In briefKeeping the Flaw, Silencing the Alert: Testing CodeQL Taint Tracking with Natural Rewrites
SummaryThe paper tests how robust CodeQL's JavaScript taint tracking is to natural rewrites that keep a vulnerability intact. A large language model, without knowing the analyzer's internals, rewrote one function on each reported flow, and the flaw survived while the alert disappeared for 26.2% of 172 real npm flows. All silencing rewrites trace to seven gaps at the library-modeling boundary, and many also fool other taint analyzers. The authors conclude that a vanished alert is weak evidence that a vulnerability has been fixed.
WhyThe authors test CodeQL taint tracking with vulnerability-preserving rewrites on 172 real npm flows, silencing 26.2%, traced to seven library-modeling gaps and cross-checked on other analyzers.
In briefCapLite: Blocking prompt injection in small AI agents without trusting model-written security rules
SummaryThis paper studies defenses against prompt injection, where malicious text tricks an AI agent into harmful actions. Existing enforcement methods ask the agent's own model to write security policies that code then enforces, and the authors find that small models often write flawed policies. They propose CapLite, which derives its policy from tool schemas and only allows write actions whose target details appear in the user's request. In 13,935 attacked AgentDojo episodes, no attack succeeded, with utility under attack comparable to CaMeL at much lower token cost.
In briefA paper on cryptographically non-linear all-or-nothing transforms, cryptographic building blocks that hide all input data unless the full output is known.
SummaryThe paper studies unconditionally secure all-or-nothing transforms (AONTs) that are cryptographically non-linear. It enumerates small (t,3,3) AONTs computationally and shows that non-additive AONTs exist. It also presents a general method for building non-additive AONTs from linear ones using coordinate-wise symbol permutations. The non-linearity of the resulting instances is measured with differential Δ_F-uniformity and Walsh magnitude, with theoretical conditions and statistical results given.
Anantajeet Devaraj (1), Navid Nasr Esfahani (1) ((1) Toronto Metropolitan University)
In briefGRID-MRI: Assessing Power System Resilience Against Coordinated Cyber-Physical Attacks
SummaryThis paper proposes GRID-MRI, a multidimensional index that measures power system resilience by combining disruption severity, coordination effects, and climatic and economic-regulatory conditions. The framework is applied to a modified IEEE 39-bus system under three escalating cyber-physical attack scenarios inspired by a December 2025 Polish cyberattack. Results show that coordinated attacks cause system collapse, with resilience losses 3.72 and 4.09 times their additive estimates, indicating that simple additive assessments are insufficient.
In briefOptimal Tokenization Disambiguation for Secure Linguistic Steganography
SummaryThe paper addresses a flaw in provably secure linguistic steganography, where ambiguous tokenizations prevent the receiver from extracting the hidden message reliably. The authors prove that a single-history receiver must give up stop entropy, and they propose coin projection, a closed-form scheme that reaches this bound. Experiments on English, Chinese and Japanese show that coin projection retains 91-93% of string entropy and converts 2.16 to 6.85 times more entropy into message bits than SyncPool.
WhyThe authors prove a single-history receiver must give up stop entropy, and present a closed-form coin projection scheme attaining this bound, compared against SyncPool on English, Chinese, and Japanes
In briefNonSense: A study on whether FPGA anti-tamper sensors can be trusted
SummaryThis paper examines on-chip sensors that FPGAs use to detect physical attacks such as glitching and trigger responses like key zeroization. The authors argue these sensors are a fragile, underexplored attack surface, and show that their detection and response mechanisms can be bypassed without invasive tampering. They also discuss how power delivery network behavior, temperature, and long-term aging reduce sensor reliability, and propose countermeasures to harden these mechanisms.
Mehmet Ali Cetin, Fatemeh Khojasteh Dana, Saleh Khalaj Monfared et al.
In briefInfrastructure for verifiable AI: where proof costs come from and how hardware can help
SummaryThis paper examines how users of AI services, including large transformer-based language models, can verify that computation follows its declared procedure without exposing private models or data. The authors propose a four-layer framework linking verifiable AI workloads, proof systems, cryptographic kernels and hardware platforms, and measure six provers and seven kernels. They find that the dominant proof cost varies with the proof system and input length. They conclude that effective hardware acceleration depends on matching the choice of hardware and proof-system optimizations to the cost profile of the target workload.
In briefBounds on the share of edited watermarked text
SummaryThe paper addresses how much of a corpus comes from a watermarked language model, a question watermark detectors do not directly answer. For Gumbel-max and KGW green-list watermarks under unknown editing, it derives a power envelope from a least-favourable next-token distribution and sequential coupling, governed by retention, entropy and substitution budgets. It gives identified sets and finite-sample bounds on the share of a fixed corpus. In resampling trials on OPT-1.3B and Qwen3-1.7B text, the bounds mostly covered, but coverage is sensitive to null calibration error.
In briefAnonymous in Name Only: Critical Review and Reidentification Test of EU Google Search Data Anonymization
SummaryThis paper examines anonymization measures the European Commission proposed in July 2026 for Alphabet's Google Search data, which must be shared with competing search engines under Article 6(11) of the Digital Markets Act. The authors argue the residual risk assessment, suppression thresholds, and reliance on contractual safeguards have significant conceptual flaws. Using real Google Search data, they demonstrate low-effort reidentification, record linkage, and confidential attribute inference. They conclude the measures fail all three anonymization criteria set by the European Data Protection Board and should not be treated as sound practice.
David S\'anchez, Benet Manzanares, Josep Domingo-Ferrer
In briefMaturity²: Evaluating How Mature Crypto Agility Maturity Models Are
SummaryThis paper evaluates three industry-driven crypto agility maturity models, which help organizations prepare for cryptographic transitions such as migration to post-quantum cryptography. The authors assess the models against established design principles and find recurring weaknesses, notably the lack of measurable, reproducible assessment criteria and limited prescriptive guidance. The paper also highlights individual strengths of the models and offers concrete recommendations for improving future crypto agility maturity models.
Leonie Wolf, Robin Leander Schr\"oder, Sebastian Schinzel et al.
In briefSTEALTH: A hidden-message method that works across different computer hardware
SummaryThis paper presents STEALTH, a method for hiding secret messages in text generated by a language model, so the text looks like ordinary model output to anyone without the key. The authors show that existing provably secure schemes often fail to decode messages when the receiver's precision, quantization, or GPU differs from the sender's. STEALTH uses keyed pseudorandom noise for token sampling together with a rateless spinal code decoded by beam search to tolerate these differences. The paper reports that every test message was decoded across precisions, smaller models, a different GPU, and different model families, and that trained steganalyzers and a targeted statistical test could not distinguish its stegotexts from honest output.
In briefBatch, Pack, and Prove: More Efficient Verifiable Computation for CKKS
SummaryThis paper addresses verifying the integrity of encrypted computations in the CKKS homomorphic encryption scheme. It introduces a more efficient arithmetization, BatchFold (a polynomial commitment supporting batched evaluations), a packing technique that removes the O(N) range-proof overhead, and SparsePack for proving sparse polynomial evaluations. The authors report proofs several orders of magnitude smaller and faster than prior approaches on a generic neural network architecture.
Ignacio Cascudo, Anamaria Costache, Daniele Cozzo et al.
