In briefShortcuts and Boundaries: Verifiable RL Misalignment and Contextual Safety Learning
SummaryThis paper studies reward-driven misalignment in reinforcement learning, where agents learn executable shortcuts that earn more reward than compliant strategies. The authors build diverse interactive environments at scale that encode these reward-context conflicts and derive compliance feedback from execution histories. They report that even a minority of conflict exposure can lead to widespread shortcut acquisition, and that a simple binary penalty from contextual checks partly mitigates violations. The learned safety also transfers to unseen tasks with changing evidence requirements, raising safe completion rates.
In briefTUTTI: Fast Parallel CKKS Bootstrapping on CPUs
SummaryThis paper introduces TUTTI, a new CKKS bootstrapping method with lower multi-threaded latency than previous low-latency solutions. It builds on SPRU with improved parallelism and message handling, and includes a refined security analysis of LMSS block-binary secret keys. Reported results show TUTTI bootstrapping 4096 real-number messages in 46 to 83.4 ms on 192 threads, and a single message in 4.6 ms on 32 threads, faster than TFHE-rs at 7.3 ms.
In briefSuppression Is Not Erasure: Analysis of LoRA Backdoor Defense Reactivation Limits
SummaryThe paper examines defenses that project LoRA adapter weights onto estimated backdoor subspaces to remove hidden triggers. A rank-1 trigger-difference projection drives static attack success to 0%, but the authors show that five-sample few-shot fine-tuning reactivates the backdoor in nearly all evaluated weight-editing defenses. They conclude that low static attack success does not mean the backdoor parameters have been erased.
In briefDeepChronos: Time-Aware Neuro-Symbolic Reasoning for Detecting Multi-Step Cyberattacks
SummaryThis paper presents DeepChronos, a neuro-symbolic network intrusion detection system that combines learned flow-level evidence with explicit attack-phase rules, temporal prerequisites, and previously inferred phases. Instead of detecting events first and correlating them later, it lets the evolving attack history guide each detection decision. Evaluated on DARPA 2000 and AIT-LDS V2, it improves macro F1 over purely neural baselines by up to 11.3%, eliminates causal violations under strict temporal constraints, and keeps inference latency at the millisecond scale.
Sofia Burkow, Andrea Agiollo, Enkeleda Bardhi et al.
In briefA paper on checking distributed energy resource commands against grid operating context to catch credentialed attacks that static checks miss
SummaryThe paper observes that authorization of distributed energy resource (DER) commands relies on the sender's identity and whether a value has been seen before, so an attacker with valid credentials writing ordinary values can pass. The authors propose judging each DER write against grid operating context, including nearby bus voltages, hour, day-ahead price, system load, and irradiance, compared with operator writes under similar conditions in the feeder's benign history. They evaluate the approach on the IEEE 123-bus and 8500-node feeders against nine attack scenarios.
In briefMaurer-Inspired Two-Way Physical-Layer Authentication Against Multi-Antenna Impersonation
SummaryThis paper proposes a two-way physical-layer authentication scheme inspired by Maurer's approach, where Alice must authenticate herself to Bob in the presence of a multi-antenna impersonator, Trudy. Bob and Alice add artificial noise to their transmissions so that Trudy cannot predict Bob's fresh randomness. For quasi-static Gaussian MIMO channels with TDD reciprocity, the authors derive missed-detection bounds for attacks that replace the challenge, the response, or both. With equal antenna numbers at all nodes, they show cases where the scheme achieves lower worst-case missed detection than specified one-way tests.
Pin-Hsun Lin, Linda Senigagliesi, Eduard A. Jorswieck
In briefHow Far Second-Order Linear Response Predicts Quantization Error: Pre-Registered Tests on Five Language Models
SummaryThis paper tests whether a fast screen based on the unquantized model's Fisher information and a second-order expansion can predict the KL divergence caused by weight quantization. Across Qwen3, OLMo-2 and other models using int8, fp8 and int4 formats, relative predictions hold consistently while absolute predictions are less reliable. The authors also trace prediction errors from bf16 gradient computation to arithmetic in the backward pass, which fp32 removes, and build a screener that predicts well on the unseen Mistral-7B-v0.3 family.
