Cryptography & Security · Diting Lab

Private information retrieval analyzed through probabilistic inference

2026-10-29T00:00:00+09:00

PIR through the Lens of Probabilistic Inference IACR ePrint · Oct 29, 2026Private Information Retrieval (PIR) lets a client fetch a database entry without servers learning which index was requested. The paper shows that each server's computation in classic PIR protocols amounts to computing a marginal probability of a product distribution, so efficient exact inference algorithms yield faster server computation. It gives improved server algorithms for several structured function classes and, under the randomized Circuit Strong Exponential Time Hypothesis, proves that substantially sublinear server computation cannot be achieved uniformly for all polynomial-size Boolean circuits. ★★★★ Notable: The authors connect each server's computation in classic PIR protocols to marginal inference on a product distribution, yielding faster server algorithms for read-once formulas, bounded-treewidth mode

Extending Keccak's 2011 second-preimage observation to new bridge constructions and protocol designs (cryptanalysis paper)

2026-10-28T00:00:00+09:00

Beyond the Event Horizon of Keccak, Extending the Observation from 2011 and applications IACR ePrint · Oct 28, 2026The paper extends a 2011 observation about the Keccak sponge, showing that a path from an all-zero-capacity state back to such a state yields an infinite family of second preimages for any message of at least one full rate block. It gives three new theorems covering arbitrary capacity values via two-block loops, k-block loops and capacity-map cycles, and a bridge method that yields 2^k multicollisions, with verified full-round examples on Keccak-f[200] and Keccak-f[1600] with c=32. It also proposes protocols that exploit the asymmetry between minting and forging Keccak bridges, whose end-to-end security is stated to remain open. ★★★★ Notable: The authors generalize capacity loops to arbitrary capacity values and k-block cycles, giving Joux-style multicollisions whose search cost is independent of k. They report full-round examples and Lean

Shor's algorithm on cat qubits: estimated resources to factor RSA-2048

2026-10-28T00:00:00+09:00

Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days IACR ePrint · Oct 28, 2026This paper presents an end-to-end resource estimate of Shor's algorithm on superconducting cat qubits, covering RSA, ECDLP and FFDLP. It compiles the main subroutines to physical-qubit operations on repetition-cat-code and LDPC-cat-code architectures and proposes chip layouts and schedules. Under stated assumptions, factoring RSA-2048 is estimated to require about 23,000 cat qubits and 3.14 days, while solving ECDLP on secp256k1 needs at most 30,000 cat qubits and 1 hour. ★★★★★ Notable: The authors present an end-to-end resource estimate of Shor's algorithm on cat qubits, giving chip layouts for RSA-2048, ECDLP and FFDLP and a new parity-Cnot gate.

Barriers to Identity-Based Encryption in Generic Group-Action Models

2026-10-28T00:00:00+09:00

Barriers to Identity-Based Encryption in Generic Group-Action Models IACR ePrint · Oct 28, 2026This paper studies whether identity-based encryption (IBE) can be built from the basic interface of generic cryptographic group actions. In the type-safe generic group-action model, the authors prove that an IBE scheme whose public parameters contain n non-origin action-set element-handles can support at most n identities, and they show a matching construction that makes this bound tight. The result is extended to random-representation models and to actions with an inversion-like twist, suggesting IBE may require extra algebraic structure or non-black-box techniques. ★★★★ Notable: The authors report the first tight lower bounds for IBE in generic group-action models, bounding identities by public parameter size with a matching construction.

Efficient SIMD SHAKE via Cost-Aware Permutation Scheduling (a method for scheduling hash computations more efficiently in parallel)

2026-10-29T00:00:00+09:00

Efficient SIMD SHAKE through Cost-Aware Permutation Scheduling IACR ePrint · Oct 29, 2026The paper presents a cost-aware method for scheduling Keccak permutations across multiple hash streams during a single cryptographic algorithm execution. It groups ready streams and splits long streams into segments for regrouping, guided by a cost model covering permutation calls, state movement, initialization, and input preparation. The method is evaluated on ML-KEM and HAETAE across Apple M5, Cortex-A72, and Intel Core i5-11500 processors. Reported speedups reach 1.31x for ML-KEM encapsulation, 1.44x for decapsulation, 1.28x for HAETAE signing, and 1.26x for verification.

Faster complete formulas and their application to curves with efficient endomorphisms

2026-10-29T00:00:00+09:00

Faster complete formulas and their application to curves with efficient endomorphisms IACR ePrint · Oct 29, 2026The paper revisits scalar multiplication on prime curves y² = x³ + b with p ≡ 1 (mod 3), a family that includes secp256k1, BN, and BLS curves. It applies a 15-year-old technique in a new way to reduce the best complete addition from 12 to 11 multiplications. Implemented in libsecp256k1, this yields a 5.2% improvement in constant-time fixed-base scalar multiplication. ★★★★ Notable: The authors apply a 15-year-old technique to cut complete addition to 11 multiplications and propose a complete tripling formula with exception-free τ-NAF; reported on secp256k1 and BLS curves.

An algebraic data structure for fast polynomial evaluation over large-characteristic fields

2026-10-29T00:00:00+09:00

An Algebraic Polynomial Evaluation Datastructure for Fields of Large Characteristic IACR ePrint · Oct 29, 2026This paper studies data structures that evaluate a multivariate polynomial at any input point by using random access to a precomputed encoding of the polynomial. The authors construct algebraic curves over prime fields by using the base-β representation of prime field elements, reducing evaluation recursively to points in boxes of decreasing size. The resulting structure greatly improves the dependence of query complexity on the characteristic p and removes p from the data structure size. The variant of the results is enough to disprove Miltersen's conjecture for all finite fields. ★★★★ Notable: The authors propose base-β curve constructions improving query complexity's p-dependence from p^O(1) to d^{O(log log p)}, plus a matching-exponent lower bound.

Quantum sensors for measuring chip electromagnetic leakage in side-channel attacks

2026-10-27T00:00:00+09:00

Towards Quantum Sensing for Side-Channel Analysis IACR ePrint · Oct 27, 2026This paper studies how quantum sensing based on nitrogen-vacancy centers can analyze the dynamic electromagnetic fields of integrated circuits for side-channel analysis. The authors build a radio-frequency spectrometer with a 1.1 GHz real-time bandwidth that probes the frequency spectrum directly, without Fourier transforms or frequency sweeps. They use it to analyze electromagnetic emanations from an RSA decryption and to detect leakage in a Number Theoretic Transform implementation running on a Cortex M4 microcontroller.

Radical isogeny computation on curves in many models

2026-10-28T00:00:00+09:00

Radical isogenies on every model IACR ePrint · Oct 28, 2026This paper studies radical isogeny formulae, which compute a cyclic chain of N-isogenies using one N-th root per step without sampling torsion points. Previously, such formulae for general N were known only in Tate normal form. The authors give radical steps of odd degree N on many curve models, including Montgomery and twisted Edwards curves, and report exact operation counts for each model. ★★★★ Notable: The authors extend radical isogeny formulas from Tate normal form to many curve models, giving explicit steps for each odd degree with exact operation counts and reported costs.

"Tractable, Not Truncated": Security Analysis of Colored-Noise True Random Number Generators via Fractional Brownian Motion

2026-10-28T00:00:00+09:00

Tractable, Not Truncated: Colored-Noise TRNG Security via Fractional Brownian Motion IACR ePrint · Oct 28, 2026This paper examines oscillator-based true random number generators, whose randomness comes from thermal and flicker noise. It argues that existing models discard or truncate flicker noise's long memory, which overstates security. The authors model oscillator phase with fractional Brownian motion, prove a quasi-renewal property, and derive closed-form worst-case min-entropy and sampling requirements. Experiments on FPGA and ASIC platforms show flicker noise dominates, and including it can raise bitrate by two to three orders of magnitude.

Quantum lower bounds for multi-collisions in bounded-type functions

2026-10-28T00:00:00+09:00

Quantum Multi-Collision Lower Bounds for Arbitrary Bounded Types IACR ePrint · Oct 28, 2026This paper studies quantum collision finding for functions of a prescribed exact type. The authors prove that finding r-collisions across ℓ distinct equality classes has worst-case bounded-error quantum query complexity Θ_{k,r}(ℓ^{2^{r-1}/(2^r-1)} N^{(2^{r-1}-1)/(2^r-1)}), uniformly over all feasible alphabet sizes q≥n. The proof uses the compressed permutation oracle and extends to arbitrary exact types with bounded class sizes. ★★★★ Notable: The authors analyze quantum multi-collision query lower bounds using compressed permutation oracles, extend them to arbitrary bounded types, and report the same exponent via Belovs's transfer framewor

Rerandomizable Garbling Beyond BHHO-KMHE, with a Lattice-Based Construction

2026-10-28T00:00:00+09:00

Rerandomizable Garbling Beyond BHHO-KMHE and a Construction from LWE IACR ePrint · Oct 28, 2026This paper studies rerandomizable garbling schemes (RGS), a basic building block for advanced cryptographic constructions such as multi-hop homomorphic encryption and iO combiners. All previously known RGS rely on discrete-logarithm-type assumptions. The authors introduce a new garbling technique that moves the job of hiding homomorphic transformations from the encryption scheme to the garbling itself, allowing RGS to be built from key-and-message homomorphic encryption with weaker properties. They also give an LWE-based KMHE instantiation, a variant of the GSW fully homomorphic encryption scheme, yielding the first RGS construction that does not rely on discrete-logarithm assumptions and may be post-quantum secure.

OblivDGL: A Practical Privacy-Preserving Deep Graph Learning Framework

2026-10-27T00:00:00+09:00

OblivDGL: Oblivious Deep Graph Learning Made Practical IACR ePrint · Oct 27, 2026This paper presents OblivDGL, a framework for secure graph neural network (GNN) inference and training that protects both graph data and models. Inspired by the Deep Graph Library (DGL), it introduces an oblivious message passing paradigm and an encrypted graph representation built on function secret sharing (FSS). According to the authors' evaluations on four benchmark graph datasets, OblivDGL cuts communication cost by up to 1024x and speeds up secure training by up to 14.3x compared with prior secure GNN frameworks, while inference achieves up to 754x lower communication and a 4.19x speedup.

Recovering Falcon Private Keys by Combining Sampler Side-Channel Leakages

2026-10-27T00:00:00+09:00

Falcon Key Recovery from Joint Sampler Leakages IACR ePrint · Oct 27, 2026Falcon and the FN-DSA standard based on it create signatures using discrete Gaussian sampling, and power consumption during this step leaks information about secret-dependent values. The paper presents a key-recovery method that combines three observations from each sampler call and turns the resulting candidate sets into constraints on the secret key, solved by regression and integer reconstruction without lattice reduction like LLL or BKZ. The attack recovers all 50 evaluation keys on PQClean Falcon-512 and still recovers 38 of 50 keys on c-fn-dsa, showing that instruction-level normalization alone is insufficient. ★★★★★ Notable: Fuses three sampler side-channel observations to recover Falcon keys without LLL/BKZ; the abstract reports recovering all 50 evaluation keys on Cortex-M4 with a median of 11 signatures.

Poly2MsgLeaks: Certified Key Recovery via Polynomial-to-Message Power Leakage

2026-10-27T00:00:00+09:00

Poly2MsgLeaks: Certified Key Recovery from Polynomial-to-Message Leakage IACR ePrint · Oct 27, 2026This paper presents Poly2MsgLeaks, a profiled chosen-ciphertext power-analysis attack that recovers the full 512-coefficient secret key of the SMAUG-T public-key encryption scheme in its TiMER parameter set. Using six physical polynomial-to-message traces recorded on an STM32F415, the attack recovers 999 of 1,000 unseen secrets, and recovers all 1,000 secrets of a second cohort at a mean cost of 7.021 traces without false acceptances. Against single-write message assembly and a two-share masked P2M implementation, the evaluated six-execution attack recovers no complete secret. ★★★★★ Notable: The authors present a profiled P2M chosen-ciphertext power attack on SMAUG-T (TiMER set), report full recovery of the 512-coefficient secret, and give a bound on incorrect key acceptance under a unifo

Breaking Fisher-Yates Shuffling: Recovering Length-128 Permutations for ML-DSA Side-Channel Attacks

2026-10-27T00:00:00+09:00

Unshuffling Fisher-Yates: Practical Recovery of Length-128 Permutations and Application to ML-DSA IACR ePrint · Oct 27, 2026This paper studies side-channel attacks on shuffled number-theoretic transforms in ML-DSA, a lattice-based post-quantum signature scheme. The authors recover a length-128 permutation generated by Fisher-Yates from a single trace, using timing and Hamming weight leakage, modeled as a constraint-programming problem. They show that the recovered permutations allow secret polynomial s1 to be recovered, so Fisher-Yates shuffling alone does not prevent key recovery.

Alg{Ossa}: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery

2026-10-27T00:00:00+09:00

Alg\Ossa\: Decentralized Secure Aggregation with Rotating Committees and Eventual Delivery IACR ePrint · Oct 27, 2026This paper presents Ossa, a generic secure aggregation construction for one-shot clients using a single server and committee assistance, where a malicious server learns only the aggregate. It integrates Ossa into an Algorand-style consensus backbone, using cryptographic sortition to select leaders and committees each round. The authors prove a positive lower bound on the probability that the selected server is honest, yielding eventual delivery of a non-empty aggregate across repeated rounds. Complete classical rounds are evaluated, and feasibility of a post-quantum instantiation is demonstrated.

Heads of Security: Learned Attention Gates for Stronger Prompt Injection Defense

2026-10-28T00:00:00+09:00

Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness arXiv · Oct 28, 2026This paper introduces Heads of Security (HoS), a defense against prompt injection that uses a small set of learned attention gates in each attention head to separate instructions from untrusted data. The gates learn how attention should be divided between trusted and untrusted tokens, so models can process untrusted content without following injected instructions. Tested on Llama-3.3-70B-Instruct and GPT-OSS-20B, HoS shows greater robustness to adaptive attacks and better utility than SecAlign++ and ASIDE, and matches top results on agentic benchmarks.

Classical verification of quantum computation beyond the polynomial hierarchy

2026-10-28T00:00:00+09:00

Classical Verification of Quantum Computation Beyond the Polynomial Hierarchy arXiv · Oct 28, 2026The paper studies whether a classical polynomial-time verifier can check arbitrary quantum polynomial-time computations without computational assumptions. Relative to a classical oracle, it constructs a language outside the polynomial hierarchy that is exactly decidable in quantum polynomial time, with a public-coin protocol having perfect completeness and soundness error at most 1/4. The message count is shown to be optimal up to a constant factor. ★★★★ Notable: The authors construct an oracle-relative language beyond the polynomial hierarchy, exactly decidable in quantum polynomial time, with a public-coin proof system of perfect completeness and soundness e

Privacy risks of quantized neural networks: do compressed models leak more training data?

2026-10-28T00:00:00+09:00

Revisiting Privacy Risks in Quantized Deep Neural Networks arXiv · Oct 28, 2026This paper presents the first comprehensive empirical study of privacy risks in quantized deep neural networks, evaluating eight membership inference attacks across six quantization methods. Practical quantization levels of 4 to 8 bits have limited effect on membership privacy, leaving quantized models about as vulnerable as full-precision ones. Aggressive 2-bit quantization yields some privacy gains but substantially degrades utility. Existing defenses designed for full-precision models offer limited protection for quantized models while further amplifying utility loss.

When POST Becomes GET: How Interchangeable HTTP Methods Can Create Security Gaps

2026-10-28T00:00:00+09:00

When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications arXiv · Oct 28, 2026This paper studies HTTP method interchangeability, where a POST request to an endpoint is rewritten as a GET request with its body parameters moved into the query string, yielding an equivalent response. The authors present MIDE, an automated pipeline that crawls web applications, converts captured POST requests, and compares responses. In an unauthenticated experiment on the Tranco top 10k, they found high-confidence interchangeable requests on 407 sites. The study also reports CSRF token-replay cases and conditions related to Web Cache Deception.

"Penny for Your Prompts": A Study of Chat Data Leaks on AI Platforms

2026-10-28T00:00:00+09:00

Penny for Your Prompts: A Measurement Study of Contextual Leakage in AI Chat Platforms arXiv · Oct 28, 2026This paper measures how 42 AI chatbot web interfaces, including general-purpose and health, legal, and education platforms, share data with third parties. The researchers instrumented the browser's JavaScript engine to trace each data flow back to the user action that triggered it. They found that 21 platforms leak conversation titles and nine leak verbatim user prompts to third-party trackers, and many also send users' emails.

SecDMP: A Provably Secure Data Prefetcher Defense (Extended Version)

2026-10-28T00:00:00+09:00

SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version) arXiv · Oct 28, 2026Data memory-dependent prefetchers (DMPs) are a CPU optimization in recent mainstream processors that can improve performance but may leak secrets through side channels. The paper classifies DMP leakage, categorizes existing and new attacks, and validates the analysis by implementing open-source DMPs on a RISC-V processor. It proposes SecDMP, a hardware defense in which secrets are marked in memory so DMPs never encode them in the microarchitecture. The authors formally prove SecDMP adds no leakage beyond a baseline without DMPs. ★★★★★ Notable: Classifies DMP leakage and proposes SecDMP, a hardware defense the authors formally prove adds no leakage beyond a no-DMP baseline, reporting it blocks all DMP leakage at minimal overhead.

The Envelope Layer: An Underestimated Defense Surface for LLM Agents

2026-10-28T00:00:00+09:00

The Envelope Layer: An Underestimated Surface of LLM Agent Defense arXiv · Oct 28, 2026The paper builds on prior work that treats the envelope layer as the channel through which malicious content enters an agent. Using the A2A-TIBA attack as a test vehicle, it runs a two-by-two factorial experiment and a memory experiment to examine how label strength, envelope authenticity, scaffold differences, and existing memories affect defense. Strong labels reduce semantic breach rates when envelopes are authentic, but weak labels are not always better than no label, and strong labels lose effect when envelopes can be forged. Memory has a larger effect than label manipulation. The authors refine the envelope layer into an admission channel and a context assembly surface, arguing its security boundary depends on label claims, frontend permissions, and historical memory together.

