Cryptography & Security · Wed, Nov 11, 2026

arXiv Cryptography and Security (cs.CR) and the IACR Cryptology ePrint Archive.

RSS feed
arXiv cs.CR · cs.SE

How Well Do SAST Tools Work Across Languages? An Empirical Study Using OCPP Implementations

In briefHow Well Do SAST Tools Work Across Languages? An OCPP Case Study

SummaryThis paper evaluates how well static application security testing (SAST) tools detect issues across programming languages, using twelve OCPP 1.6 implementations for electric vehicle charging stations, each written in a different language. The authors applied SonarQube, Semgrep, and language-specific analyzers. Reported issues ranged from two in Rust to 1,689 in Java, which the authors attribute likely to differences in the maturity of SAST tool ecosystems rather than inherent code quality.

Zachary Wadhams, Emma Sheppard, Dalton Arford et al.

arXiv cs.CR · cs.DB · cs.LG

MammothDP: Private Boosted Decision Trees Ready for Trusted Hardware and Leakage-free Hyperparameters

In briefMammothDP: Privacy-Protected Boosted Decision Trees for Trusted Hardware

SummaryThe paper presents MammothDP, a machine learning system built on the gradient boosted decision tree learner S-BDT for protecting sensitive tabular data, such as in the European Health Data Space. It runs on a trusted execution environment (TEE) with timing side-channel hardening and is provably differentially private when used within a privacy filter. To improve the privacy-utility tradeoff, the authors introduce an early stopping criterion that selects the number of trees without privacy overhead, and an improved rollback protection that resists timing side-channel attacks.

Moritz Kirschte, Thorsten Peinemann, Kari Kostiainen et al.

arXiv cs.CV · cs.CR Open resources

Location Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion Personalization

In briefLocation Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion Personalization

SummaryThis paper introduces SEAL, a method that protects face photos from being used by diffusion models to learn and reproduce a person's identity. SEAL modifies only 5% of spatial locations in a facial image, using a differentiable top-k masking scheme and a variance-based objective on the frozen VAE encoder's latent distribution. Experiments on CelebA-HQ and VGGFace2 report protected-image quality exceeding 41 dB PSNR, 0.97 SSIM, and at most 0.07 LPIPS, with identity similarity reduced to at most 0.15 after personalization.

Shuting Yang, Shuxin Li, Linyan Dai et al.

arXiv cs.CR

Model-Based Authoring of SOC Simulation Exercises for Cybersecurity Education

In briefModel-based method for creating SOC simulation exercises for cybersecurity training

SummaryThis paper presents a model-based method for authoring virtual Security Operations Center (SOC) exercises for cybersecurity education. A technical and educational specification is used to build an incident exercise model, and a large language model generates selected scenario text based on it. The method was implemented in a Virtual SOC prototype and evaluated with a phishing-to-ransomware reference exercise, where a separate validator checked references, ordering, evidence links and assessment completeness. The resulting exercise package ran in the Virtual SOC learner environment, indicating the approach is feasible.

Felix H\"arer