In brief"Look It Up": Multi-bit LLM Watermarking Using Codebook Search
SummaryThis paper proposes a codebook-based watermarking method for attributing short LLM-generated texts to their source. An n-bit payload is mapped to a longer u-bit codeword, embedded during generation through token-level logit biasing, and recovered by finding the nearest codeword in a secret codebook using Hamming or Levenshtein distance. Experiments report near-perfect recovery of 16 to 24-bit payloads on 200-token generations and strong results on 127-token generations from base models.
Jaros{\l}aw Janas, Pawe{\l} Morawiecki, Josef Pieprzyk
In briefFaster private decision-tree evaluation on encrypted data using signed dyadic path encoding
SummaryThis paper proposes a signed dyadic path-sum encoding for privately evaluating decision trees over TFHE, where a server classifies an encrypted query without learning its input. The method packs the two children of each leaf-parent into one test polynomial, reducing programmable bootstrapping operations from the number of leaves to the number of leaf-parents. The authors extend the approach to gradient-boosted ensembles and report reduced latency on UCI benchmarks at depths 1 to 4 without accuracy loss.
In briefMobileProbe: Adaptive Security Testing of Phone-Operating AI Agents via Trajectory-Aware Injection
SummaryMobile GUI agents operate phone apps for users by reading the screen, so attackers can hide malicious instructions in ordinary interface content to redirect them. This paper proposes MobileProbe, a red-teaming framework that automatically finds attacker-controllable content, locates vulnerable decision points along an agent's execution path, and iteratively refines context-aware attack payloads. The authors built a benchmark of 83 long-horizon attack instances across 12 mobile apps, each labeled with a confidentiality, integrity, or availability goal. Tested on three representative agent architectures, MobileProbe achieved higher attack success rates than human-written, zero-shot LLM, and adapted prior automated baselines.
In briefCrossPloit: A Benchmark for Moving Web Exploit Proofs Across Python Versions
SummaryThis paper introduces CrossPloit, a benchmark of 127 instances across 45 CVEs in Python web applications, testing whether a proof-of-concept exploit for a listed version can trigger the same vulnerability on an earlier, unlisted version. Benchmark construction identified 149 vulnerable prior versions missing from the affected-version lists of four databases, 127 of which require migration. Across 18 agent configurations, the best resolved 58.3% of instances versus 8.7% for an adapted baseline, while attack-vector shift cases were hardest, with no configuration exceeding 37.9%.
Hung Nguyen-Huu, Nguyen Anh Tuan, Ting Zhang et al.
In briefSmall Decision Models in a Harness Find Memory-Safety Flaws at Scale on Consumer GPUs
SummaryThis paper asks whether small open-weight decision models can support large-scale vulnerability discovery in open-source C and C++ software. A deterministic harness selects projects and localizes suspicious code, and the 4B-parameter Intern-Decision-4B model scores and ranks candidate functions rather than making final accept or reject decisions. On 75 public CVEs, the fixed function reached its repository's top 25 in 21% of cases, about 1.4 times the rate of random ordering. The campaign confirmed 187 memory-safety findings, with 12 rated critical under worst-case CVSS v3.1.
Tim De Wachter, Kyryl Volkov, Myrto Eleftheria Gkogkou et al.
In briefGame-theory study of RIS-assisted challenge-response physical-layer authentication, Part I: perfect channel knowledge
SummaryThis paper studies a physical-layer authentication setting where a user Alice communicates with an authenticator Bob through a reconfigurable intelligent surface controlled by Bob, while an attacker Trudy tries to impersonate Alice by precoding her messages. Under perfect channel knowledge, the authors model the joint RIS selection and precoder design as a finite zero-sum game, deriving exact channel subspace conditions for attack indistinguishability and equilibrium mixed strategies. Simulations in geometric and 3GPP UMi-NLOS channels show that authentication performance depends on spatial degrees of freedom, channel correlation, and SNR, and that the proposed strategies balance rate and security better than conventional benchmarks.
Anna V. Guglielmi, Linda Senigagliesi, Marco Baldi et al.