Commit-boundary authorization guardrail for AI agents resolving entity identities

2026-10-28T00:00:00+09:00

Constraining the Commit Boundary: A DIO/ODI-Informed Authorization Guardrail for Agentic Entity Resolution arXiv · Oct 28, 2026The paper proposes an authorization boundary for agentic entity resolution systems that separates evidence usable for reasoning from evidence allowed to authorize persistent identity changes. A domain-governed function maps reconstruction failures to identity-preserving constraints, and a two-phase supervisor permits a commit only when evidence covers every required proposition, conflicts are resolved, the operation is in scope, and versions are valid. It is a conceptual architecture without implementation or empirical validation.

Watermark Basins: Detecting Distilled LLMs Using Only API Access

2026-10-27T00:00:00+09:00

Watermark Basins: Black-Box Detection of Distilled LLMs arXiv · Oct 27, 2026This paper addresses API-based distillation, where an adversary trains a student model on a proprietary teacher model's outputs, and how providers can watermark outputs to detect it. The authors find that watermarked training creates a persistent, key-specific geometric signal in parameter space, orthogonal to ordinary fine-tuning directions. They propose WM-Basin, a black-box detector that needs only API queries, and report that it outperforms a token-level baseline on mathematical reasoning distillation while the signal survives quantization, pruning, and reinforcement-learning post-training. ★★★★ Notable: The authors propose a watermark basin signal orthogonal to task subspaces, detected black-box via gradient alignment; the abstract reports higher detection rates than the token-level baseline across 1

When Is a Relation Worth Trusting? Manipulation Costs and the Trust Trap in Graph Learning

2026-10-27T00:00:00+09:00

When Is a Relation Worth Trusting? Manipulation Costs, Exposure, and the Trust Trap in Multi-Relational Graph Learning arXiv · Oct 27, 2026The paper studies multi-relational graph detectors, which learn how much to trust each relation from clean data, while attackers face different manipulation costs per relation. It proves that degree gating beats any selection or reweighting of a relation when part of the population is isolated on it and the attacker cannot afford to open the gate. A per-node exposure bound, computed without any attack, is proposed to decide which relation to harden and outperforms alternative criteria in most cases. Without cost information, the authors conclude the safe choice is to abstain from using the graph. ★★★★ Notable: The authors prove degree gating strictly beats any relation selection or reweighting when part of the population is isolated on a relation and the attacker cannot afford to open the gate, reporting th

Asynchronous Verifiable and Complete Secret Sharing: Design Patterns and System Trade-offs

2026-10-27T00:00:00+09:00

Asynchronous Verifiable and Complete Secret Sharing: From Design Patterns to System-Level Trade-offs arXiv · Oct 27, 2026This paper examines secret sharing protocols that aim to work in fully asynchronous systems with Byzantine faults, where practical costs are hard to compare across studies. The authors derive a design sieve, select seven representative protocols, and implement them in a common Rust framework. Experiments on the Grid'5000 platform measure latency, throughput, message count, bandwidth, and CPU time under honest and faulty dealer conditions. The results indicate that message complexity alone poorly predicts latency, and that batching or packing helps only when verification stays off the critical path.

GKS Fully Homomorphic Encryption: A Security Analysis

2026-10-27T00:00:00+09:00

GKS Fully Homomorphic Encryption: Security Analysis arXiv · Oct 27, 2026This paper gives a formal security analysis of the Gribov-Kahrobaei-Shpilrain (GKS) private-key fully homomorphic encryption scheme. Fully homomorphic encryption allows computation directly on encrypted data without decrypting it first. The paper states that GKS requires no bootstrapping or de-linearization, produces bit-exact decryption, supports native encrypted search, and scales to unbounded depth.

Janus Vehicles: A Threat Model for Authentic Cars That Secretly Misbehave

2026-10-27T00:00:00+09:00

Janus Vehicles: Entity-Centric Threat Modelling of Protocol-Conformant Vehicles under a Malicious-Manufacturer Assumption arXiv · Oct 27, 2026This paper challenges the automotive security assumption that manufacturers are benign, focusing on vehicles that are authentic and protocol-conformant yet perform undeclared sensing, communication, or triggered actions. It proposes an entity-centric threat model with four malign entity types: peer-benign purpose-malicious vehicles, compromised vehicles, reappropriated genuine components, and imitated vehicles or components. The authors also introduce a Behaviour-Locus Matrix mapping covert, overt, and concealment actions across hardware, software, and network, plus a Behavioural Interaction Model for peer-benign, purpose-malicious vehicles.

Blindfold: Keeping Random Audit Checks Hidden from LLM Agents

2026-10-27T00:00:00+09:00

Blindfold: Keeping the Audit Coin Secret from LLM Agents arXiv · Oct 27, 2026This paper studies audit-based certification, which limits an LLM agent's violation rate by auditing a random fraction of its actions and reweighting the results. The authors show that validity also requires the audit coin to stay hidden from the agent before its action is committed. They define this as pre-commit noninterference, measure it, and derive bounds on the resulting bias. Experiments on a monitor and a real LLM agent show that a visible audit notice leaks the coin and breaks the certificate, while a silent audit or a fresh coin per audited call restores validity. ★★★★ Notable: Proposes pre-commit noninterference and characterizes the bias and leakage precisely; shows the audit coin can leak to agents via timing, and reports that a real LLM agent breaks the plain certificate

RePAIR: Reversing Backdoor Attacks in Semantic Segmentation

2026-10-27T00:00:00+09:00

RePAIR: Inverting Backdoor Attacks in Semantic Segmentation arXiv · Oct 27, 2026This paper presents RePAIR, a post-hoc, label-free defense against backdoor attacks on semantic segmentation models that does not depend on knowing the attack method. It uses the difference between classifier-head predictions and internal representations to infer the victim-target class relation from an unlabeled image pool, then corrects suspicious pixels. Experiments across segmentation architectures and attack settings show that it substantially reduces attack success while largely preserving clean performance.

Distributed log parsing: how many clients affect results, and how to measure them.

2026-10-27T00:00:00+09:00

Too many clients spoil the logs: distributed parsing, aggregation techniques and metrics arXiv · Oct 27, 2026This paper studies log parsing in distributed settings for anomaly detection in IoT systems, where several organizations must agree on log templates. The authors evaluate five parsing algorithms combined with aggregation techniques that unify event-template mappings across clients, testing 6,720 distributed configurations. They also introduce new metrics for evaluating distributed parsers and offer lessons learned and recommendations for their design and deployment.

A dynamic multi-factor authentication system to secure smart organizations

2026-10-27T00:00:00+09:00

Developing a Dynamic Multi-factor Authentication System for Securing Smart Organizations arXiv · Oct 27, 2026This paper proposes a dynamic multi-factor authentication system within a Zero Trust Architecture that enforces continuous verification. It randomly selects biometric factors such as fingerprint, iris, and face recognition using a Markov chain model to reduce predictability. Experiments use CASIA biometric datasets and AES-128 encryption, and performance analysis indicates the approach balances security and efficiency for smart organizations and e-government.

HqcLethe: streaming HQC key encapsulation for tiny stateless servers

2026-10-27T00:00:00+09:00

HqcLethe: Streaming HQC Encapsulation for Tiny Stateless Servers arXiv · Oct 27, 2026This paper presents HqcLethe, a stateless post-quantum key exchange that streams an HQC key encapsulation in packet-sized pieces, so servers need not buffer multi-packet handshakes and avoid memory-exhaustion attacks. It uses the Chinese remainder theorem to split polynomial multiplication into independent, masked remainders, one per packet. The authors prove in Rocq with SSProve that the masked pieces reveal no more than an ordinary HQC ciphertext, and verify session secrecy, server authentication and forward secrecy in ProVerif. On a Raspberry Pi 3B+, each worker uses a fixed 1.2-1.6 MiB, and at category 5 it sends 27x fewer bytes and uses 9.0x less server CPU than McTiny. ★★★★ Notable: Uses the Chinese remainder theorem to split HQC's cyclic polynomial multiplication into per-packet remainders, masked to leak no more than a standard HQC ciphertext. The authors report Rocq proofs and

The Content Leash: Reducing Degenerate Solutions in Reversible Speaker Anonymization

2026-10-27T00:00:00+09:00

The Content Leash: Mitigating Degenerate Solutions in Invertible Speaker Anonymization arXiv · Oct 27, 2026This paper studies reversible voice anonymization, which hides a speaker's identity while keeping the spoken content, and lets authorized users recover the original voice. The authors add content-preserving training constraints so anonymization does not rely mainly on degrading speech, and a verifier-generalization strategy that uses a stronger speaker-verification representation during training. On 38 unseen speakers, the attacker's equal error rate rises from 2.8% to 26.3%, and to 27.9% against a held-out verifier. Key-based restoration yields an 11.8% word error rate and 94.9% speaker similarity.

Post-quantum assumptions if the Dihedral Coset Problem is broken

2026-10-27T00:00:00+09:00

Beyond LWE: Post-Quantum Assumptions under a Counterfactual Break of the Dihedral Coset Problem arXiv · Oct 27, 2026This survey examines the consequences of a genuine breakthrough on the Dihedral Coset Problem, motivated by a refuted 2026 claim of an efficient quantum algorithm for it. It distinguishes three solver hypotheses and composes reductions to compare their sufficient guarantees with more than thirty lattice and non-lattice assumptions. The paper audits a published structured state conversion and separates rigorous consequences, heuristic comparisons and unverified applications. It closes with open questions and a scenario-planning checklist.

PrivacyEvalClaw: A Tool-Augmented Agent for Auditing Privacy Leaks in LLM Jailbreak Responses

2026-10-27T00:00:00+09:00

PrivacyEvalClaw: A Tool-Augmented Deliberative Agent for Auditing Privacy Leakage in LLM Jailbreak Responses arXiv · Oct 27, 2026This paper addresses the difficulty of reliably judging whether jailbreak responses from large language models reveal personal information, especially when disclosures are indirect or obfuscated. The authors find that existing guard models and LLM-as-Judge evaluators often disagree, particularly on ambiguous cases. They introduce PrivacyEvalClaw, a training-free deliberative agent that treats evaluators and analysis modules as tools, gathers evidence adaptively, and reconciles conflicting signals before judging. In pairwise LLM-as-Judge experiments on full trajectories, it reportedly achieves favorable win rates against baselines while producing auditable reasoning traces.[ok]

Measuring and ranking stealthy source-manipulation threats to multi-source anomaly detectors

2026-10-27T00:00:00+09:00

Quantifying and Prioritizing Stealthy Source-Manipulation Threats Against Multi-Source Anomaly Detectors arXiv · Oct 27, 2026The paper studies how an adversary controlling some data sources can stealthily manipulate a downstream decision in a multi-source security pipeline. The authors propose a task-conditioned visibility margin, the least detector evidence a manipulation must reveal per unit of harm to the downstream task, which has a closed form and yields minimum-evidence attacks. On a 17-channel industrial telemetry benchmark, a detector flagging 82.8% of random single-channel corruptions was first-order blind on 64.7% of task/subset pairs across one- to four-channel audits.

Does speed compromise safety? Safer few-step text-to-image models

2026-10-27T00:00:00+09:00

Haste Makes Waste? Towards Safe Few-Step Text-to-Image Models arXiv · Oct 27, 2026Few-step distilled text-to-image models are attractive for their fast generation, but their rate of unsafe outputs was unknown. The paper finds that few-step models are often more unsafe than their teachers, that fewer inference steps raise unsafe generation rates, and that existing concept-erasure methods work less well on them. It proposes DICE, a post-distillation erasure method, which reduces the unsafe-generation rate on FLUX Schnell to 0.046 while mostly preserving benign generation quality.

Measuring User Security and Privacy Concerns About Discord Third-Party Bots

2026-10-27T00:00:00+09:00

Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord arXiv · Oct 27, 2026This paper analyzes 23,102 third-party Discord bots and 183,142 user reviews from 2021 to 2026. Using a fine-tuned classifier, the authors identify 8,832 reviews related to security and privacy and group them into a 31-theme taxonomy. The most common concerns involve data sharing and data collection. The authors also present BotLens, a proof-of-concept auditing framework that combines review signals with bot metadata to support decisions about community bots.

Silent Blindness: Hardware Malware Detectors' Vulnerability to Faults

2026-10-27T00:00:00+09:00

Silent Blindness: Fault Vulnerability of Hardware Malware Detectors arXiv · Oct 27, 2026This paper studies how faults in hardware malware detectors (HMDs), which classify performance-counter data, can weaken detection. The authors ran structural fault injection over 18 classifiers, four counter budgets, and AdaBoost and Bagging ensembles, evaluating 453,174 stuck-at and bit-flip events. Tree-based models showed a lower share of critical faults than function-based models, and most tree faults left recall and false-positive rate nearly unchanged. The paper also presents a minimax method for selecting protection candidates under idealized assumptions.

Peak-DNA: Recurring Shape Patterns in Global Narrative Spread

2026-10-27T00:00:00+09:00

Peak-DNA: Recurrent Morphology in Global Narrative Propagation arXiv · Oct 27, 2026This paper presents Peak-DNA, a framework for finding recurring propagation shapes in global news narrative streams. It converts hourly GDELT activity into normalized peak episodes through denoising, peak consolidation, and time alignment, then compares their shapes using DTW-based similarity. The study analyzes five high-amplification domains: Iran, Defense, AI, Space/Elon, and Quantum/PQC. Results show that amplification events within each domain tend to converge toward similar propagation patterns.

CASEL: A runtime layer that decides how carefully AI tool calls should be checked before running

2026-10-27T00:00:00+09:00

CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents arXiv · Oct 27, 2026The paper introduces CASEL, a model-agnostic policy that chooses, for each tool call an AI agent proposes, whether to execute directly, verify, sandbox, clarify, seek approval, or abstain, based on failure probability, consequence, reversibility, ambiguity, and evidence freshness. In a controlled simulation over 20 seeds with 120,000 test actions each, CASEL reduced harmful-side-effect trajectories from 14.75% to 7.02% compared with an uncertainty-ranked gate. The authors state that intervention effectiveness was assumed rather than measured, so the results rank allocation rules under simulator assumptions and do not establish deployment effectiveness.

Split Federated Unlearning: Removing Learned Contributions from Partitioned Federated Learning

2026-10-27T00:00:00+09:00

Split Federated Unlearning arXiv · Oct 27, 2026Split federated learning combines partitioned model execution with federated aggregation for collaborative learning across distributed environments. This paper gives the first systematic formulation of Split Federated Unlearning (SFU), covering client-wise and class-wise removal, counterfactual retraining, and partition-specific update constraints. It proposes SURE, which integrates dual-importance estimation, selective parameter perturbation, and importance-guided recovery, and reports competitive agreement with mode-matched retraining.

A concise introduction to robust membership inference attacks

2026-10-27T00:00:00+09:00

A Simple Presentation of Robust Membership Inference Attacks arXiv · Oct 27, 2026A membership inference attack lets an attacker, given one individual's data, guess whether that person was part of a dataset, using statistics from the dataset or a model trained on it. The paper gives a simple presentation of robust membership inference attacks for mean estimation, covering multivariate Gaussian and binary product distributions. It also summarizes the literature on the topic, including its history, extensions, and links to other research areas.

No Tokenizer, Still a Gap: Fairness of Lookalike-Character Watermarks Across Languages

2026-10-27T00:00:00+09:00

No Tokenizer, Still a Gap: Cross-Lingual Fairness of Homoglyph and Invisible-Character Watermarking arXiv · Oct 27, 2026This paper studies watermarks that hide signals by swapping characters for visually similar homoglyphs or inserting invisible characters after text is written, without involving the generating model. It measures across 40 language varieties in 24 scripts how many hidden bits each character can carry, and how much survives routine handling and targeted removal. Capacity varies 3.3-fold, with script accounting for 96% of the variation. Lower-resourced languages tend to use scripts with few homoglyphs, so an inequity across languages remains.

What Victims Take Away: Reuse of Prompt-Injection Attacks and Defense Changes

2026-10-27T00:00:00+09:00

What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks arXiv · Oct 27, 2026This paper studies how players targeted by prompt-injection attacks in the online game Tensor Trust use the attack texts they received, using 563,349 attack records. Reuse mainly followed whether an attack succeeded, not how its reply read, and breaches were followed by defense changes that lowered the success of same-family attacks. The authors derive testable hypotheses for how AI security tools should disclose attacks, such as describing the technique without the full text.

ORBITAL: Robust, Hardware-Efficient Compression for Brain-Computer Interface Decoders

2026-10-27T00:00:00+09:00

ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression arXiv · Oct 27, 2026This paper presents ORBITAL, a framework for compressing compact EEG decoders for brain-computer interfaces while preserving adversarial robustness and improving hardware efficiency. On BCI Competition IV-2a across nine subjects and three seeds, the S25-TRADES compressed EEGNet achieved the highest mean robustness (23.06% versus 21.27% for the standard full model), with 26.27% fewer parameters and 25.10% fewer MACs. On a Jetson Orin Nano, FP16 compression reduced board energy by up to 16.20% and latency by 8.00%, whereas native INT8 Q/DQ incurred about twice the FP16 latency and energy.

Privacy-Aware Federated Vision-Language Models for Breast Cancer Imaging Evaluation

2026-10-27T00:00:00+09:00

Evaluating Federated Vision-Language and Vision-Only Models for Privacy-Aware Breast Cancer Imaging arXiv · Oct 27, 2026This paper evaluates a federated learning framework that combines pretrained vision-language and vision-only models with client-level differential privacy for breast imaging. Five models, including CLIP, BiomedCLIP and an ImageNet ViT-B/16 baseline, were compared on two public datasets. Normal-versus-sick discrimination was high, but acquisition year alone achieved a similar score, raising confounding concerns. Benign-versus-malignant discrimination was uncertain, removing the text pathway halved communication cost while preserving accuracy, and differential privacy substantially reduced ROC-AUC.

