-error laws and retention rates. A modular security theorem bounds the extra guessing advantage an adversary can gain after syndrome disclosure and block acceptance.

Luis Adri\'an Lizama-P\'erez, Jos\'e Mauricio L\'opez-Romero

ShadowBench-MCP: Measuring Shadow Invocations in MCP-Style Tool Routing

In briefShadowBench-MCP: Measuring hidden risky tool calls in LLM routing

SummaryThis paper studies how LLM agents acting as tool routers can be steered, through task-preserving request variants, onto riskier execution paths that skip safety tools such as validation, provenance, or audit. The authors introduce ShadowBench-MCP, a benchmark and metric suite that combines task-preservation, operational-pressure, and route-drift measures into a pre-execution score. In a single-router policy ablation, efficiency-first routing showed a 29.2% shadow-invocation rate, while policy-aware routing reduced it to 4.2%. The authors present these as early evidence from one router rather than a claim of universal vulnerability.

Eyhab Al-Masri, Wenjun Yang

Using the Planted Clique Conjecture for Cryptography: Public-Key Encryption from Planted Clique and Noisy k-mathsfLIN Over Expanders

In briefPublic-key encryption built on the planted clique conjecture and noisy k-LIN over expanders

SummaryThe paper presents a public-key encryption scheme that is provably secure against polynomial-size adversaries. It relies on the standard planted clique conjecture at hardness level n^{log^α n} for any α in (0,1), together with a milder conjecture about noisy k-LIN over expanders. Both conjectures are average-case versions of NP-complete problems studied for decades. The scheme answers an open question posed by Applebaum, Barak, and Wigderson at STOC 2010.

Riddhi Ghosal, Isaac M Hair, Aayush Jain et al.

Attack Injection to Vehicle Reactions: Extensible Closed-Loop Adversarial Evaluation Framework

In briefInjecting attacks into vehicle messages to study how traffic reacts

SummaryThis paper presents an extensible closed-loop adversarial evaluation framework built on the VaN3Twin traffic and wireless network simulator. It adds 76 configurable attack profiles, adapted to European Telecommunications Standards Institute (ETSI) message formats and organized into nine suites, along with a labelled dataset. Evaluation shows that attacked messages drive vehicle reactions, which can then influence other vehicles through subsequent unmodified messages.

Mohamed Gaber, Tahsin Wahid, Mohammad Mamun et al.

PRISM: Causal Counterfactual Minimization of Agent Tool Privileges via Information Bottleneck Role Induction

In briefPRISM: Trimming AI Agent Tool Permissions via Causal Counterfactuals and Information Bottleneck Roles

SummaryThis paper applies role engineering to large language model agents rather than human users, addressing over-authorization when agents receive full tool privileges through the Model Context Protocol. PRISM tests whether each tool is necessary for a task using sandbox interventions, compresses agent trajectories into discrete roles via an information bottleneck, and sets the role count at the knee of the rate-distortion curve. Pruning is cast as a bilevel Stackelberg game solved with a generative flow network. On AgentDojo, τ-bench and ToolEmu, PRISM reduces authorized tools per role by 78.3%, reports a 78.2% task success rate, 88.7% counterfactual necessity accuracy, and a 15.9% blast radius.

Yang Luo, Qingni Shen, Tairui Wang et al.

Robust and Private Swarm Learning via Zero-Knowledge Validator Admission and Consensus Aggregation

In briefRobust, private swarm learning with zero-knowledge validator admission and consensus aggregation

SummaryThe paper proposes a swarm learning framework where validators must first pass a zero-knowledge attestation showing a reference model ran correctly on their private data, without revealing samples. Admitted validators reach Byzantine fault-tolerant consensus on gradient masks and quality-based aggregation weights. Across four non-IID benchmarks, the method matches FedAvg on clean data and, under a gradient-scaling attack, retains 94% of clean accuracy on CIFAR-100 and over 99% on FashionMNIST, where FedAvg reaches 2.1% and 11%.

Marco Arazzi, Mert Cihangiroglu, Antonino Nocera

Coding Agents Propagate Vulnerabilities in Code Bases

In briefStudy on whether AI coding agents copy existing security flaws into new code

SummaryThis paper examines whether LLM-based coding agents introduce vulnerabilities similar to those already present in a code base. The authors test 96 backend implementation tasks and 20 pairs of repository-level C/C++ tasks. They find that insecure existing code leads agents to write vulnerable code more often, with agents using existing flaws as templates.

Chenhao Sun, Niels M\"undler-Sasahara, Mark Vero et al.