In briefVerifiable approximate nearest neighbor search in outsourced vector databases
SummaryThis paper addresses how to verify the integrity of approximate nearest neighbor (ANN) search results when vector databases are outsourced to third-party clouds, where untrusted providers might return suboptimal or fabricated results. The authors propose VIDA, which replaces raw vector transmission with compact vector commitments and uses an aggregated Inner Product Argument to verify multiple distance computations efficiently. They also introduce MeST, a topology-aware authenticated data structure, and a quantization-aware strategy that uses distance bounds for pruning. Experiments report up to a 6.6× end-to-end latency speedup and up to 99.2% reduction in data transfer time compared with state-of-the-art methods.
In briefHow to Defeat a Mafia of Size 1: A Provably Optimal Strategy for the Detective in a Social Deduction Game
SummaryThis paper studies the social deduction game Mafia, in which players try to identify a secret coalition among them, with one non-coalition player acting as a Detective with special abilities. The authors analyse the case with one mafia member and one detective. They describe an explicit strategy that is provably optimal, providing a first such example beyond the case without a Detective.
In briefBait: A defense against harmful agentic reinforcement learning by probing the reward function
SummaryThe paper shows that safety alignment of a large language model can be fully undone through harmful agentic reinforcement learning run via a service API, at a cost of about $20. The authors propose Bait, a defense that proactively probes the reward function to block learning from harmful rewards. Experiments indicate Bait still allows learning from benign reward functions, and analysis suggests an adaptive attacker aware of Bait cannot perfectly subvert it.
WhyThe authors expose a safety vulnerability in agentic RL services and propose Bait, a defense probing the reward function; experiments report mitigation of harmful learning.
Tiansheng Huang, Ananth Balashankar, Virat Shejwalkar et al.
In briefReliaGuard: Reconstruction-Aware Watermarking for Tracing Image Sources and Locating Edits
SummaryThis paper presents ReliaGuard, a watermarking framework for identifying the source of generated or edited images and locating edited regions without a reference. The writer embeds keyed features into both the protected image and its variational autoencoder reconstruction, while the reader uses only the received image and a secret key to predict an edit mask. On an independent test set of 300 source images and 900 editing cases from three image domains, edit-region IoU reaches 85.61% for complete outputs and 94.90% for locally spliced outputs, with identifier-bit accuracy at 100% in both conditions.
In briefSEC: A Secret Sharing Scheme Giving Each Participant One Short Share
SummaryThis paper introduces SEC, a ramp secret sharing scheme built from lossless bipartite expander graphs, aimed at lattice-based distributed cryptography. Each participant receives exactly one share regardless of the number of parties or thresholds, and shares and reconstruction vectors have bounded coefficients. The authors define hard-core local leakage resilience and prove SEC satisfies it under the MatrixHint-MLWE problem.
Muhammad Arzaki, Muhammed F. Esgin, Amin Sakzad et al.
In briefOptimal feature selection for firewall log analysis using machine learning and hybrid metaheuristics
SummaryThis paper proposes bee swarm optimization with Q-learning-based local search (QBSO-FS) to select features for classifying firewall logs in the UCI Internet Firewall Data Set. The method is paired with random forest, k-nearest neighbor, and Bernoulli naive Bayes classifiers. Using a leakage-free split into training, validation, and test sets, random forest with 7 selected features on deduplicated data reaches 99.90% accuracy and 94.88% Macro-F1. Evaluation over multiple splits is left as future work.
In briefPolicySniff: a side-channel attack that infers an LLM agent's approval-policy setting from shared-GPU timing
SummaryThe paper presents PolicySniff, a method by which a co-resident attacker on the same GPU infers which approval-policy setting an LLM agent is using, by timing only its own GPU kernels. On an eager sparse mixture-of-experts runtime, it identified the deployed setting with 94.17% balanced accuracy. The authors conclude that behavioral compliance does not imply configuration confidentiality, so operators should measure distinguishability on their serving runtime and enforce authorization outside the model.
WhyThe authors show GPU-sharing timing side channels can infer an LLM agent's approval policy, reporting 94.17% balanced accuracy on a sparse MoE runtime.
In briefFault injection attacks on Q-learning: how hardware glitches can break reinforcement learning and how to defend it
SummaryThis paper analyzes how hardware fault injection attacks, using voltage and clock glitching on a ChipWhisperer platform, affect five Q-Learning variants. Standard implementations are corrupted during both learning and inference, and the Robust variant still retains injected NaN and infinite values. The Resilient variant, using triple modular redundancy with majority voting, corrects corruption in a single Q-table copy but leaves shared inputs such as the reward and the voting code unprotected. In a traffic light control simulation, a single injected infinite value degraded accumulated vehicle waiting time by 148x, while triple modular redundancy corrected the faults injected in the tests.