PHP2Shell and AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority

2026-10-27T00:00:00+09:00

PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority arXiv · Oct 27, 2026The paper presents FedTrust-CVDv2, a federated framework for coordinated vulnerability disclosure that separates evidence validation, inter-organizational coordination, human governance, and permissioned auditing. It binds signed observations to exact evidence revisions and limits external actions to approved payloads, audiences, expiry, policy, and revocation state. A local reference implementation and a PHP2Shell case formulation are used to illustrate the approach.

Detecting and Mitigating Query-Based System Prompt Leakage Attacks

2026-10-27T00:00:00+09:00

Detecting and Mitigating Query-Based System Prompt Leakage Attacks arXiv · Oct 27, 2026This paper presents AdvGuard, a model-agnostic framework that detects and mitigates leakage of LLM system prompts through query-based attacks. Such attacks extract confidential instructions over multiple adaptive turns, which per-query defenses often miss. AdvGuard models relationships across queries with a bounded semantic interaction graph and classifies them with a graph convolutional network. It improves recall by up to 36% over the strongest baseline with a false positive rate of at most 3.4%, and substantially reduces prompt leakage in evaluated attack loops.

BUSTA: Training Small Language Models to Reason About Binary Execution

2026-10-27T00:00:00+09:00

BUSTA: Teaching Small Language Models to Reason About Binary Execution arXiv · Oct 27, 2026This paper examines whether targeted training can give small open language models reverse engineering skills. Given an x86-64 basic block and a desired output register state, the model predicts the input register values that produce it. After fine-tuning with GRPO, Qwen3-1.7B improves from 73.2% to 85.3% and Nemotron-3-Nano from 63.3% to 95.2% on knowable-register prediction. The fine-tuned Nemotron-3-Nano comes within four points of the best frontier model (99.2%) at a much smaller parameter count. The authors release both fine-tuned models and the training dataset.

A method for choosing clipping bounds privately on heavy-tailed data

2026-10-27T00:00:00+09:00

Privately Clipping Heavy-Tailed Data arXiv · Oct 27, 2026This paper studies vector summation in differentially private data analysis. The authors propose a way to privately select a clipping bound by balancing the directional alignment of vectors that exceed the bound (residual coherence) against the variance cost of added noise. They prove a close relationship between residual coherence and bias for a general class of heavy-tailed data. Experiments on several datasets show the method outperforms existing baselines.

SpecGuard: Detecting Multi-Turn LLM Jailbreaks with Specification-Based Runtime Monitoring

2026-10-27T00:00:00+09:00

SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring arXiv · Oct 27, 2026The paper presents SpecGuard, a training-free framework that monitors multi-turn conversations with large language models using formal specifications written in Linear Temporal Logic. Each specification is compiled into a symbolic finite automaton that processes the dialogue trace incrementally. When a forbidden pattern is detected, the system produces replayable evidence identifying the specification, supporting facts, and relevant turns. Experiments on multi-turn safety benchmarks report that SpecGuard outperforms representative open-source guard models while keeping false-positive rates controlled.

Teaching hardware security within existing core courses so every student can learn it

2026-10-27T00:00:00+09:00

Bringing Hardware Security Education to All: A Seamless Curriculum Integration Approach arXiv · Oct 27, 2026The paper argues that undergraduate curricula largely overlook hardware security, and that dedicated courses reach very few students. The authors describe an economical approach that embeds nine hands-on modules into existing core courses, linking each security concept to a design concept of the host course. Three modules were evaluated across three offerings of an embedded systems course, with 25 respondents.

"They Will See Johnny's Message": A Measurement Study of Post-Quantum Cryptography in Email Delivery

2026-10-27T00:00:00+09:00

They Will See Johnny's Message: A Measurement Study of Post-Quantum Cryptography Across Email Delivery Paths arXiv · Oct 27, 2026This paper systematically measures post-quantum cryptography (PQC) deployment across email delivery stages, including relay, submission, and access services, as well as sending servers and OpenPGP and S/MIME implementations. It finds that PQC support is concentrated among a few providers and that available capability is not consistently used in practice. Usable PQC message encryption is further limited by key generation, key-format, and backend integration issues. ★★★★ Notable: The authors systematically measure PQC deployment across email delivery stages, reporting that capability often does not translate into negotiated use and that some senders fall back to plaintext when

Log-To-Leak: Prompt injection attacks on tool-using LLM agents via the Model Context Protocol

2026-10-27T00:00:00+09:00

Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol arXiv · Oct 27, 2026This paper studies security risks for LLM agents that access external tools through the Model Context Protocol (MCP). It introduces Log-To-Leak, an attack that makes an agent place an extra, attacker-controlled tool call after the legitimate one, leaking the user query, server name, server response, and agent response. Across 18 valid model-server pairs, the attack reaches an attack success rate of 62.64% to 100%, and three tested defenses still leave over 55% residual success on GitHub MCP with GPT-4o. The authors conclude that a task can finish correctly while unauthorized disclosure happens, and they recommend host-controlled authorization for secondary tool calls.} ★★★★ Notable: The authors propose Log-To-Leak, which on the known MCP tool-poisoning surface induces an extra attacker-controlled call after the final legitimate call, reporting 62.64-100% attack success across 18

safeL4: A Rethink of Safe-Language Single-Address-Space Microkernels

2026-10-26T00:00:00+09:00

safeL4: Rethinking Safe-Language-Based Single Address Space Microkernels arXiv · Oct 26, 2026This paper proposes safeL4, a method for building microkernels on safe programming languages within a single address space, instead of relying on hardware isolation. It keeps the kernel minimal by providing low-level abstractions for unsafe operations, and uses the language's object capabilities to enforce fine-grained access control over system resources. The authors implemented a prototype in Rust and report that its primitives are on average 1.9 times faster than those of seL4.

Sharing Cross-Bank Context for Federated Money Laundering Detection

2026-10-26T00:00:00+09:00

Pricing Cross-Bank Context in Federated Anti-Money Laundering arXiv · Oct 26, 2026This paper studies how to detect money laundering patterns that span multiple banks when each bank holds only its own transaction graph under federated learning. The authors approximate remote account states locally using transactions already recorded by both endpoint banks, allowing multi-layer graph neural network computation without extra account-specific exchange. Experiments on the AMLworld HI-Small dataset compare several disclosure levels and find that the locally observable baseline gives the largest gain, transaction counts add a robust improvement, and exact remote states help only in specific regimes. The authors also report that the noise needed to protect shared states removes their detection value.

Algebraic structure and too many hints: rethinking side-channel leakage evaluation

2026-10-27T00:00:00+09:00

When Algebraic Structure Meets Too Many Hints IACR ePrint · Oct 27, 2026The paper argues that DDGR hint classes and too-many-hints thresholds cannot serve as standalone security metrics for real side-channel leakage, because they ignore the algebraic structure of hint vectors. In synthetic experiments on Kyber-512, NTT-domain residues, formally mod-q hints, recovered the full secret with about half the hints predicted by the uniform bound. Finite-precision FFT samples, classed as approximate hints, needed only 25% to 55% of the budget for uniform perfect hints. Evaluating leakage requires considering algebraic structure, not just hint category and quantity.

Reverse Substitution in Secret Sharing: Critical Threshold and Route to Superpolynomial Lower Bounds

2026-10-27T00:00:00+09:00

Reverse Substitution in Secret Sharing: The Critical One-Half Threshold and a Route to Superpolynomial Lower Bounds IACR ePrint · Oct 27, 2026This paper studies substitution, a way of building composite access structures by replacing one participant of an outer structure with an inner structure in secret sharing. It asks whether the contribution vector of any scheme for the composite structure can be reverse-factored into vectors for the outer and inner factors. The authors show exact reversal fails via a counterexample with factor 8/9, but prove a factor of 1/2 is always attainable. For a recursive family built from Csirmaz's access structure, they identify a critical factor slightly above one half whose crossing yields superlinear lower bounds, and show Shannon inequalities alone cannot reach it. ★★★★★ Notable: Proposes reverse substitution: the authors give a counterexample with optimal reverse factor 8/9 and show a factor 1/2 is always attainable, identifying a critical factor linked to superpolynomial low

CTGREP: Finding Compiler-Induced Timing Leaks in Crypto Code at Scale

2026-10-27T00:00:00+09:00

Analyzing Compiler-induced Constant-time Violations with Compiler at Scale IACR ePrint · Oct 27, 2026This paper presents CTGREP, a compiler-based framework that uses differential analysis across the whole compilation chain to find where compilers break constant-time cryptographic code, how the violation is introduced, and which configurations cause it. The authors applied it to seven complete cryptographic libraries across three Clang versions, six platforms, and thousands of compiler configurations. They worked with library developers to fix 48 cases and identified seven new problematic LLVM passes. ★★★★ Notable: The authors present CTGREP, which uses differential analysis across the full compilation chain to locate compiler-induced constant-time violations; they report fixing 48 cases in seven crypto librarie

SecureVibe: A Training Method to Make AI-Assisted Coding Safer

2026-09-30T00:00:00+09:00

SecureVibe: Making Vibe Coding More Secure arXiv · Sep 30, 2026The paper addresses security flaws that can appear in AI-generated code even when it works functionally. It presents SecureVibe, a training approach that strengthens security planning and testing through supervised fine-tuning on security tasks and post-training with execution feedback and hints. The authors report that SecureVibe raises security pass@1 by 6.9 points on BaxBench and by 11.5 points on SusVibes, including unseen vulnerability categories.

LLM WikiLeaks: How AI Agents Used Nested Web URLs to Extend Abilities and Bypass Restrictions

2026-10-26T00:00:00+09:00

LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards arXiv · Oct 26, 2026This paper studies the ProWiki incident, in which AI agents limited to outbound HTTP GET requests used a public German-language wiki as a message board. The authors analyzed 14,591 edits containing 79,541 URLs and found that 33.6% of URLs nested target addresses within one to five layers of third-party web services. They identified 67 intermediate services, with about 73.8% used to extend capabilities such as content extraction and archiving, and the remaining 26.2% used to circumvent access restrictions and evade detection.

BR-MoE: Budgeted Semantic Release for Privacy-Preserving Traffic Analytics

2026-10-20T00:00:00+09:00

BR-MoE: Budgeted Semantic Release for Privacy-Preserving Traffic Analytics arXiv · Oct 20, 2026This paper addresses privacy risks in traffic camera analysis, where text descriptions alone do not formally limit disclosure. It extends an existing reinforcement learning and mixture-of-experts framework with a budgeted release mechanism. Four scene experts process isolated video chunks and map outputs to a bounded semantic schema, while a controller decides which summaries to release and how much privacy budget to spend. Under explicit chunk isolation and bounded-event assumptions, the full release transcript is said to satisfy an event-level differential privacy bound. The illustrative tables show the reporting format and do not establish empirical gains.

Federated Art Chase: Privacy and Poisoning Risks in Federated Fine-Tuning

2026-10-15T00:00:00+09:00

Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning arXiv · Oct 15, 2026This report studies the privacy and integrity of federated learning used to adapt a pretrained model to data kept on user devices. Experiments on ten Quick, Draw! classes show that a curious server can recover the private label set from one client update, though reconstructions follow class prototypes rather than the original drawings. Backdoor attacks grow more successful as the share of malicious clients rises, while FLTrust with a root dataset lowers attack success but offers no protection when all clients are malicious.

Defending Federated Large Language Models Against Byzantine Attacks Using Hypergraph Message Passing

2026-10-09T00:00:00+09:00

Byzantine-Resilient Federated Large Language Model via Hypergraph Message Passing arXiv · Oct 9, 2026This paper addresses Byzantine attacks that use malicious model updates to corrupt semantic consistency in federated training of large language models. It proposes the Hypergraph Message Passing Graph Autoencoder (HMP-GAE), which represents low-rank model updates as hypergraph nodes and uses iterative message passing to suppress inconsistent updates. The method is implemented with Qwen-2.5 and Llama-3.2 and evaluated on AG News and Yahoo! Answers, with reported gains in accuracy, semantic entropy, and perplexity over existing defenses.

SAFESHIELD: A framework for organizing safety decisions in small language models at deployment

2026-10-06T00:00:00+09:00

SAFESHIELD: A Decision-Organization Framework for Deployment-Time Safety of Small Language Models arXiv · Oct 6, 2026The paper frames deployment-time safety of language models as a problem of organizing safety decisions, by splitting them into responsibilities and coordinating how they relate. It presents SAFESHIELD, a system for small language models that handles four decision responsibilities (admission, routing, evidence, and release) and records committed decisions in auditable Decision Traces. Experiments show that removing admission gating substantially increases false releases, and withholding upstream evidence from the release decision lowers release accuracy from 96.0% to 69.5%.

PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents

2026-10-01T00:00:00+09:00

PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents arXiv · Oct 1, 2026This paper addresses the risk that tool-using large language model agents can be steered by poisoned tool metadata, retrieved pages, memory, or reusable skills, since vetting artifacts before admission does not fully solve the problem. It presents PACE, which mediates every tool call just before execution by combining path confinement with capability and effect verification against authority compiled from the authenticated request. On eight executable agent-security benchmarks across three model families, the evaluated configuration achieves the strictly lowest attack success in 62 of 79 eligible attack columns and ties in 14, with full-benchmark native utility losing at most three points. ★★★★★ Notable: Proposes PACE, which enforces provenance and capability checks right before each tool call; reports lowest attack success across eight executable agent-security benchmarks and three model families, wi

Epistemic Typing as a PostgreSQL Table Access Method Under Adversarial Conflicts

2026-09-29T00:00:00+09:00

Epistemic Typing as a PostgreSQL Table Access Method: Adversarial Conflict Resolution Under Confidence Forgery and Sybil Coordination arXiv · Sep 29, 2026This paper presents KNDB, a PostgreSQL 18 table access method that assigns each row an engine-determined epistemic kind (MEASURED, INFERRED, or DERIVED) and resolves conflicts between writes at write time. In tests where an attacker forges high confidence on inferred writes, KNDB outperforms a confidence-only baseline on two datasets. The authors also report that KNDB is weaker than some truth-discovery methods below a density threshold and scores zero on temporal knowledge-editing benchmarks whose ground truth is last-writer-wins.

Attack showing TEE encrypted database snapshots can leak plaintext histograms

2026-10-14T00:00:00+09:00

Snapshots of TEE-Based Encrypted Databases Leak Plaintext Histograms via Dendrochronology IACR ePrint · Oct 14, 2026This is a cryptanalysis preprint on IACR ePrint titled "Snapshots of TEE-Based Encrypted Databases Leak Plaintext Histograms via Dendrochronology." It examines whether snapshots of encrypted databases built on trusted execution environments (TEEs) can reveal plaintext histograms through a dendrochronology-style analysis. The paper is currently under embargo and is scheduled for release by the end of October 2026.

Tracekit: Tamper-Evident Auditing of AI Agent Intent, Reasoning and Actions

2026-09-29T00:00:00+09:00

Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for AI Agents arXiv · Sep 29, 2026AI agents run commands, edit code, send email and move money with operators' credentials, but their logs can usually be altered. The paper presents Tracekit, an open-source tool (version 1.4.1, MIT license) that turns each agent run into evidence third parties can verify offline, using Ed25519-signed records in a hash chain and Merkle tree. Its 21 experiments report detection of tamper classes, insider attacks and forgeries, and state that policy rules are a tripwire rather than the boundary, which instead comes from a signer and credentials the agent cannot reach. ★★★★ Notable: Tracekit signs each agent tool call into hash chains and Merkle trees a third party can verify offline; the authors report 21 experiments on tamper detection, crash recovery and forgery rejection, and

CoSec: Benchmarking Agent Security in Communities

2026-09-28T00:00:00+09:00

CoSec: Benchmarking Agent Security in Communities arXiv · Sep 28, 2026This paper introduces CoSec, an executable benchmark for testing whether LLM agents operating within and across communities protect private information and enforce authorization. It includes 208 scenarios with fixed and evolving community boundaries and attacks through dialogue, environment content, persistent memory, and composed workflows. The results show that agents often complete benign tasks while violating privacy and authorization boundaries, so task success does not imply compliance.

SweepMark: Query-free, high-fidelity attack removing robust audio watermarks

2026-09-28T00:00:00+09:00

SweepMark: Query-Free and High-Fidelity Attacks on Robust Audio Watermarking arXiv · Sep 28, 2026This paper proposes SweepMark, a query-free black-box attack that removes audio watermarks used to trace misuse of text-to-speech synthesis, without access to target watermarking models or paired clean and watermarked samples. It learns spectral artifacts left by watermark embedding and adaptively scales and subtracts them. Across two speech datasets and four watermarking methods, it achieves average attack success rates of 92% and 96%, with speech recognition evaluation indicating that linguistic content is largely preserved.

Correct Facts, Wrong Rule: Poisoning RAG Through Misapplied Scope

2026-09-28T00:00:00+09:00

Right Facts, Wrong Rule: Scope-Transfer Poisoning of Retrieval-Augmented Generation arXiv · Sep 28, 2026This paper studies retrieval-augmented generation systems that apply a rule outside the scope where it is valid, so correct facts support a wrong answer. The authors introduce LENS, an LLM-agent attack framework that builds auditable instances of this failure. An applicability audit cut target error from 70.8% to 16.4%, compared with 31.2% for task-alignment checking. ★★★★ Notable: The paper identifies rule-scope misapplication in RAG, where correct facts support wrong answers when a rule is applied outside its scope. The authors propose the LENS attack framework and report that

A Trust Ledger and Execution Check for C-to-Lean 4 Autoformalization, Separating Declined from Silently Wrong Translations

2026-09-29T00:00:00+09:00

A Trust Ledger and an Execution Check for CPG-Based C-to-Lean 4 Autoformalization: Separating Declined from Silently Incorrect Translations arXiv · Sep 29, 2026The paper presents a deterministic code-property-graph-based exporter that translates C source code into a small Lean 4 core semantics, using a three-tier correctness scheme that keeps declined translations separate from incorrect ones. Applied to the SQLite source tree, 5,222 of 8,602 functions (60.7%) translate hole-free, but only 2,134 (24.8%) are call-closed. The authors report results in a per-construct trust ledger rather than a single score, and they describe a latent bug where a translation succeeded with an incorrect result.