In briefBounded delegation for runtime protection reconfiguration in RISC-V microcontrollers
SummaryThis paper addresses runtime changes to protection policies in microcontroller-based embedded systems, where existing mechanisms do not limit what policy an authorized domain may create. It proposes an ownership-aware model that uses explicit ownership and rule containment to bound configuration authority and recursive delegation. An open-source RISC-V World Checker integrated into a CVA6-based SoC shows no drop in access latency or operating frequency, with 7.1% LUT and 1.2% FF overhead for eight rules. In an over-the-air update case study, direct reconfiguration reduces policy-transition latency by 89.5% compared with hypervisor mediation and 94.6% compared with trusted firmware mediation.
Lu\'is Cunha, Jos\'e Martins, Manuel Rodr\'iguez et al.
In briefDouble-Blind Evals: A Method for Mutually Confidential AI Safety Audits
SummaryThis paper proposes "double-blind evals," a method that keeps an evaluator's test prompts hidden from the model owner while also protecting the owner's model weights and inference code. It uses secure enclaves that encrypt data in RAM at the hardware level. In a pilot, the authors evaluated Google DeepMind's proprietary Gemini 2.5 Flash Lite against part of the private AILuminate benchmark, running on an NVIDIA H100 secure enclave on Google Cloud Platform with OpenMined's PySyft.
In briefStealthy system identification under timing limits: a simple static model and how detectable it is
SummaryThis paper studies how an attacker can learn the dynamics of a cyber-physical system while trying to avoid detection. It proposes a lightweight static linear model in which the time to complete a setpoint change is proportional to the commanded speed difference, and tests it on a Siemens PROFINET testbed. The model captures the drive's ramp response well but misses the terminal overshoot, and that transient is where the attacker's residual is detected by two anomaly monitors. The authors argue that the stealth limit for this model class is tied to the plant's own settling transients under the detector calibration used.
Victor Mattos, Guilherme Sobreira, Amit Bhaya et al.
In briefText2NGAC: multi-LLM pipeline extracting NGAC access policies with mutation-tested verification
SummaryThe paper presents Text2NGAC, a pipeline of cooperating large language models that converts natural-language access-control policies into NIST Next Generation Access Control (NGAC) graphs. It disambiguates each sentence, escalates uncertain ones to a multi-model ensemble, and checks the extracted graph with a five-strategy verifier whose effectiveness is measured by controlled mutation testing. The authors claim it is the first system to extract all four NGAC relationship types from real-world policy documents.
WhyThe authors report the first extraction of all four NGAC relationship types from real policy documents, with mutation-tested verification and 97.3-99.6% accuracy across corpora.
In briefHidden in Plain Sight: Register-Renaming-Based Privacy-Enhanced Computing
SummaryThis paper introduces HPS-PEC, a method that achieves privacy-enhanced computing by reusing existing CPU register renaming and register file infrastructure with minor architectural changes. Across 25 VIP-Bench benchmarks using a 7-cycle QARMA-64 cipher, encrypted code runs at 3.41x the execution time of unprotected native code (geometric mean). It is 1.26x faster than a Sequestered Encryption unit while using under a third of its dedicated area.
In briefML Models Are Not Ciphers: Why Power Analysis Struggles to Extract Model Weights
SummaryThis paper asks whether power-analysis attacks from cryptography can reveal the secret weights of machine-learning models. It challenges the approach of treating models as ciphers and examines recovering all layers of fully trained networks, assuming an idealized adversary who observes leakage without noise. The authors find that limited-precision floating-point arithmetic, low-diffusion linear operations, and the reduction of data entropy in models make weight recovery, especially in deep layers, require unexpectedly many traces.
Mohammed Qaiss, Peter Horvath, Michal Shagam et al.