In briefCoordX Types: A Trustless, Swappable Type System for Shared Records
SummaryThe CoordX Protocol verifies who wrote each signed, encrypted entry and whether they had permission, but it does not define what entries mean. This paper presents the CoordX type system, which assigns meaning through short documents that specify how to read parts of a shared record. Types are signed objects fixed by their digest, and each party evaluates them independently over verified entries, so no trust in a server or other party is required. A type names its intended interpreter, allowing several interpreters to coexist within one record.
In briefIntent-aware protection for AI agents: using deployed purpose as a security reference
SummaryThe paper notes that existing defenses mainly detect prompt injection or harmful outputs and cannot tell whether an AI agent still serves its deployed purpose. The authors propose Intent-Aware Security, defining Intent Preservation and Intent Drift through an Intent Profile built from organizational, role, and developer intent. They present an 887-sample benchmark across 35 agents and four profile-based protections, which outperform profile-free baselines on their evaluations.
WhyThe authors treat trusted agent intent as a security object, define intent drift, and report gains over baselines on their benchmark and AgentDojo trajectories.
In briefHiding Targets in 6G Sensing Using Environmental Scatterers
SummaryThis paper examines security threats in 6G integrated sensing and communication (ISAC) systems, noting that existing methods mainly reduce a warden's parameter-estimation accuracy rather than hiding a target's presence. The authors propose endogenous target covertness, which uses known objects, ambient backscatter devices, and reconfigurable intelligent surfaces as ghost targets to make the true target hard for a warden to detect. The legitimate base station can still extract the true target's response using prior knowledge of the scatterers. A case study shows that target covertness can be achieved without dedicated jamming power, and open research challenges are outlined.
In briefHiding Targets from Wireless Sensing Detection Using Reconfigurable-Antenna Reflectors
SummaryThis paper introduces low probability of target detection (LPTD) as a security goal for wireless sensing, aiming to conceal a target's existence from passive wardens. The authors deploy reconfigurable-antenna reflectors around the target as artificial scatterers, adjusting their reflection coefficients to mask the target's echo. They analyze the warden's optimal detection strategy, derive false-alarm and missed-detection probabilities, and give a closed-form minimum total detection error probability. Numerical results show that sufficient reflector cooperation raises this error probability to about 0.94 to 0.96, close to random guessing.
In briefOptimal integer masks limiting one-guess attacks under a mask-cost budget
SummaryThe paper studies the average one-guess success probability of an adversary who observes the integer sum of a finite-support secret and an independent integer mask, with the mask's absolute moment bounded. For a uniform secret on an interval, the exact optimum and an explicit optimiser are obtained. For a biased bit, the paper characterises masks that do not increase success over the prior baseline, determines their minimal cost, and gives the full cost-vulnerability frontier for every bias.
WhyThe authors exactly characterise the cost-vulnerability frontier of additive integer masks, showing infinitely many piecewise-linear pieces accumulating at a critical cost, for uniform and biased-bit
In briefStudy of privacy leakage from recurrent state in LLM inference
SummaryThis paper studies how personalized LLM services compress private context into fixed-size recurrent state that can still be inferred after public dialogue. The authors probe partial states and observe GPU power during inference across released hybrid models. They find that private facts and personal attributes can be recovered and can change later decisions, and that whole-device power can reveal information such as age.
WhyThe authors extend recurrent-state privacy leakage to persistence and GPU power side channels, reporting probing experiments and an unprivileged age inference on a partitioned GPU, affecting serving a
In briefAuditing feature attribution for network intrusion detection by restricting queries to protocol-valid network states
SummaryThe paper argues that feature-attribution methods can query network states that violate protocol rules, so explanations and their evaluation depend on model behavior outside the operational domain. The authors formalize this as domain blindness and prove that a procedure confined to a declared rule-valid set returns the same attribution when models agree on the required information within that set. They apply a protocol-aware query-control principle to LIME, SHAP, Integrated Gradients, and DeepLIFT and audit these configurations across four network intrusion detection datasets and three classifier families.
Emmanuelli El-Mahmoud, Abanisenioluwa Kolawole Orojo, Pablo Rivas et al.