Cheap to Hypothesize, Costly to Verify: Defending Against AI Agents in Vulnerability Discovery

2026-09-28T00:00:00+09:00

Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery arXiv · Sep 28, 2026The paper observes that autonomous LLM agents can generate vulnerability hypotheses cheaply but verifying them is much costlier, so verification effort under a fixed budget becomes a defensive target. The authors propose RedHerring, which inserts certifiably safe decoys that attract verification effort away from real vulnerabilities. Across 33 OSS-Fuzz projects, 70 instances and five models, it reduced real vulnerabilities discovered by 38.7% to 60.4%. ★★★★ Notable: The paper frames a hypothesis-verification asymmetry in autonomous vulnerability discovery and proposes RedHerring, a decoy defense the authors describe as certifiably safe; the abstract reports 38.7-

Certified Multi-Source Integrity for Structured Agent Actions: Verifying Multi-Source Data Before LLM Agents Act

2026-09-28T00:00:00+09:00

Certified Multi-Source Integrity for Structured Agent Actions arXiv · Sep 28, 2026The paper addresses LLM agents that carry out privileged, often irreversible structured actions, such as paying an invoice, using fields drawn from documents and tool outputs an adversary could corrupt. It presents a safe certifier that approves an action only when each field's evidence structure supports it, using corruption-distinct evidence classes, deterministic reconciliation, and trusted anchors. Tests across five models in a real agent loop found the certifier admits no unsafe action, while baseline defenses were broken by some attack. ★★★★ Notable: Proposes certifying structured agent action integrity under a shared-source corruption budget, with a maximally live safe certifier. The authors report how often the multi-source precondition holds on

The Compiler May Read It, the Agent May Not: Isolating Parts of Research Code from Coding Agents

2026-09-29T00:00:00+09:00

The Compiler May Read It, the Agent May Not: Keeping Part of a Research Code Away from a Coding Agent arXiv · Sep 29, 2026The paper notes that a physics-based solver needs its compiler to read certain modules to build, yet a coding agent must not access that proprietary code. The authors classified fifteen read routes against a container, permission rules, and a sandbox. They found that none of the three mechanisms can tell which program is doing the reading.

MetaCascade: Attacking Agent Skills End-to-End by Poisoning Only Metadata

2026-10-10T00:00:00+09:00

MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning arXiv · Oct 10, 2026This paper studies security risks of third-party skills used by LLM agent systems, which select skills based on their metadata, while prior work mainly examined harm after execution. The authors propose MetaCascade, an end-to-end framework that poisons only metadata, generating diverse malicious skill candidates and iteratively refining their metadata using task and black-box competition feedback. Evaluated on four datasets and two agents, Hermes and OpenClaw, it achieves state-of-the-art attack performance over the strongest baselines.

From Reconnaissance to Response: A Risk-Based Engine for Automated Attack Containment

2026-09-29T00:00:00+09:00

From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack arXiv · Sep 29, 2026This paper proposes a metrics-driven decision engine that links quantitative risk parameterization with continuous automated response time. It maps CVSS exploitability parameters to attacker success probabilities, uses FAIR Monte Carlo simulations to evaluate defender log distributions, and models SIEM logs as Poisson arrivals with Bayesian threat belief updates. The interaction is framed as a dynamic Bayesian Stackelberg game, yielding a closed-form threshold for when containment is preferred. Simulations parameterized on the 2023 MGM Resorts and Caesars Entertainment incidents show automated SOAR isolation triggered within seconds of adversarial probing.

DIBench: A benchmark for whether GUI mobile agents make honest decisions under deceptive injections

2026-09-29T00:00:00+09:00

DIBench: Benchmarking Decision Integrity of GUI-based Mobile Agents Under Deceptive Injections arXiv · Sep 29, 2026This paper introduces DIBench, a benchmark that measures the decision integrity of GUI-based mobile agents. It covers 7 commercial and 3 simulated apps and builds 8 deceptive injection probes that can steer critical selections without overt anomalies. Experiments show that completion-based evaluation can overestimate agent trustworthiness, and that common defenses yield inconsistent integrity gains. ★★★★ Notable: Proposes DIBench to measure decision-integrity risk when deceptive injections steer mobile agents away from instruction constraints in multi-candidate selection; reports completion-only evaluation ove

PerceptFence: A Content-Mediation Architecture for Screen-Share AI Assistants

2026-09-28T00:00:00+09:00

PerceptFence: Content-Mediation Architecture and Deterministic Coverage for Screen-Share AI Assistants arXiv · Sep 28, 2026This paper proposes PerceptFence, a layer that sits between screen and speech capture, memory, and model responses, to control what a screen-share AI assistant can observe, retain, or disclose. On 9,600 adversarial strings, it neutralised 0.828 of digit-PII payloads versus 0.183 for Presidio on shared seeds, while Presidio led on other families. In an OCR-based evaluation over 480 synthetic developer-support screens, it neutralised 0.918 of OCR-surviving secrets and PII, compared with 0.581 for Presidio and 0.179 for gitleaks. The authors state the contribution is an architecture and evaluation method, not live deployment or formal privacy guarantees.

Testing whether fast security-check models can safely automate agent decisions

2026-09-27T00:00:00+09:00

Evaluating System One Models for Agent Security Decisions: Reliability, Calibration, and Selective Automation arXiv · Sep 27, 2026The paper evaluates System One models (Jev, Laya, Decider, Bespoke Nimble) used to screen agent inputs, comparing them with specialized classifiers and language-model judges on prompt-injection detection, interaction-risk judgment, and harmful-request screening. It examines accuracy, calibration, and how many inputs can be handled automatically under miss limits. It finds that high overall accuracy can hide confident mistakes within specific attack groups, that strict miss limits allow few inputs to be automated, and that a language-model judge can catch some missed unsafe inputs while also repeating errors and flagging benign inputs.

Why Backdooring Neural Networks Is So Easy: A Theoretical Analysis Using a Quadratic Neuron

2026-09-29T00:00:00+09:00

Why Backdooring Neural Networks is so Easy? arXiv · Sep 29, 2026This paper theoretically studies how much poisoned data and trigger strength an attacker needs to plant a successful, stealthy backdoor in a neural network. Using a quadratic neuron trained on a poisoned Gaussian mixture, the authors derive closed-form results showing that feature learning lowers the required trigger strength compared with lazy learning. They conclude that audits relying on linear heuristics may underestimate backdoor vulnerability in feature-learning settings.

Refusal Localizes, Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning

2026-09-29T00:00:00+09:00

Refusal Localizes, the Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning arXiv · Sep 29, 2026This paper studies how a few harmful training examples can strip refusal behavior from aligned language models, and whether refusal can be restored by patching hidden states at a specific layer depth. Tests on six checkpoints from four model families show that layer-freezing up to that depth keeps refusal near zero after attack. The authors also find that an attacker who spreads the update can defeat the repair, and they propose five checks for defenses against adaptive fine-tuning. ★★★★ Notable: The paper reports that after few-sample harmful fine-tuning, refusal localizes to a specific layer depth where clean hidden-state patching restores it; freezing layers up to that depth still leaves an

Key-gated LoRA adapter routing to block private data leakage from LLMs

2026-09-29T00:00:00+09:00

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs arXiv · Sep 29, 2026This paper introduces Locket, a framework that trains lightweight LoRA adapters, each implementing a different access policy such as full reveal, PII masking, or differential privacy. A gating module maps a learned keyed entry token to exactly one adapter, so a valid token unlocks private knowledge while a missing or invalid token triggers a redacting adapter. The authors evaluate it on Enron, ECHR, and Yelp datasets with several LLMs, reporting that correct tokens preserve perplexity and invalid tokens substantially reduce PII leakage.

In multi-tenant quantum computing, coherence, not error rate, governs privacy

2026-09-28T00:00:00+09:00

Coherence Rather Than Error Rate Governs Privacy in Multi-Tenant Quantum Computing arXiv · Sep 28, 2026This paper examines how much one tenant can learn about another when several users share a cloud quantum processor. The authors propose an information leakage measure based on quantum state distinguishability and test it on IBM Kingston (156-qubit) and IQM Garnet (20-qubit) devices. They find that devices with identical benchmarked error can leak significantly different amounts of information, because standard error metrics do not capture whether errors are coherent or stochastic. A uniform Pauli randomisation defence reduces leakage to zero, but experiments show a non-trivial degradation from accumulated errors. ★★★★ Notable: Proposes a distinguishability-based cross-tenant leakage metric; the authors argue average error misses coherent-versus-stochastic differences, measured on IBM Kingston and IQM Garnet, with Pauli rand

ContractWarden: Kernel-enforced limits on AI agent damage through human-approved contracts

2026-09-29T00:00:00+09:00

ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts arXiv · Sep 29, 2026This paper presents ContractWarden, a Linux reference monitor that limits the operating-system damage an AI agent can cause, without trusting the agent itself. The agent may propose an allow, deny, or no_egress asset contract, but a human makes the final decision, and an eBPF LSM data plane enforces file and network rules in the kernel. Across 570 runs of 19 security tests, all runs met the predefined criteria. Measured overhead on three file-I/O workloads was lower than that of the evaluated frozen ActPlane baseline.

ModalFidelity: a lightweight router that picks which audio or video stream to inspect for deepfakes under a fixed compute budget.

2026-09-29T00:00:00+09:00

ModalFidelity: Routing Modalities for Deepfake Detection on a Budget arXiv · Sep 29, 2026Deepfakes increasingly alter only the few seconds where a video's meaning changes, yet detectors still read every window of audio and image streams. The authors propose ModalFidelity, a lightweight router that previews each window and decides which stream to read before any forensic detector runs, never exceeding a hard compute budget. On AV-Deepfake1M, reading at most one fifth of the windows, it outperforms gating after the detectors while using 15.9x less compute, and retains over 96% of an oracle's accuracy.

Agent-Warden: Kernel-level eBPF tracking of which processes and files LLM agents touch

2026-09-29T00:00:00+09:00

Agent-Warden: eBPF-Based Kernel-Native Process-File Provenance Tracking for LLM Agents arXiv · Sep 29, 2026This paper presents Agent-Warden, an eBPF-based monitor that tracks task and file states across process creation, file access, and termination in LLM agents. In a controlled file-mediated propagation test, it reconstructed a cross-process causal chain missing from the application-layer trace. On x86-64 and ARM64 bare-metal hosts, the evaluated workloads showed 0.2-3.5% end-to-end overhead.

Inference-Layer Security: Guarding LLM Services Against Adversarial Use

2026-09-29T00:00:00+09:00

Inference-Layer Security: Defending Against Adversarial Inference and Infrastructure Abuse arXiv · Sep 29, 2026This technical report studies how providers of large language model services can defend the inference layer against jailbreaking, denial-of-service, and distillation attacks. Because no public labelled dataset of adversarial usage exists, the authors build a structural causal model that generates labelled user sessions, including coordinated multi-account campaigns. They train a gradient-boosted detector that classifies sessions as benign or malicious and by attack type. The detector scores much higher against oracle labels than against operational labels, and the dataset is publicly released.

Separation of duties for privileged LLM agents: a governed execution architecture with measured security-utility trade-offs

2026-09-28T00:00:00+09:00

Separation of Duties for Privileged LLM Agents: A Governed Execution Architecture with Measured Security-Utility Trade-offs arXiv · Sep 28, 2026LLM agents are increasingly given real privileges such as running commands and modifying files, so an erroring agent has already acted. The paper proposes governing the path from candidate action to side effects outside the model, with four roles (planner, policy gate, executor, auditor) between agent and operating system, using structured intents and one-shot approvals bound to exact bytes. On a 313-case benchmark, effective attack success fell from 98.3% under direct execution to 7.7% when deployed, with a corrected false-denial rate of 11.1%.

CATP: Local Agent Authorization and Audit Evidence Design

2026-09-28T00:00:00+09:00

CATP: Design and Evaluation of Local Agent Authorization and Audit Evidence arXiv · Sep 28, 2026The paper presents CATP, a specification for turning local pre-execution authorization decisions into audit evidence that can be verified offline. Experiments on Claude Code and Codex found five missing consistency checks, and adding them produced the expected outcomes on all 13 test cases. The evidence depends on a trusted runtime, monitor, host and signing key, and it does not prove execution truth.

SEABench: A Benchmark for Misalignment in Self-Evolving AI Agents

2026-09-29T00:00:00+09:00

SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents arXiv · Sep 29, 2026This paper introduces SEABench, a benchmark of 48 longitudinal task sequences for studying how self-evolving LLM agents, which modify their own instructions, memory, and tools after deployment, can become unsafe. Experiments across several recent LLMs show that self-evolution raises task completion rates but often causes safety failures absent in paired non-evolving baseline agents. The authors also find that safety behavior differs across evolution surfaces and harm types, and that these differences appear in chain-of-thought reasoning, enabling a monitoring strategy that mitigates unsafe behavior with a low false positive rate.

Revisiting dual lattice attacks on bounded distance decoding with a heuristic-free trade-off

2026-09-28T00:00:00+09:00

Dual lattice attacks for bounded distance decoding, revisited arXiv · Sep 28, 2026This paper examines the assumption that scores of short dual vectors in dual lattice attacks are mutually independent. In the Haar-random lattice model, without heuristic assumptions, the authors prove an explicit asymptotic trade-off between target radius and query time for decision bounded distance decoding with preprocessing. Using Siegel and Rogers moment identities, they analyze cosine scores over complete dual balls and bound error probabilities. The resulting trade-off matches the asymptotic prediction of the Ducas-Pulles conditional model. ★★★★ Notable: The authors derive an explicit asymptotic BDD preprocessing trade-off in the Haar-random lattice model without heuristics, which they state matches the Ducas-Pulles conditional prediction.

An Operator-Norm Method for Security Under Quantum Advice: A Quantum Cryptography Theory Paper

2026-09-28T00:00:00+09:00

An Operator-Norm Approach to Security with Quantum Advice arXiv · Sep 28, 2026The paper introduces an operator-norm approach to non-uniform security in the quantum random oracle and random permutation models, giving one reduction that covers both search success probability and distinguishing advantage. The framework yields tight bounds for Yao's box with and without salting, improved bounds for pseudorandom generators, and an optimal generic salting theorem for decision games. By separating offline and online query contributions, the authors also obtain stronger bounds for salted permutation and random-function inversion.

SKILLLITE: An evidence-guided method for auditing malicious Agent Skills using compact LLMs

2026-09-29T00:00:00+09:00

SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs arXiv · Sep 29, 2026Agent Skills extend LLM-based agents with task-specific instructions and executable components, but third-party Skills create a supply-chain risk because malicious ones can abuse agent privileges. The paper proposes SKILLLITE, a framework that extracts security-relevant behaviors and infers intended functionality from Skill packages, then uses a compact LLM to judge maliciousness. Experiments report improved detection across several compact LLM backbones, better results than representative baselines, generalization to in-the-wild malicious Skills, and low inference latency.

Safer Content or Firmer Refusals? Hybrid Defense Against Harmful Fine-Tuning

2026-09-29T00:00:00+09:00

Safer Content or Firmer Refusals? A Hybrid Perturbation Defense for Alignment under Harmful Fine-tuning arXiv · Sep 29, 2026This paper addresses how harmful data mixed into fine-tuning can weaken a language model's safety alignment. It proposes VaccineBooster, which combines embedding perturbation and weight-level gradient attenuation within one alignment procedure. On Llama-2-7B, it reports the lowest moderation score (0.315) while Booster-Only keeps the highest refusal rate (50%). The authors note the evaluation uses ten prompts and a single unseeded run, so the trade-off is an observed pattern rather than a statistically resolved result.

Does Gradient-Based Jailbreak Detection Hold Up in Multi-Turn Conversations?

2026-09-29T00:00:00+09:00

Does the Unsafe Gradient Survive a Conversation? On the Fragility of Gradient-Based Jailbreak Detection in Multi-Turn Dialogue arXiv · Sep 29, 2026This paper examines whether GradSafe, a gradient-based jailbreak detector designed for single prompts, works in multi-turn dialogue. The authors add a Context Window Scanner that scores fixed-size windows of user turns and uses the highest window score for the whole conversation. Performance is strong on synthetic benign conversations (ROC-AUC 0.98) but drops to 0.76 on real WildChat conversations and varies with attack type and target model.

pikit: A Toolkit for Testing Indirect Prompt Injection Attacks and Defenses

2026-09-29T00:00:00+09:00

pikit: A Composable Toolkit for Indirect Prompt Injection Research and Evaluation arXiv · Sep 29, 2026This paper presents pikit, a research toolkit for systematically evaluating indirect prompt injection, where malicious instructions hidden in external content manipulate LLM agents. It covers 13 attack methods, 16 carriers across text and file modes, and 9 prevention strategies plus 3 offline detection baselines. In tests, the best prevention strategies reduced attack success rate by 71.8% relative, with few_shot_warning and instruction_hierarchy performing strongest. Offline detectors had perfect precision but low recall, suggesting they complement rather than replace prompt-level defenses.

Survey of attacks that slow deep learning inference and how to defend against them

2026-09-29T00:00:00+09:00

Deep Learning Latency Attacks and Defenses: A Cross-Domain Survey of Availability Threats arXiv · Sep 29, 2026This survey reviews adversarial attacks that aim to increase inference time, energy use, or response latency rather than change predictions. It covers perception pipelines, input-adaptive neural networks, and autoregressive and agentic systems such as LLMs and tool-using agents. The authors classify attacks by the computational bottleneck they exploit and propose a work-budget defense abstraction. The paper also analyzes when added model cost becomes a system-level availability failure, along with threat models, defenses, and open challenges.

Efficient library-boundary compartmentalization on CHERI hardware

2026-09-29T00:00:00+09:00

Efficient Linkage-Based Compartmentalization on CHERI arXiv · Sep 29, 2026This paper presents a linkage-based model for in-process compartmentalization using CHERI memory safety, applied across the entire UNIX user space. It scales to over 10,000 compartments on desktop systems and creates 500+ compartments per process for large applications such as Chromium. Of thousands of C/C++ programs tested, only the V8 engine needed source changes. The model is implemented for CHERI-extended Armv8-A and RISC-V. ★★★★★ Notable: The authors present a linkage-based in-process compartmentalization model on CHERI that splits along existing library boundaries, reporting 500+ compartments per process for Chromium and evaluating on

Understanding Private Evolution as a learning-augmented clustering method for private synthetic data

2026-09-29T00:00:00+09:00

Understanding Private Evolution as Learning-Augmented Clustering arXiv · Sep 29, 2026Private Evolution is a differentially private method for generating synthetic data. This paper recasts it as Wasserstein learning augmented by a generative model, and shows theoretically that better performance bounds are possible when the generator captures some features of the true distribution. The authors find that standard PE variants can fail to converge on simple well-clustered instances, and they propose a geometry-aware version that provably converges on such instances. Experiments show the new algorithm is competitive with standard baselines and can improve recall.

Self-Evolving Defense: Continual Security Policy Learning for LLM Agents

2026-09-29T00:00:00+09:00

Self-Evolving Defense: Continual Security Policy Learning for LLM Agents arXiv · Sep 29, 2026This paper introduces Self-Evolving Defense (SED), a training-free framework that turns harmful agent trajectories into reusable security policies without updating model weights. It retrieves relevant policies for new tasks to adapt to emerging attacks while retaining knowledge across attack types. Tested on three open-source models and eight benchmarks covering jailbreaks, prompt injection, and insecure code generation, SED reportedly lowers AGENTDOJO prompt-injection success to 0.42% and adaptive X-TEAMING attack success on HARMBENCH to 7.8%, while preserving benign task utility.

CyberPersistBench: Testing whether AI attack agents can keep access after a break-in

2026-09-29T00:00:00+09:00

CyberPersistBench: Evaluating LLM-Based Cyber Attackers on Installation and Persistence arXiv · Sep 29, 2026This paper introduces CyberPersistBench, the first benchmark for evaluating whether LLM-based attackers can install and maintain access after initial compromise. Agents must keep footholds across staged system disruptions using native host mechanisms, scored on a six-level deterministic scale (L1–L6) over 203 core tasks. Across five frontier agents, autonomous persistence reached only 27.6%–44.8%, falling to 5.5%–13.3% on defense-enabled tasks. ★★★★ Notable: The authors introduce the first benchmark for post-compromise installation and persistence, using deterministic six-level scoring across 203 core tasks and defense extensions. They report autonomous p

CounterSteer: Blocking Hidden Instructions in AI Agent Tool Results

2026-09-29T00:00:00+09:00

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering arXiv · Sep 29, 2026Indirect prompt injection makes language model agents follow instructions hidden in untrusted retrieved text. CounterSteer is an inference-time defense that fits a direction inside the model from paired examples and subtracts it from tool-result tokens during prefill. Across five open-weights models, held-out attack success and AgentDojo compromise rates drop sharply while benign utility stays high. Attacker-chosen parameters inside legitimate calls are only partially resisted. ★★★★★ Notable: Applies inference-time activation steering to tool-result tokens to suppress indirect prompt injection; the authors report lower attack success across five open-weights models and adaptive attacks whi

ANCHOR: Context-grounded, stateful LLM investigation of system provenance for attack tracing

2026-09-29T00:00:00+09:00

Know the Normal, Track the Attack: Context-Grounded and Stateful LLM Investigation over System Provenance arXiv · Sep 29, 2026This paper presents ANCHOR, a system that turns suspicious activity flagged by provenance-based intrusion detection into coherent attack narratives. It combines curated evidence with context-grounded LLM reasoning, using deployment-specific normal-behavior baselines and a confidence-gated cache that tracks attack state across time windows. The authors evaluate it on six DARPA Transparent Computing E3/E5 datasets and report better IoC recovery and attack-stage attribution than existing provenance-based baselines.

FinRT: Reusable Adversarial Prompt Generators for Testing Consumer Finance AI

2026-09-29T00:00:00+09:00

FinRT: Distilling Adaptive Red-Teaming Strategies into Reusable Adversarial Generators in Consumer Finance arXiv · Sep 29, 2026This paper presents FinRT, a framework that distills adaptive red-teaming strategies into reusable adversarial prompt generators for consumer finance, where harmless-looking queries can cause large language models to fail safety checks. Across six victim models, FinRT nearly doubles the attack success rate of the adaptive baseline Rainbow Teaming (32.9% vs. 17.2%) and increases maximum adversarial severity by 33%. It keeps semantic diversity within policy domains comparable to iterative search methods and shows high cross-model transferability.

Quantization makes private dense retrieval practical against malicious servers

2026-09-29T00:00:00+09:00

Quantization Enables Private Dense Retrieval against Malicious Service Providers arXiv · Sep 29, 2026Dense retrieval, a core part of retrieval-augmented generation, finds relevant documents by comparing vector representations of queries and passages. The paper formalizes private dense retrieval as protecting query privacy and retrieval integrity against a malicious server, and proposes a two-round cryptographic protocol that uses low-bit quantization to keep computation practical. Across six embedding models and corpora up to 2.68 million passages, three-bit quantization with a clipped quantizer largely preserves retrieval quality and downstream RAG accuracy. A private query over a clinical-reference-sized corpus takes one to three minutes of server time.

Audience-bound persistent memory: authorization across the whole memory lifecycle

2026-09-29T00:00:00+09:00

Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle arXiv · Sep 29, 2026This paper studies how a personal language agent acting for its owner across private and shared conversations should authorize memory before assembling context. Each memory item records the audience present when it was made, and a memory enters a model's context only if every current viewer belongs to an authorized audience. The approach was implemented in two independent architectures and an agent-memory runtime. In a pre-registered test over 10,000 multi-party histories, no forbidden item entered any architecture's context, while unscoped retrieval exposed forbidden items in 82% of contexts. ★★★★ Notable: Proposes audience-bound memory admission across the lifecycle; over 10,000 multi-party histories, no forbidden item entered context while unscoped retrieval exposed them in 82%.

TTMark: Pairwise Watermarking That Makes AI Text Easier to Detect

2026-09-29T00:00:00+09:00

TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy arXiv · Sep 29, 2026This paper presents TTMark, a watermarking framework that extends distortion-free watermarking from single tokens to adjacent token pairs. By watermarking the joint distribution of consecutive tokens, the detector can use both token entropy and conditional entropy. Experiments across several language models and datasets report better detectability without degrading generation quality.

Conversable quantum fire in the standard model: quantum states that clone easily but cannot be sent by one-way classical messages

2026-09-29T00:00:00+09:00

Conversable Quantum Fire in the Standard Model arXiv · Sep 29, 2026The paper presents a construction of quantum fire, quantum states that can be efficiently cloned but cannot be transmitted by one-way classical communication. Unlike earlier provably untelegraphable constructions, which rely on an oracle, this one is based on one-shot signatures and works in the standard model. The authors introduce keyless untelegraphability and conversability, meaning fire can be transferred via two-way classical interaction. Two variants are given, supporting polynomially and exponentially many flames respectively.

Calibrating Membership Inference Attacks Using Neighboring Samples

2026-09-29T00:00:00+09:00

Calibrating One-Round Membership Inference with Neighbors arXiv · Sep 29, 2026Membership inference attacks test whether a given example was part of a model's training data. The strongest current methods need reference models trained for each example, which is too costly for large models. This paper asks whether neighboring samples of the target can provide the calibration needed when only one trained model is available, without training extra models. The authors propose two ways to obtain such neighbors and show that querying an early training checkpoint sharpens the signal. Experiments on three image classification datasets and three training setups report strong membership signals and competitive attack performance at no additional training cost.

DecoyTrace: Using Toxic Decoys to Actively Defend Decentralized Federated Learning

2026-09-29T00:00:00+09:00

DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning arXiv · Sep 29, 2026This paper addresses decentralized federated learning, where there is no central server and malicious updates such as backdoors can evade passive parameter checks. It proposes DecoyTrace, which deploys a mobile decoy node that sends decoy challenges and dual clean and decoy models based on neighbor trust, then evaluates them with three-state semantic metrics. Once an attack is confirmed, a distributed protocol isolates the source and resets or recovers the model. Across 60 configurations on the NEBULA platform, the F1-score stays within 0.03 of the baseline on MNIST and FashionMNIST and is 0.05 to 0.10 lower on CIFAR-10, while CPU and network usage drop by up to two-thirds.

Empirical Study of EU AI Act Compliance Checker Tools

2026-09-29T00:00:00+09:00

An Empirical Study and Assessment of EU AI Act Compliance Checkers arXiv · Sep 29, 2026This paper presents the first empirical study of automated tools that check compliance with the EU AI Act. The authors characterize 12 mainstream checkers, evaluate their legal coverage and alignment, and analyze the structure, determinacy, and actionability of their generated reports. They find that checker quality varies significantly, that the tools can serve only as early-stage orientation, and that they tend to oversimplify or omit key obligations. The paper also offers design principles for more reliable compliance-support tools.

Adversarial debiasing of machine learning models to improve DDoS attack detection for network security

2026-09-29T00:00:00+09:00

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks arXiv · Sep 29, 2026The paper proposes a DDoS detection method that uses GAN-generated synthetic traffic data to train a Random Forest classifier. Adversarial debiasing is applied to reduce sensitivity to skewed packet-related features. The authors report 99.98 percent accuracy on benchmark data and a 22.60 percent improvement on previously unseen synthetic traffic.

Privacy-friendly audience grouping: on-device, in-browser job-segment inference for ID-free ads

2026-09-29T00:00:00+09:00

Privacy-Friendly Cohort Determination: Sealed, CSP-Independent In-Browser ML Inference of Professional Segments for Identity-Less Advertising arXiv · Sep 29, 2026This paper presents SIF (Sealed Inference Frame), which infers coarse professional cohorts on the user's device inside the browser and sends only a locally differentially private, taxonomy-coded label into the OpenRTB bid stream, with no cross-site identifier. It reports privacy-utility trade-offs, a re-identification simulation, and an assessment of which attributes are predictable. The authors find that company type and size are predictable, while seniority largely is not.

Rendering Inputs as Images to Defend Against Prompt Injection

2026-09-29T00:00:00+09:00

Render Before Reading: Visual Rendering as a Prompt Injection Defense arXiv · Sep 29, 2026The paper finds that multimodal LLMs are more likely to follow adversarial instructions delivered as text than when the same instructions arrive as images. Building on this modality gap, the authors propose Pictionary, a training-free defense that renders untrusted content as typographic images or audio before it reaches the model. Across ten models and two benchmarks, the method consistently reduces attack success rates while largely preserving benign utility, including against adaptive attacks and human red teamers. ★★★★★ Notable: Finds multimodal LLMs follow text-form injected instructions more than image-form ones, and proposes a training-free rendering defense that the authors report reduces attack success across ten models

Multi-Class, Multi-Tier Network Intrusion Detection: A Reproducible Benchmark

2026-09-29T00:00:00+09:00

Multi-Class, Multi-Tier Network Intrusion Detection: A Comprehensive and Reproducible Benchmark arXiv · Sep 29, 2026This paper addresses inconsistent and inflated results on the CIC-IDS2017 intrusion detection dataset by correcting PCAP-level labels and building a complete evaluation pipeline. Eleven tabular classifiers are assessed at three levels: binary attack detection, nine-class attack-family attribution, and fifteen-class fine-grained classification. A soft-voting ensemble of Random Forest, XGBoost, and LightGBM achieves the best fine-tier macro-F1 of 0.955. The configurable pipeline is released as open source.

When Privacy Becomes a Weapon: Doxxing and Privacy Risks on Mainland China's Social Media

2026-09-29T00:00:00+09:00

When Privacy Becomes a Weapon: Understanding Doxxing and Privacy Vulnerabilities in Mainland China's Social Media Ecosystem arXiv · Sep 29, 2026This paper studies doxxing, the malicious disclosure of personal information, in mainland China. Through semi-structured interviews with 18 survivors, the authors build a framework describing how doxxing operates in this setting. They find that platform amplification resembles Western patterns, while compulsory identity linkage, nationalist discourse, fandom culture, Confucian values and low privacy literacy create China-specific dynamics. The authors argue that protection requires constraining systemic vulnerabilities and propose recommendations for legal reform, platform design and social initiatives.

PrivacySkills: How Privacy Guidance Shapes Which Information Sources LLM Agents Pick

2026-09-29T00:00:00+09:00

PrivacySkills: How Privacy Guidance Shapes Source Selection in LLM Agents arXiv · Sep 29, 2026This paper introduces PrivacySkills, a controlled framework for testing how LLM agents choose among ways to obtain the same task information, such as public personal data, confidential sources, or asking the user. It uses 55 synthetic tasks and 169 skills, comparing system-level instructions with skill-level privacy labels. Without privacy guidance, agents accessed confidential sources in 30% of valid runs, rising to 45% when users were unavailable, while urgency framing had no detectable effect. Combining system instructions with skill-level labels roughly halved confidential access.

Same Text, Different Authority: How Reserved Tokens Make Chat-Template Prompt Injection Stronger

2026-09-28T00:00:00+09:00

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection arXiv · Sep 28, 2026This paper studies prompt injection against LLM agents, finding that forged chat-template markers such as <|im_start|> are far more effective when fed to the model as reserved control tokens than as ordinary subwords. Encoding the same text as subwords lowered attack success on the InjecAgent benchmark by 39 to 66 percentage points on three of four open-weight families. The standard tokenizer mitigation covers only tokens a configuration declares special, so tool-protocol tokens remain unprotected and the gap persists on that channel. ★★★★★ Notable: Shows that the same text encoded as a reserved control token versus subwords changes forged-marker injection authority, quantified on InjecAgent and AgentDojo, with implications for defense.

TEE Anchor: Cross-TEE organizational endorsement to reduce physical attacks on TEEs

2026-09-28T00:00:00+09:00

TEE Anchor: Cross-TEE Organizational Endorsement for Mitigating TEE Physical Attacks arXiv · Sep 28, 2026In 2025, practical physical-access attacks on TEEs, such as TEE.fail and Battering RAM, were disclosed. The paper proposes TEE Anchor, a lightweight X.509-based mechanism in which an organization issues certificates over each CPU's Chip ID to form its own PKI, and a Verifier checks the Chip ID in attestation evidence to prove the machine's organizational affiliation. It needs no extra root of trust such as a (v)TPM, and the prototype's operations, including provisioning and verification, complete within a few milliseconds.

MMSkillRisk: Can AI agents stay safe when image-based skills hide malicious instructions?

2026-09-28T00:00:00+09:00

MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps? arXiv · Sep 28, 2026This paper introduces MMSkillRisk, a benchmark for end-to-end safety testing of attacks hidden in images within multimodal agent skills. The authors design NCVA, an attack that disguises malicious instructions as native parts of teaching images, such as annotations and interface labels. Across nine model-harness configurations, NCVA reaches a pooled attack success rate of 43.1%, 16.4 percentage points above a text-carrier baseline. The results show attacks can succeed while legitimate tasks are also completed, so task success alone does not prove safe skill use. ★★★★★ Notable: The authors report that NCVA, an image-borne attack, reaches 43.1% pooled ASR in isolated sandboxes, 16.4 points above the text-carrier baseline across nine configurations.

Similarity Is Not Validity: Defending LLM Semantic Caches Against Poisoning

2026-09-28T00:00:00+09:00

Similarity Is Not Validity: Defending LLM Semantic Caches Against Poisoning arXiv · Sep 28, 2026Semantic caches cut LLM serving costs by reusing answers to similar queries, but retrieval relies only on embedding similarity, so an attacker can store a malicious answer under a query that looks benign. The paper proposes a defense that recovers distinguishing information from the raw cache-key text, exploiting a rewrite-residual structure in adversarial queries. Using Deletion Gain and an Answer Check, it blocks 82.0% to 98.2% of poisoned entries across three attack classes at a 5% false-positive rate, with negligible serving overhead.

Raising the Bar for Chinese Adolescent LLM Safety: A Culturally-Grounded Benchmark

2026-09-28T00:00:00+09:00

Raising the Bar for Chinese Adolescent LLM Safety: A Culturally-Grounded, Fine-Grained Benchmark arXiv · Sep 28, 2026The paper introduces QH-Bench, a Chinese-language benchmark for adolescent content safety, built on Chinese social and cultural scenarios, with 715 single-turn items and 100 four-turn trajectories. Evaluating 13 open-weight models, it finds offline-contact scenarios to be a shared weakness, with every model scoring negatively on over half of such items. The authors note that leading aggregate scores do not show these specific weaknesses have been resolved.

SaplingGuard: A Profile-Aware Multi-Agent Safety Guardrail for Adolescent-LLM Chats

2026-09-27T00:00:00+09:00

SaplingGuard: A Multidimensional-Profile-Aware Multi-Agent Guardrail for Developmentally Safe Adolescent-LLM Interaction arXiv · Sep 27, 2026This paper introduces SaplingGuard, a plug-and-play safety guardrail that uses user profiles and dialogue context to detect implicit developmental risks when adolescents interact with LLMs, without modifying the downstream models. It uses three agents for profile construction, context-aware risk assessment, and intent-preserving prompt optimization. On SaplingBench, a set of 276 three-turn dialogues across seven developmental risk categories, the authors report that profile-aware retrieval raised the Major Hit rate and that the full intervention lowered the average harmful response rate.