In briefExtra Privacy Cost of Geometry in Distance-Sensitive Filters: ℓ∞ versus ℓ2
SummaryThis paper studies how much extra differential-privacy cost a set representation incurs beyond exact membership when it must accept nearby points and reject distant ones in a metric space. It gives lower bounds that apply to every mechanism, showing an extra cost of Θ_c(d) in ℓ∞ for c<3, which confirms a recent conjecture. In ℓ2 the extra cost is Θ_c(min(d, ln(1/α))), so partition-based constructions are optimal in ℓ∞ but not in ℓ2.
WhyThe authors give lower bounds for all private distance-sensitive set representations, separating ℓ∞ (Θ(d)) from ℓ2 (Θ(min(d, ln(1/α)))) and introducing a single-large-ball mechanism.
In briefDUFT: Device-unique feedback traversal for generating authentication responses from SRAM PUFs
SummaryThis paper proposes DUFT (Device-Unique Feedback Traversal), a seed-based, multi-round feedback mechanism built on SRAM physical unclonable functions to produce measured responses. The feedback chain is driven by the device's stable and unstable bit positions and a device key hashed from the SRAM array. The authors report reaching an estimated 128 bits of min-entropy on their reference hardware, and use the mechanism in a lightweight authentication and key-encapsulation protocol evaluated on physical IoT and embedded hardware.
In briefPrivacy-protecting obfuscation of spectrum data for next-generation spectrum sharing systems
SummaryThis paper studies how to protect privacy when partially disclosing primary user spectrum usage in spectrum coexistence systems. It shows that naive randomized subset disclosures can leak spectrum information through inference that exploits temporal structure. The authors design structure-aware obfuscation schemes for Markovian and periodic usage dynamics that disrupt inference, and report that these schemes significantly hinder recovery of spectrum information.
Yalin E. Sagduyu, Tugba Erpek, Sastry Kompella et al.
In briefBeyond the Diff: VulSpot, a vulnerability dataset that locates every vulnerability
SummaryVulSpot is a continuously refreshed benchmark for detecting, classifying, and localizing software vulnerabilities. It contains over 500k functions in 21 languages, drawn from 24k registered CVEs, including over 15k vulnerable C/C++ functions. By linking code added by a patch to the existing statement it protects, it locates the vulnerability in 99.3% of functions that earlier diff-based datasets could not localize. It also reports how reliable each label is, offers leak-free splits and hierarchical CWE labels, and is updated automatically every month.
In briefBMRaccoon: Lattice-Based Blind Multi-Signatures for Post-Quantum Security
SummaryThis paper presents BMRaccoon, the first lattice-based post-quantum blind multi-signature scheme, allowing a user to obtain a compact signature on a hidden message from multiple signers. Its two-round signing protocol is secure under concurrent sessions, and its signatures are compatible with Raccoon. The authors also introduce MRaccoon, a Raccoon-based multi-signature scheme, and prove its strong unforgeability in the random oracle and KOSK models.
WhyThe authors present the first lattice-based post-quantum blind multi-signature and first Raccoon-based multi-signature, with security proofs under AOM-MISIS and MSIS and concrete parameters.
Keerthi Aiswarya Varshini, Kanchan Bisht, Palkesh Jain et al.
In briefSharper Noise Bounds for Polynomial Evaluation in BGV Homomorphic Encryption
SummaryThis paper presents the first average-case noise analysis for the BGV fully homomorphic encryption scheme that accounts for correlations from secret and public keys as well as dependencies between ciphertexts. The authors propose new variance estimates for noise in homomorphic additions and multiplications and extend the framework to polynomial evaluation. Their estimates match experiments within 1.2 bits, and they use them to select smaller initial ciphertext moduli than those in OpenFHE and HElib.
WhyThe authors present the first average-case noise analysis for BGV accounting for key and ciphertext dependencies, extending it to polynomial evaluation and smaller moduli.
In briefHidden Image Attacks: Recovering Secret Content from Deep Hiding Models
SummaryThis paper examines whether an attacker can identify what a hidden image depicts without knowing which model concealed it. The authors built a dataset from 11 deep hiding models and trained a single decoder that extracts secret content from unseen models, recognizable by both humans and machines. The attack also works on out-of-distribution secrets, multi-image hiding, and exposes private content hidden by AIRPNet.
WhyThe authors show a single decoder extracts hidden secrets across 11 deep hiding models, strengthened via frequency-guided training, with implications for steganographic privacy.