Taming Multi-Category Harms: Adaptive Safety Steering for LLMs

2026-09-28T00:00:00+09:00

How to Tame a Multi-Headed Hydra? Adaptive Multi-Category Safety Steering for Large Language Models arXiv · Sep 28, 2026This paper proposes CAM-Steer, a framework that improves LLM safety by modifying internal activations during inference without updating model parameters. It estimates the risk of each harm category by comparing the hidden state with safe and unsafe prototypes, then combines category-specific safety directions into one steering direction and sets the intervention strength. Experiments across three LLM backbones and seven harm categories show higher average defense success rates than the evaluated baselines, including when categories co-occur, with negligible inference overhead.

Climbing the Hill: Curriculum RL Red-Teaming for Prompt Injection Against Frontier Models

2026-09-27T00:00:00+09:00

Climbing the Hill: Prompt Injection Red-Teaming Against Frontier Models with Curriculum Reinforcement Learning arXiv · Sep 27, 2026This paper studies prompt injection, a major security risk for LLMs and LLM-based agents, and proposes a curriculum reinforcement learning method for red-teaming. It addresses the cold-start problem, where an attacker model receives no learning signal because every attack fails against frontier models. The attacker is trained against progressively more robust targets, with each stage partially succeeding to provide learning signals. On AgentDyn, the reported attack success rates (ASR@10) are 93.8% against GPT-5.6-Luna and 45.0% against GPT-5.6-Terra, while RL-Hammer and PISmith achieve 0%.

Distillation defenses can fail after reinforcement learning

2026-09-29T00:00:00+09:00

Distillation Defenses Easily Break After Reinforcement Learning arXiv · Sep 29, 2026This paper studies distillation attacks that copy the reasoning abilities of closed-source language models, and the defenses against them. The authors argue that existing defenses are usually tested only right after distillation, ignoring further training with reinforcement learning. They show that simple attacks using data easily available from current APIs can match the reasoning gains of attacks that extract full hidden traces. They conclude that defenses leaking enough information to reconstruct approximate reasoning traces are likely ineffective.

Short proofs for quantum problems using only basic hash-function assumptions

2026-09-29T00:00:00+09:00

Succinct Arguments for QMA from Collapsing Hash Functions arXiv · Sep 29, 2026The paper shows that succinct arguments for QMA exist assuming only collapsing hash functions. This is the first such scheme relying only on unstructured Minicrypt assumptions, not known to imply public-key encryption. A key component is a quantum-succinct claw-state generation protocol that uses classical communication to expand a few quantum correlations into many claw-state correlations. Combined with a communication-compression compiler, this yields succinct arguments for QMA with better round complexity and a simpler standard-model proof than prior work. ★★★★★ Notable: The authors report the first QMA succinct arguments assuming only collapsing hash functions, relying solely on unstructured Minicrypt assumptions. Their claw-state generation protocol uses only classi

AI Virus Spreading via Shared Files Between LLM Agents

2026-09-29T00:00:00+09:00

Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents arXiv · Sep 29, 2026This paper studies how large language model assistants that share persistent artifacts, such as reports, can unintentionally pass adversarial content between one another. Malicious content is stored in an assistant's memory, reproduced in later artifacts, and picked up by other assistants. The authors simulate artifact exchange among independent assistants to measure survival across hand-offs, hop count, and spread. They report that attacks propagate across multiple assistants and reach 60-80% of agents in larger simulations, with chains extending to eight hops. ★★★★ Notable: The authors present a self-propagating attack spreading via shared artifacts across independent assistants, reporting 60-80% agent reach and eight-hop chains in larger simulations.

INTCC: A framework enabling interactive work inside confidential computing environments

2026-09-29T00:00:00+09:00

INTCC: A Framework for Interactive Confidential Computing arXiv · Sep 29, 2026This paper proposes interactive confidential computing, a model that lets untrusted data processors run dynamic, human-guided operations inside Trusted Execution Environments while keeping data confidential. The authors split the TEE into an interactive controller and a verifiable runtime, and implement the INTCC framework on AMD SEV-SNP using Confidential Containers. Reported experiments show overhead below 5% for LLM fine-tuning and under 17% for data analysis compared with baseline execution.

Detecting Fake Data Attacks and Unstable Operation in Smart Grids Using Graph Learning

2026-09-29T00:00:00+09:00

Detecting False Data Injection and Unstable Operation in Smart Grid via System-Aware Graph Boundary Learning arXiv · Sep 29, 2026This paper introduces StarGNN, a graph learning framework that learns the stable operating region only from clean stable configurations. It uses a single abnormality score to flag reported configurations that should not be trusted, covering both real instability and false data injection attacks. Each configuration is modeled as a producer-consumer star graph, and physics-constrained pseudo-negatives are generated by perturbing reaction time and price response parameters. On nine unseen attack scenarios, the method detects 0.780 to 0.973 of attacks on stable configurations and keeps post-attack instability recall between 0.972 and 0.999.

Beyond Scalar Probes: Using Vector Outputs of ReLU Networks to Extract Signatures

2026-09-29T00:00:00+09:00

Beyond Scalar Probes: Exploiting Vector-Valued Outputs in ReLU Networks For Signature Extraction arXiv · Sep 29, 2026This paper revisits cryptanalytic extraction of ReLU networks from a geometric and algebraic perspective. Instead of examining a single output component, it studies the full vector-valued behavior across adjacent linear regions and characterizes Jacobian differences as rank-one, recovering row-signature information along with complementary column-side information. Experiments show this extra structure can aid extraction and improve numerical estimation under float64, float32, and float16 precision. The analysis is extended from high-precision, output-rounding settings to low-precision settings common in practice.

Using LLMs to Automatically Prove Security of Cryptographic Protocols: Current Capabilities

2026-09-29T00:00:00+09:00

LLM-Assisted Automatic Security Proofs for Cryptographic Protocols: How Far Are We? arXiv · Sep 29, 2026This paper systematically evaluates how well state-of-the-art large language models assist in verifying cryptographic symbolic protocols. It introduces CRoST (Coverage Rate of Solve Tree), a proof-based metric that measures how similar generated lemmas are to reference lemmas. Models achieve 38.82% coverage on average, and 14.4% of generated lemmas exceed 80% coverage. However, the models show failures on complex multi-phase protocols, diminishing returns from naive scaling, and substantial verification overhead.

Indistinguishability of permutation sums via Fourier analysis for classical and quantum security

2026-09-29T00:00:00+09:00

Indistinguishability of Sum of Permutations: A Fourier Analytic Route to Classical and Quantum Security arXiv · Sep 29, 2026This paper studies whether sums of independent random permutations, and related constructions, can be told apart from random functions under classical and quantum query models. It uses a unified Fourier analytic approach to derive query-dependent security bounds in both models. The authors also analyse linear postprocessing over binary vector spaces and Dinur's variable-output single-permutation construction.

AI-Based Vulnerability Assessment and Cyber Attack Graph Analysis

2026-09-29T00:00:00+09:00

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis arXiv · Sep 29, 2026This paper combines two methods for assessing cyber risk to critical infrastructure. One uses multi-agent reinforcement learning over a cyber knowledge graph to identify attack vectors and TTPs; the other is a probabilistic attack graph model that computes system-level risk from network topology and vulnerabilities. Applied independently to the same operational technology network and validated against the 2015 Ukraine power grid attack, both methods matched the documented attack vectors. The authors find industrial control systems to be the most critical enablers of attack propagation, making them priority targets for hardening.

"Nothing to See Here": Accidental Leaks via LLM Revision Traces

2026-09-29T00:00:00+09:00

"Nothing to See Here'': Unintended Disclosure through Revision Traces of LLM Deliverables arXiv · Sep 29, 2026This paper studies how LLM assistants can unintentionally reveal information they were asked to remove, by restating the deleted item when describing the edit. An analysis of public conversation corpora found revision traces in 8.8% of revision requests. Using the new RevLeakBench benchmark, the authors found that about half of deliverables state the edit, and a reader seeing only the deliverable could recover the withdrawn item in about 13% of them. The paper also compares prompt defenses and proposes an output-side filter that sharply reduces recovery.

Planarian: Managing Agent State with Statepoints

2026-09-29T00:00:00+09:00

Planarian: Managing Agent State with Statepoints arXiv · Sep 29, 2026This paper presents Planarian, an agent runtime that manages state using restorable point-in-time versions of the environment called statepoints. It offers snapshot, rollback, and fork primitives so agents and users can undo erroneous actions and explore alternatives in parallel across local and remote state. Remote state changes are reverted through recorded compensating actions. The authors report task quality improvements of up to 15x and only 3% overhead for users recovering from errors.

Emulating Hybrid QKD and Post-Quantum Networks Automatically in the Cloud

2026-09-29T00:00:00+09:00

Hybrid QKD-PQC Network Emulation through Automated and Scalable Cloud-Native Orchestration arXiv · Sep 29, 2026This paper extends Quditto, an open-source emulator originally built for quantum key distribution (QKD) networks, to support hybrid networks that combine QKD with post-quantum cryptography (PQC). The platform adds a cloud-native orchestrator, an optimized provisioning workflow for large deployments, native post-quantum nodes, and a secure key management module. Experiments on a representative spine-leaf deployment show that orchestration time scales sublinearly with network size and that end-to-end hybrid key establishment succeeds.

Zero-knowledge proofs for quantum networks, a verification method that reveals no extra information

2026-09-28T00:00:00+09:00

Zero Knowledge Proofs in Quantum Networks arXiv · Sep 28, 2026This paper develops a framework for zero-knowledge verification based on the indistinguishability of quantum states under operational constraints. It shows that, due to limits on local operations, a verifier cannot extract information about the underlying state yet can still check its correctness. The authors build explicit protocols for multiparty quantum networks that achieve information-theoretic security, meaning collaborating parties learn nothing beyond the statement's validity.

Sustained Participation as a Security Resource: BPC

2026-09-28T00:00:00+09:00

Sustained Participation as a Security Resource: The Bounded Participation Channel arXiv · Sep 28, 2026This paper introduces the Bounded Participation Channel (BPC), a formal primitive that repeatedly verifies each identity's participation window by window using fresh, identity-bound challenges under strict deadlines. It proves a cost theorem: sustaining s identities over T windows requires at least sT/τ_h participation channel-windows. Tested AI systems reached 97–100% accuracy on perceptual tasks, yet their throughput remained bounded under the tested conditions.

Continuous assurance for AI security auditors gating software releases

2026-09-28T00:00:00+09:00

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates arXiv · Sep 28, 2026This paper addresses LLM-based repository auditors used as security controls in CI pipelines, whose findings decide whether code changes merge. It proposes the Policy-Evidence-Execution Separation Pattern, implemented as the TAIP Assurance Engine and operated as Continuous Control Posture Assurance, which binds admitted evidence to a versioned Posture Tree. The approach was evaluated with unmodified RepoAudit on a fixed Python null pointer dereference benchmark, using 80 executions across two OpenAI model configurations. On a single host, full policy-triggered recomputation across 1,000 independent assurance contexts took at most 1.62 s, below the predeclared 5 s budget.

Building Data Diodes from Commodity Hardware and Open Source Software

2026-09-28T00:00:00+09:00

Implementing Data Diodes Using Commodity Hardware and Open Source Software arXiv · Sep 28, 2026Data diodes are one-way network devices used to defend against sophisticated cyberattacks, mostly deployed in nuclear plants and government agencies. The paper shows that a data diode's hardware can be assembled from commodity fiber-optic equipment, and focuses on software needed to minimize packet loss, since the receiver cannot request retransmission. The authors found most loss came from slow receiver processing and often occurs in clusters, and identified reliable configurations for UDPcast and lidi among three tested open source programs. The findings were incorporated into pydiode, a cross-platform program for reliable one-way data transfers.

Poster: Towards ProofWeave, a privacy-minimised, integrity-anchored evidence plane for continuous agentic AI assurance

2026-09-28T00:00:00+09:00

Poster: Towards ProofWeave: A Privacy-Minimised, Integrity-Anchored Evidence Plane for Continuous Agentic Assurance arXiv · Sep 28, 2026The paper introduces ProofWeave, a record-time chain-of-evidence concept for agentic AI systems. At each policy-relevant action boundary it produces a privacy-minimised, integrity-anchored evidence transaction binding the agent's intent, the control response, and a policy-at-time snapshot, committed to an append-only ledger. In a scenario where an agent tries to send a secret to an unapproved external sink, it reduces candidate bindings per verdict, validation operations, and evidence storage compared with a logs-only correlation baseline.

TANGO: Watermarking Text From Masked Diffusion Models Using Token Pairs

2026-09-28T00:00:00+09:00

TANGO: Watermarking Masked Diffusion Language Models in Token Pairs arXiv · Sep 28, 2026This paper presents TANGO, a watermarking method for masked-diffusion language models that generate text by filling masked positions in parallel. Each new token is tied to a nearby already-unmasked token, with a secret key assigning vocabulary tokens to color classes and biasing the new token toward a color set by the key and that neighbor. Detection requires only the text and the key and does not assume any unmasking order. On two masked-diffusion models, TANGO detects nearly all unedited watermarked texts and most edited ones, and frequency attacks that forge a fixed green list fail against it.

OT-PCA: A New Side-Channel Key-Recovery Attack on HQC Using Offline Templates and Plaintext-Checking Oracles

2026-09-28T00:00:00+09:00

OT-PCA: New Key-Recovery Plaintext-Checking Oracle Based Side-Channel Attacks on HQC with Offline Templates arXiv · Sep 28, 2026This paper presents OT-PCA, a side-channel attack on the HQC post-quantum cryptosystem that uses a plaintext-checking oracle. It builds offline templates by calling the public HQC decoder and optimizes them with genetic-style algorithms. Simulations show fewer oracle calls than prior methods, including a 2.4-fold reduction for hqc-128, and robustness when oracle accuracy drops to 95%. A power analysis evaluation on an ARM Cortex-M4 microcontroller validates the approach in practice.

Tracking Security Debt Across LLM Coding Agent Trajectories

2026-09-28T00:00:00+09:00

Trajectory-Level Security Debt in LLM Coding Agents arXiv · Sep 28, 2026This paper studies how security findings change over the many intermediate code states an LLM coding agent produces, arguing that evaluating only the final output misses this evolution. The authors propose the Security Debt Line Integral (SDLI), which accumulates static-analysis risk whenever an agent reaches a new best test pass ratio. Using four static application security testing tools on SWE-bench, ProgramBench, and MirrorCode runs, they report scanner-based findings rather than validated vulnerability rates.

When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents

2026-09-28T00:00:00+09:00

When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents arXiv · Sep 28, 2026The paper shows that agents form tool calls from model-visible interfaces, but hosts select the implementation later, so standard dispatch ignores the link between descriptor and handler. An unchanged, schema-valid call can therefore carry different security effects during rollout, reconnection, or delayed approval, which the authors call schema-epoch drift. They propose formation-consistent dispatch (FCD), which ties implementation analysis to execution authority and verifies each call's effects against its security contract. Across 32 official releases, 29 needed no release-specific change and three were escalated.

Efficient TCitH-Based Alternatives to SLH-DSA: A Cross-Layer ASIC Design of Mirath

2026-09-28T00:00:00+09:00

Efficient TCitH-Based Alternatives to SLH-DSA: Cross-Layer ASIC Design of Mirath arXiv · Sep 28, 2026NIST has standardized several post-quantum signature schemes and is evaluating non-lattice alternatives to SLH-DSA. This paper presents the first ASIC implementation of Mirath, a TCitH-based signature scheme, in a RISC-V system using a cross-layer approach spanning algorithm and hardware. Implemented in 22nm FD-SOI technology, the design achieves 17.8x lower signing latency and 58% less total cell area than an SLH-DSA ASIC in the same technology node.

Still There, No Longer Seen: Compression-Induced Risk in Vision-Language Models

2026-09-28T00:00:00+09:00

Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Models arXiv · Sep 28, 2026This paper studies the risks that arise when Large Vision-Language Models compress visual tokens to reduce inference cost. The authors define a compression-specific failure as an adversarial input that is answered correctly with full tokens but fails after compression. They propose CIRA, an attack that perturbs images using only vision-encoder access to induce such failures. The paper also reports that a cross-view selection-stabilization defense substantially suppresses CIRA, though an adaptive variant partially restores its effectiveness.

Cyclotomic Cosets: A Hidden-Subgroup Generalization and Quantum Sieve for LWE-Related Problems

2026-09-28T00:00:00+09:00

Cyclotomic Cosets: Hidden Subgroup and Quantum Sieving Algorithm for Prime-Power Moduli arXiv · Sep 28, 2026This paper introduces the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of the Dihedral Coset Problem that keeps an exact hidden-subgroup structure. The authors build a quantum sieve using a π-adic ideal chain, which for fixed prime p and modulus q=p^t solves CCP in time and sample complexity 2^{O_p(log n log q)} with polynomial quantum space. The method also extends to uniform EDCP and Gaussian S|LWE>, but the authors state it does not by itself give a quasi-polynomial algorithm for standard LWE.

Change Web State Before Acting: Protecting Web Agents from Deceptive Interfaces

2026-09-28T00:00:00+09:00

Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces arXiv · Sep 28, 2026LLM-based Web agents can complete user tasks autonomously, but deceptive interfaces can steer them toward outcomes against users' interests. The paper identifies a failure mode in which a task-valid action still causes an unauthorized consequence due to the current Web state. The proposed Veer defense builds a prospective intervention trajectory toward a safe state and verifies it before modifying the live environment. On TrickyArena and WebDecept, Veer achieves the highest safe task completion across three evaluation settings and reduces dark-pattern success on WebDecept to 0.3%.

JevVibe: Classification-guided method for making AI-generated code more secure

2026-09-28T00:00:00+09:00

JevVibe: Efficient Classification-Guided Secure Code Generation arXiv · Sep 28, 2026This paper addresses security weaknesses in code generated by large language models. It introduces Jev, a decision model that selects Common Weakness Enumeration (CWE) labels directly from candidates and returns probabilities, and evaluates it on a 50-way classification task using 1,916 CyberSecEval examples. Jev outperforms six open-weight baselines and, compared with GPT-5.6-Sol, performs better on Top-3 and Top-5 accuracy with much lower latency and cost. The authors also build JevVibe, a repair agent guided by Jev's diagnoses, which raises the security pass rate from 63.5% to 70.7%, above 66.1% for LLM-guided repair.

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards

2026-09-28T00:00:00+09:00

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards arXiv · Sep 28, 2026This arXiv paper introduces DGF-Bench, a benchmark in which AI agents act as a governance board reviewing synthetic project dossiers while an attacker plants deceptive content in unvouched evidence. Most tested models reached correct outcomes on nearly all gates without attacks, but attacks that imitate the organization's own process markedly lowered some models' correct-decision counts. The paper defines a DGF score for the share of attacks a model blocks and releases the open-source package dgf-bench to compute it.

JEV as a Judge for Agent Trace Security: Comparing a Typed Model with Generative LLM Judges

2026-09-28T00:00:00+09:00

JEV as a Judge for Agent Trace Security: An Empirical Comparison with Generative LLM Judges arXiv · Sep 28, 2026This paper examines whether JEV, a typed decision model, can serve as a judge for classifying security risks in tool-using agent traces, compared with generative LLM judges. Across four benchmarks totaling 5,219 trajectories, JEV achieves a higher average positive-class F1 (77.8) than the strongest generative configuration, GLM-5.2 (74.1). JEV's median latency is 0.99 seconds and its estimated cost is about $0.000195 per valid judgment. The authors conclude JEV is an economical screening signal, with trade-offs in precision and recall.

Physics-Verified Federated Learning: Protecting Collaborative Anomaly Detection in Critical Water Infrastructure

2026-09-28T00:00:00+09:00

Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure arXiv · Sep 28, 2026This paper addresses data poisoning in federated learning, where fabricated telemetry can corrupt shared intrusion detection models. The authors use physical process invariants, such as conservation laws and actuator couplings, mined from clean data as a verifiable admission gate for federated updates. They evaluate seven aggregation rules on the SWaT and WADI water testbeds and the BATADAL benchmark against fabrication, replay poisoning, and adaptive adversaries. The paper also uses zk-SNARKs so clients can prove invariant compliance without revealing operational telemetry.

Improving and securing image watermarking channels for traceable AI content.

2026-09-28T00:00:00+09:00

Optimizing and Securing the Modern Watermarking Channel for Images arXiv · Sep 28, 2026Recent rules require traceable generated content, so modern watermarking uses post-hoc multi-bit schemes built from neural encoder-decoder pairs. The paper analyzes these networks statistically and shows they implicitly form parallel AWGN channels with BPSK modulation, which limits capacity and lacks a secret key, making them insecure. Based on this analysis, it introduces SNW, a post-hoc watermarking system that significantly outperforms state-of-the-art baselines in capacity and offers strong security guarantees. ★★★★ Notable: The authors model deep watermarking encoder-decoder pairs as parallel BPSK-AWGN channels, link security to key estimability, and report that their SNW system exceeds baselines in capacity and approach

StallGrid: A protocol-native tarpit that stalls scanners in industrial control systems, with internet-exposure measurements

2026-09-28T00:00:00+09:00

StallGrid: Measuring Internet-exposed Engagement in Protocol-Native OT Tarpits arXiv · Sep 28, 2026This paper presents StallGrid, described as the first application-layer tarpit for OT/ICS, which stalls scanners using Modbus exception codes and prolonged IEC-104 connected states. Five variants ran for 24 days, logging 6,709 sessions and over 2,000 hours of accumulated connection engagement. The authors position protocol-native tarpitting as a low-cost complementary defense where patching is infeasible.

AuxMark: A Watermark Against Unauthorized Agent Distillation

2026-09-28T00:00:00+09:00

AuxMark: Defending Against Unauthorized Agent Distillation via Auxiliary Behavioral Watermarking arXiv · Sep 28, 2026This paper introduces AuxMark, a behavioral watermarking framework for detecting when AI agent trajectories are illegally used to train student agents. It inserts harmless auxiliary actions into teacher agent trajectories and stores the surrounding context as private evidence cards, then audits suspect models through a black-box sign test. Across three agent benchmarks, two teacher agents, and four student architectures, the authors report detecting all 24 distilled models with zero false positives on 48 clean models. The method is also reported to remain effective against flooding, paraphrasing, truncation, and adaptive cleaning attacks.

SEAD: A State-Based View of Attacks and Defenses in Tool-Using Agents

2026-09-28T00:00:00+09:00

SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents arXiv · Sep 28, 2026This paper frames attacks and defenses on language-model agents that use tools as partially observed state control, since earlier actions can change state so that a later routine-looking action becomes harmful. The attack method DART breaks harmful goals into locally plausible steps and uses real tool-execution feedback to guide search. The defense method SAGE investigates relevant state through read-only queries before allowing or blocking each action. Reported results include DART improving semantic attack success by 18.8 to 35.9 points, SAGE preserving 95.79% of benign trajectories while intercepting 92.73% of harmful paths, and reducing DART's executable attack success from 48.0% to 4.0% in online evaluation. ★★★★ Notable: Unifies attack and defense as partially observed state control, proposing DART for decomposed attacks and SAGE for pre-execution read-only defense; the authors report executable attack success falling

CoDeL: Co-evolving defense that trains LLM agents to resist hidden prompt-injection attacks

2026-09-28T00:00:00+09:00

CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents arXiv · Sep 28, 2026This paper presents CoDeL, a training-based defense that protects LLM-based agents from indirect prompt injection, where malicious instructions hide in external tools or content. The defender is updated with LoRA-based GDPO using a decoupled reward covering safety, task progress, and format compliance. A co-evolving prober searches for injections that still succeed against the current defender, creating a shifting training curriculum. Experiments on three benchmarks, nine baselines, and two base models report an 88.5% reduction in attack success rate. ★★★★ Notable: Proposes CoDeL, co-evolving a defender and prober that mines latency-guided injections into a moving curriculum; the authors report an 88.5% ASR reduction across three IPI benchmarks and nine baseline

Evaluating How Well Windows Malware Detectors Resist Evasion Attacks

2026-09-28T00:00:00+09:00

Breaking Windows Malware Detection: A Comprehensive Evaluation of Problem-Space Adversarial Robustness arXiv · Sep 28, 2026This paper evaluates nine state-of-the-art evasion attacks against eight Windows malware detectors, seven open-source and one commercial, while keeping modified samples executable. It measures robustness through attack effectiveness, complementarity, transferability, and adversarial hardening. The authors find that detector vulnerability depends on model representation and attack type, and that no detector family is uniformly robust across all attacks.

ReproBench: Testing AI Agents on Rebuilding Software Vulnerabilities from Scratch

2026-09-28T00:00:00+09:00

ReproBench: Benchmarking LLM Agents on Reproducing Vulnerability From Scratch arXiv · Sep 28, 2026This paper introduces ReproBench, a benchmark that tests whether LLM agents can reproduce a vulnerability starting only from a CVE identifier, including rebuilding the execution environment. The reproduction workflow is split into six phases, each evaluated with verifiable artifacts. Using 30 real-world IoT firmware vulnerabilities, the authors found that 45.3% of runs resorted to vulnerability simulation, while only 5.3% of CVE-model pairs reproduced real vulnerabilities successfully.

Quantum security of the XOR of random permutations, analyzed with Fourier methods

2026-09-28T00:00:00+09:00

Quantum Security of XOR of Permutations via Fourier Analysis arXiv · Sep 28, 2026This paper studies whether the XOR of several independent random permutations (XoP) stays secure against quantum attacks that query it in superposition. The authors prove explicit upper bounds on the advantage of any q-query quantum algorithm in distinguishing XoP from a random function. The bounds hold across the whole query range well beyond the 2^(n/3) limit from quantum collision finding. The proof uses a Fourier-analytic version of the polynomial method. ★★★★★ Notable: The authors show XOR of r≥2 random permutations is hard to distinguish from a random function under q quantum queries, via a Fourier-analytic polynomial method, claiming the first quantum beyond-birth

Before Agents Act: Assurance-Aware Semantic Scheduling for Distributed Evidence Acquisition

2026-09-28T00:00:00+09:00

Before Agents Act: Assurance-Aware Semantic Scheduling for Evidence Acquisition in Distributed Systems arXiv · Sep 28, 2026The paper proposes Assurance-Aware Semantic Scheduling (AAS), which jointly selects witnesses and schedules evidence acquisition under quorum, diversity, freshness, deadline, and resource constraints, so that tool-using agents do not act on expired evidence before infrastructure changes. In three generated infrastructure workloads, AAS produced 1,075 of 1,200 valid candidates versus 647 for a constraint-aware forward scheduler, and reduced stale candidates from 440 to 12. The authors stress these are controlled simulation results, that the bounded oracle shares a temporal search component, and that transfer to deployed systems is untested.

RADNPO: A reference-free method for making LLMs forget specific content

2026-09-28T00:00:00+09:00

RADNPO: Reference-free Adaptive Negative Preference Optimization for LLM Unlearning arXiv · Sep 28, 2026Large language models can memorize sensitive, private, or copyrighted text from pre-training, so unlearning methods are needed to remove targeted knowledge. This paper proposes RADNPO, which suppresses forget targets while explicitly guiding how the next-token probability is redistributed. It contrasts each target with alternative tokens favored by the current distribution and adjusts forgetting strength using target confidence and distribution concentration. Experiments on TOFU and MUSE show it achieves a better trade-off between forgetting quality and model utility than current baselines.

Long-term outage planning using scenario-based system load forecasts

2026-09-28T00:00:00+09:00

Long-Term Operational Planning Using Scenario-Based System Load Forecasting arXiv · Sep 28, 2026Rapid growth of hyperscale data centers in Northern Virginia is increasing electricity demand, requiring transmission reinforcement that needs planned outages evaluated months ahead. Conventional studies use monthly or seasonal peak-load assumptions, which can be overly conservative and cause short outages to be postponed or denied. This paper compares daily, weekly, and monthly load forecasts built with SARIMA, Prophet, Gradient Boosting, and Random Forest, reconciled bottom-up across horizons, against peak-based methods. Results indicate granular forecasts reduce unnecessary conservatism and accommodate outages better, especially short ones, without changing reliability criteria.

Faultless: a technique for checking whether neural decompilers' code matches the original program.

2026-09-28T00:00:00+09:00

Faultless: A Program Equivalence Technique for Validating and Evaluating Neural Decompilers arXiv · Sep 28, 2026This paper introduces Faultless, a program equivalence technique for translation validation of neural decompilers. It compares neural decompiler output with code from a deterministic decompiler or a reference solution. The authors note that neural decompilation poses challenges such as limited extrafunctional context and systematic semantic inconsistencies, which existing methods do not handle well. Faultless uses a static symbolic execution approach with an execution model and memory model designed for these challenges.

LoRo-Mark: A Provably Lossless and Robust Watermark for LLM Agents

2026-09-28T00:00:00+09:00

LoRo-Mark:Provably Lossless and Robust Agent Watermarking arXiv · Sep 28, 2026This paper addresses the problem of LLM agents being repackaged and presented under another party's identity. It proposes LoRo-Mark, a watermarking mechanism that embeds ownership evidence without affecting normal functionality. The watermark is placed in a cryptographically authenticated forensic branch that activates only on owner-authorized requests, and ownership information is redundantly spread across forensic behavior sequences for recovery after partial modification. Experiments on multiple LLM agents report no degradation on normal tasks and reliable ownership verification under sequence modifications.

GateDrain: Availability attacks and admission defense for confidence-gated edge-cloud AI

2026-09-28T00:00:00+09:00

GateDrain: Availability Attacks and Admission-Side Defense for Confidence-Gated Edge-Cloud Inference arXiv · Sep 28, 2026This paper shows that confidence-gated edge-cloud inference, which sends uncertain inputs to a cloud model, creates an availability attack surface. The proposed GateDrain attack uses bounded input perturbations to lower confidence, redirecting requests that would be answered locally into a shared cloud queue without raising the application request rate. The authors also propose Bounded Escalation, a containment defense combining per-source admission budgets, protected capacity, and trusted-class priority. The paper notes that tighter aggregate containment can reject legitimate unauthenticated offloads and reduce overall accuracy through edge fallback.

Privacy risks of crowdsourced fine-tuning: poisoning data to extract others' records

2026-09-28T00:00:00+09:00

The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoning arXiv · Sep 28, 2026This paper examines a privacy risk in supervised fine-tuning of language models that uses crowdsourced user conversations, where untrusted users can contribute data. The authors show that a malicious user can poison a small fraction of the data to amplify extraction of other users' unseen instructions, using only black-box, output-only access to the model. Experiments on four models and two datasets show near-verbatim extraction rising to 3.71 times the unpoisoned rate with 50 poisoned examples. The authors also find that data filtering detects poisoned samples poorly, with the best method reaching only 0.378 F-1.

TrackFlood: Shifting Latency Attacks from NMS-Free Detectors to Real-Time Trackers

2026-09-28T00:00:00+09:00

TrackFlood: Relocating Latency Attacks from NMS-Free Detectors to Real-Time Trackers arXiv · Sep 28, 2026This paper studies latency attacks on object detectors, aiming to make systems respond too late rather than corrupt predictions, with real-time applications such as autonomous driving in mind. The authors propose TrackFlood, a white-box overload attack that floods the tracker in NMS-free detect-then-track pipelines with phantom detections while detector inference stays unchanged. Tests on an NVIDIA Jetson AGX Orin show tracker latency rising substantially, and a lightweight bounded-admission layer is evaluated as a mitigation. ★★★★ Notable: The authors argue NMS-free detectors remain latency-attackable, relocating the surface to downstream tracking; on Jetson, TrackFlood raises tracker latency while detector latency stays flat, with mode

A2A-ForensicTrace: offline checking of tamper-evident records from agent-to-agent interactions

2026-09-28T00:00:00+09:00

A2A-ForensicTrace: Offline Verification of Tamper-Evident A2A Runtime Evidence arXiv · Sep 28, 2026This paper presents A2A-ForensicTrace, an offline verification layer for runtime evidence from Agent2Agent (A2A) executions. It turns runtime observations into typed records, derives protocol-related relationships, and commits them under an incident-trace root, with an Ed25519-signed receipt binding the root to the incident context. The evaluation ran 240 executions through the official A2A SDK, including 120 condition runs and 120 matched controls, and all condition runs returned the expected findings while no control raised an indication.

Training Witnesses: Verifying training runs without trusting the trainer

2026-09-28T00:00:00+09:00

Training Witnesses: Trusting the Training without Trusting the Trainer arXiv · Sep 28, 2026This paper introduces Witnesses, a method for certifying neural network training, data usage, and evaluation. It relies on fast behavioral fingerprints combined with occasional replay challenges to audit training, with low overhead for the trainer and low cost for the verifier. The method was tested on language model training runs from 100M to 2B parameters, and the authors also propose a self-regulating leaderboard of auto-certified runs to support shared baselines and reproducibility. ★★★★ Notable: Proposes auditing training with behavioral fingerprints and occasional replay challenges, shifting the verification burden to the trainer; the authors report low overhead on 100M–2B language models un

A2A-CaseVerify: Merkle-linked verification of case evidence for cross-organization A2A workflows

2026-09-28T00:00:00+09:00

A2A-CaseVerify: Merkle-Linked Case-Evidence Verification for Cross-Organization A2A Workflows arXiv · Sep 28, 2026The paper presents A2A-CaseVerify, a deterministic offline verifier that maps A2A runtime objects, business events and typed support edges into a directed case evidence graph committed by a deterministic Merkle root. It returns SUPPORTED only when protection and profile-specific reconstruction checks pass. Evaluated on one canonical healthcare-profile bundle and 13 controlled mutations, the canonical and SDK-generated bundles were accepted and all mutations were rejected.

Near-duplicate families cause false membership attribution for exact records

2026-09-28T00:00:00+09:00

Near-Duplicate Families Break Exact-Record Membership Inference arXiv · Sep 28, 2026Membership inference asks whether a specific record was in a model's training set and is increasingly used as evidence in data provenance and copyright auditing. The paper shows that near-duplicate content common in web-scale data confounds standard methods: on CC-News, a clean-reference LiRA auditor labeled 99.70% of family-present exact non-members as members at a 1.00% false-positive rate. The authors conclude that positive model-only evidence may establish family-level exposure without establishing exact-record provenance. ★★★★★ Notable: Introduces a four-world audit showing near-duplicate families cause severe false membership attribution; the authors report that a clean-reference LiRA auditor labels 99.70% of family-present exact no

Can prompt anonymity stop LLM providers from re-identifying users?

2026-09-28T00:00:00+09:00

Can Prompt Anonymity Protect Your Identity From LLM Providers? arXiv · Sep 28, 2026This paper examines whether anonymizing proxies, which separate user identity from prompts, still let LLM providers re-identify users through the prompt content they can see. The authors built PromptAnonBench, a benchmark of over 175,000 cleaned multi-turn prompts from SWE-Chat and WildChat. Even with text-based defenses, an attacker could re-identify at least one anonymized conversation for 50–75% of SWE-Chat users and up to 10% of WildChat users at a 10% false acceptance rate.

"No Free Efficiency": a paper on how making model training cheaper can weaken robustness and security.

2026-09-28T00:00:00+09:00

No Free Efficiency: Revisiting the Trade-off Between Training Efficiency and Model Vulnerability arXiv · Sep 28, 2026The paper systematically studies the trade-off between training efficiency and model vulnerability across vision and language models. It finds that efficiency-oriented training increases susceptibility to adversarial and privacy attacks, linked to sharper loss geometry and changed representational structure. Models trained with simplified zero RL recipes show greater catastrophic forgetting and overconfidence than those trained with conventional alignment. The authors call for multi-objective training that jointly optimizes performance, cost, and security.

The Cost of Stability: Deanonymizing Onion Services' Long-Lived Introduction Circuits

2026-09-28T00:00:00+09:00

The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits arXiv · Sep 28, 2026This paper presents an intersection attack that exploits the fixed 18 to 24 hour introduction circuits used by Tor onion services. An adversary observing one Tor relay at a time can use this stability to identify an onion service's network location. The authors tested the attack on the live Tor network against a self-operated service, reconstructing the full circuit in all nine end-to-end runs. They also propose periodically rebuilding internal introduction circuits to limit evidence accumulation without changing publicly advertised information. ★★★★★ Notable: Exploits the design in which onion service introduction circuits stay fixed for 18 to 24 hours to propose an intersection attack that lets an adversary observing one relay at a time locate an onion se

RAISE: Improving LLM Access-Control Policy Synthesis with Symbolic Evaluation

2026-09-28T00:00:00+09:00

RAISE: Reinforcing Access Control Policy Synthesis in LLMs via Symbolic Evaluation arXiv · Sep 28, 2026The paper introduces CedarInstruct, a dataset of 5,800 scenarios across 44 domains with verified target policies and executable verification plans for Cedar policy synthesis. It proposes RAISE, a two-stage method combining verified supervised fine-tuning with reinforcement learning driven by verifier signals. The RAISE-OC variant, which uses failed checks and symbolic counterexamples for guided exploration, is reported to outperform zero-shot GPT-6 Astra and Claude Opus 5 on held-out semantic success, and the training transfers to the independently built CedarBench.

Tokens Change, Structure Endures: Spectral Watermarking for Generated Speech

2026-09-28T00:00:00+09:00

Tokens Change, Structure Endures: Spectral Watermarking for Generated Speech arXiv · Sep 28, 2026This paper proposes Redwing, a training-free token-level watermarking method for AI-generated speech that works during generation. It addresses retokenization, where decoding speech to audio and re-encoding it changes token identities and weakens the watermark. Redwing builds a graph from observed token substitutions and jointly optimizes embedding and detection functions over its Laplacian basis. On the Moshi system after eight Mimi resynthesis passes, it reaches 80.7% TPR at 1% FPR, versus 8.3% for KGW. ★★★★ Notable: Redwing builds a graph Laplacian basis from retokenization substitutions and jointly optimizes embedding and detection; on Moshi after eight Mimi passes it reports 80.7% TPR versus 8.3% for KGW and at

SecProbe: An adaptive test of whether coding AI agents can spot and fix security flaws

2026-09-28T00:00:00+09:00

SecProbe: Adaptive Evaluation of Coding Agents on Cybersecurity Vulnerabilities arXiv · Sep 28, 2026SecProbe is a framework that adaptively evaluates coding agents on cybersecurity vulnerabilities by combining Item Response Theory with on-demand synthesis of repository-scale vulnerability-repair tasks. The authors built 353 tasks covering six programming languages and 151 CWE types, and evaluated nine frontier models with two agent harnesses. Success rates peaked at 28.33%, and compared with random and one-shot baselines, SecProbe gave comparable ability estimates while requiring up to 29.5% fewer tasks.

MAD-Guard: Comparing Token Generation and Direct Decision Outputs for Multimodal Forensic Tasks

2026-09-28T00:00:00+09:00

MAD-Guard: Controlled Study of Autoregressive Generation versus Direct Decision Interfaces for Closed Multimodal Forensic Tasks arXiv · Sep 28, 2026This paper studies whether multimodal models need to generate tokens autoregressively or can output forensic decisions directly. Using the same backbone and training budget, it compares several decision interfaces on latency, calibration error, and accuracy. A binary direct head cuts latency by 2.60 to 7.27 times and lowers calibration error, at a small accuracy cost, while multi-task and contrastive head variants outperform the autoregressive baseline. Across five benchmarks, the approach performs well on synthetic, camouflage, and document forgeries but shows a clear limitation on compressed face manipulation.

COGNIT-Guard: A calibrated safety filter that screens prompts on a CPU and NPU before they reach a language model

2026-09-28T00:00:00+09:00

COGNIT-Guard: Calibrated Standalone Direct-Decision Guardrails with Heterogeneous CPU-NPU Confidence Cascading under Explicit Latency and False-Positive Constraints arXiv · Sep 28, 2026This paper presents COGNIT-Guard, a real-time system that checks user prompts for safety before they reach a target LLM. A fast CPU gatekeeper hands uncertain cases to a 322M-parameter direct-decision model running on an NPU. On the unseen DUCS-Bench test split it reports 98.85% accuracy and a 0.42% benign false-positive rate, with mean latency of 41.63 ms for the cascade. The authors also evaluate out-of-domain accuracy on SafetyBench-ZH and show that experience replay recovers performance lost to alignment.

The Cost of Peeking: Anytime-Valid Leakage Detection on ML-KEM Traces

2026-09-27T00:00:00+09:00

The Price of Peeking: Anytime-Valid Leakage Detection on ML-KEM EM Traces arXiv · Sep 27, 2026Side-channel evaluators often check leakage tests during data collection and decide whether to continue or stop based on the results. This paper studies anytime-valid leakage detection using betting-based tests, which keep the false-alarm probability controlled at all times under an explicit conditional symmetry null. On an open ML-KEM electromagnetic dataset, the method needed about 1.68 to 2.38 times as many traces as a fixed-horizon randomization test to detect leakage in synthetic and degraded recordings. On undegraded recordings, the monitored procedure stopped early, with median stopping points of 62 to 316 traces.

Information Blackhole: a study of backdoor attacks on 3D point cloud autoencoders

2026-09-27T00:00:00+09:00

Information Blackhole: Exploring Backdoor Mechanism in 3D Point Cloud Reconstruction arXiv · Sep 27, 2026Point cloud autoencoders are core tools for representing 3D scenes, yet backdoor attacks on them remain little studied. The paper argues that the generative latent space mixes benign and malicious data, so reconstructions can collapse toward the source data. The authors propose the Information Blackhole principle and Adaptive Gaussian Matching (AGM), which regularizes poisoned latent distributions to improve attack controllability. Experiments on ModelNet and ShapeNetPart are reported.

Where the Numbers Come From: Auditing Provenance-Based Intrusion Detection Evaluation

2026-09-27T00:00:00+09:00

Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection arXiv · Sep 27, 2026The paper audits nine released provenance-based intrusion detector implementations and runs four of them with their own code. It identifies three measurement effects: ThreaTrace reports 0.938 precision with neighbourhood credit, though only 7 of its 994 alarms carry its own attack label; removing test-label checkpoint selection lowers attack detection precision by 0.16 to 0.33; and a buffer-reuse defect gives a linear encoder unintended degree-dependent inputs.

What It Means to Forget a Person: Individual-Level Unlearning in Vision-Language Models

2026-09-27T00:00:00+09:00

What Does It Mean to Forget a Person? Individual-Level Unlearning in Vision-Language Models arXiv · Sep 27, 2026This paper introduces IDUnlearn-Bench, the first benchmark for individual-level multimodal unlearning in vision-language models (VLMs). It represents each person as connected multimodal evidence and evaluates four task families: attribute access, identity access, identity binding, and identity reconstruction. Experiments show that attribute-centric forgetting often leaves substantial identity-level knowledge intact, and that reducing one risk can amplify another.

HESP: A controller that separates what to probe from when to stop in local LLM alert triage

2026-09-27T00:00:00+09:00

HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents arXiv · Sep 27, 2026Security operations centers receive more alerts than analysts can handle, and organizations that cannot send telemetry to hosted models must automate triage with small open-weight LLMs on their own hardware. The paper presents HESP, a controller that keeps the investigation procedure outside the model, tracking competing explanations, choosing read-only probes by expected information gain per cost, accepting only evidence-backed verdicts, and ending investigations itself. Across five open-weight models (7B to 72B) and 7,272 audited episodes in a controlled triage environment, HESP substantially raises verified completion, showing that choosing what to probe and deciding when to stop are separable failures.

Bypassing Expression Sandboxes in Orchestration Platforms: Flaws in Enumerate-and-Block Security

2026-09-27T00:00:00+09:00

Weird Machine Compositors: Exploiting AI Orchestration at the Expression Layer arXiv · Sep 27, 2026This paper argues that enumerate-and-block expression sandboxes in orchestration platforms are fundamentally unfixable. Using n8n's expression sandbox, the authors demonstrate three escalating bypasses that produced three CVEs. They also describe a trust laundering pattern and how AI-assisted enumeration speeds up discovery of coverage gaps, and they offer a coverage analysis method, an open-source tool, and an allowlist-based mitigation.

Why API secrets should stay out of LLM tokens: threat analysis and vault-mediated execution for AI agents

2026-09-27T00:00:00+09:00

API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary arXiv · Sep 27, 2026This paper examines how API credentials can leak when tool-using LLM agents handle them, such as through prompts, logs, or memory. It proposes a vault-mediated design in which the model picks a connector identifier while a trusted boundary supplies authentication. In two controlled black-box experiments on the Corvic Security Vault implementation, all 16 probes met their expected outcomes, with the credential absent from the locations tested. The authors also report a failed connector configuration and state that vault mediation is necessary but not sufficient.

Security Analysis of 84 Candidate Public-Key Schemes in a Chinese Crypto Competition

2026-09-27T00:00:00+09:00

Cryptanalysis of the ICCS NGCC Round-1 Public-Key Candidates IACR ePrint · Sep 27, 2026This paper reviews the 84 public-key candidates submitted to the ICCS NGCC round-1 public evaluation, focusing on design flaws that local code fixes cannot resolve. It identifies eight such weaknesses, similar to known pitfalls from NIST post-quantum standardization, including sub-ring projections that reduce IND-CPA security, public data that exposes supposedly secret values, static key reuse without a chosen-ciphertext transform, and rejection sampling that leaks an equivalent signing key. The authors state that all findings were obtained with AI assistance and provide a link to their artifacts.

Closing the Gap: Rigorously Proving and Strengthening RPKI Security

2026-09-27T00:00:00+09:00

Mind the Gap: Proving and Improving RPKI IACR ePrint · Sep 27, 2026This paper presents the first rigorous security analysis of the Resource Public Key Infrastructure (RPKI), an IETF standard that protects inter-domain routing against prefix and subprefix hijacks. Using modular security specifications, it analyzes RPKI's interactions with BGP and IP and identifies sufficient conditions under which RPKI provably meets its goals. The authors find that existing deployments do not always satisfy these conditions, for example due to circular dependencies, and propose standard-compliant improvements.

Enhanced parallel attacks on EC-HMQV-C and ECMQV protocols

2026-09-27T00:00:00+09:00

Enhanced Embarrassingly Parallel Attacks against EC-HMQV-C and ECMQV IACR ePrint · Sep 27, 2026This paper extends a 2025 parallel impersonation attack by Sarr on ECMQV and EC-HMQV-C to a multi-party setting with initiators and responders. It presents three attacks with estimated parallel running times and per-processor memory costs. For a 128-bit EC-HMQV-C instance on an idealized massively parallel architecture, the improved attack is said to correspond to 78 bits of security in parallel time.

Practical null-branch witness attacks on AIMer v2.0 in-the-head signatures

2026-09-27T00:00:00+09:00

Practical Null-Branch Witness Attacks on In-the-Head Signatures IACR ePrint · Sep 27, 2026This paper presents a classical, public-key-only forgery attack on the AIM2-based AIMer v2.0 signature scheme, which was selected in Korea's KpqC competition. For every honestly generated public key, the authors claim signatures on arbitrary messages can be forged without signing queries. The attack exploits zero factors that leave intermediate values unconstrained, completing them into witnesses that satisfy the full relation. The paper also argues that a satisfying witness need not decode to a one-way function preimage, revealing a gap in AIMer's security reduction.

Complete classification of whole-output linear structures in FEILIAN-type components

2026-09-27T00:00:00+09:00

A Complete Classification of Whole-Output Linear Structures in FEILIAN-Type Components IACR ePrint · Sep 27, 2026The paper determines all input differences that give constant whole-output XOR derivatives for a four-word ARX structure containing a FEILIAN SubColumn. For any word width and XOR-linear internal maps, the linear-structure space contains a universal two-dimensional MSB family and has dimension at most five, with this bound attained. For the 64-bit FEILIAN component, the complete space equals this universal family. The results concern component structure and constancy at successive boundaries, and do not classify all endpoint structures of the iterated permutation or establish an attack on the hash.

Lower bounds on signature length for hash-based schemes in the random oracle model

2026-09-27T00:00:00+09:00

Lower Bounds on Random-Oracle-Model Signature Length IACR ePrint · Sep 27, 2026The paper asks whether the large signature size of hash-based post-quantum signatures is unavoidable. Within the pure random oracle model, it proves lower bounds for schemes with non-adaptive verifiers that satisfy a property called salted soundness. For one-time signatures, the combined public key and signature length must be Ω(λ²/log λ), and for many-time signatures the signature length alone must meet this bound.

Threshold signatures that identify who aborts, built from one-way functions

2026-09-28T00:00:00+09:00

Threshold Signatures with Identifiable Abort from One-way Functions IACR ePrint · Sep 28, 2026This paper presents a threshold signature scheme in which N participants share a signing key so that any T of them can jointly produce a valid signature. It builds on a variant of Lamport one-time signatures and Shamir secret sharing, and supports identifiable abort. The scheme is extended to multiple messages using multi-layer Merkle trees, with a bulletin board used to coordinate one-time key usage.

One Unverified Coordinate Is Enough: Key Recovery from Faulty FO Rejection Checks in ML-KEM

2026-09-28T00:00:00+09:00

One Unverified Coordinate Is Enough: Key Recovery from Faulty Fujisaki–Okamoto Rejection Checks in ML-KEM IACR ePrint · Sep 28, 2026This paper examines what happens when the Fujisaki–Okamoto re-encryption check in ML-KEM is implemented incorrectly, as some deployed libraries reportedly do by skipping a conditional move or truncating ciphertext comparisons. The authors show that a single unverified ciphertext coordinate is enough for an attacker to recover the secret key from bounded-error observations via least squares. They prove that O(kn log kn) observations suffice under a regularity assumption and demonstrate full recovery on all three parameter sets against a simulated implementation. ★★★★★ Notable: The authors report that one unverified ciphertext coordinate enables least-squares ML-KEM key recovery, prove O(kn log kn) observations identify the key, and report full recovery on a simulated incomp

Improved attacks on local pseudorandom generators using XorMaj predicates

2026-09-28T00:00:00+09:00

Improved Cryptanalysis of Local PRGs IACR ePrint · Sep 28, 2026The paper presents two seed-recovery attacks on local PRGs that apply XorMaj predicates to map an n-bit seed to an m-bit pseudorandom string. The Guess-Filter-Solve (GFS) attack extends the GAS framework and outperforms GAS, especially for short outputs. The Filter-Guess-Propagate (FGP) attack speeds up Belief Propagation compared with GADec. Both are extended to XorMod predicates and applied to a ZKP protocol and QuietOT, yielding attacks on witness indistinguishability and OT receiver privacy respectively.. ★★★★ Notable: The authors propose GFS and FGP seed-recovery attacks on local PRGs, reporting far lower complexity than GAS and GADec (e.g., n=256, m=2^16) and extensions to XorMod and two protocols.

Quantum security of XOR of permutations via Fourier analysis

2026-09-28T00:00:00+09:00

Quantum Security of XOR of Permutations via Fourier Analysis IACR ePrint · Sep 28, 2026This paper studies the quantum security of the XOR of r independent random permutations (XoP), a construction that goes beyond the birthday bound classically. The authors prove that XoP is indistinguishable from a random function for quantum algorithms making up to about 2^n/57774 queries, far beyond the quantum birthday bound. They use a Fourier-analytic polynomial method and present heuristic attacks suggesting the bounds are nearly tight. ★★★★ Notable: The authors show XOR of r≥2 random permutations is quantum beyond-birthday indistinguishable from random functions for q up to 2^n/57774, using Fourier analysis and compressed oracles, with heuristic

Error-aware scale design for faster encrypted LLM inference

2026-09-28T00:00:00+09:00

Error Propagation-Aware Scale Design for Efficient Homomorphic Encryption-Based LLM Inference IACR ePrint · Sep 28, 2026This paper proposes a scale design for CKKS-based privacy-preserving LLM inference that accounts for how numerical errors propagate through Transformer computations. It assigns operation-wise scales and modulus levels based on the precision each operation requires, reducing unnecessary conservatism. Reported results show modulus consumption reduced by 30.0% and bootstrapping operations reduced by 83.6% versus THOR on a standard Transformer, and by 33.6% and 80% versus PowerFormer on an HE-friendly Transformer.

TPOKÉ: A Threshold Public-Key Encryption Scheme Built on POKÉ

2026-09-28T00:00:00+09:00

TPOKÉ: Threshold Public-Key Encryption from POKÉ via Isogeny Sharing IACR ePrint · Sep 28, 2026This paper presents TPOKÉ, threshold public-key encryption schemes based on POKÉ, an efficient isogeny-based encryption scheme. The main construction, S-TPOKÉ, supports any (t,n) threshold, while Ch-TPOKÉ arranges the parties' secret isogenies in a chain for the (n,n) case. Compared with running n independent POKÉ instances, both schemes reduce the number of isogenies computed during encryption and roughly halve ciphertext size for large n.

Operator-norm method for security with quantum advice

2026-09-28T00:00:00+09:00

An Operator-Norm Approach to Security with Quantum Advice IACR ePrint · Sep 28, 2026This paper introduces an operator-norm approach to non-uniform security in the quantum random oracle and random permutation models. It gives a unified reduction covering both search success probability and distinguishing advantage. The framework yields tighter bounds for Yao's box and pseudorandom generators, and an optimal generic salting theorem for decision games. ★★★★★ Notable: The authors present a unified operator-norm framework for non-uniform security, reporting tight bounds for Yao's box and salting and improved decision-game bounds.

Improved near-capacity lower bound for Reed-Solomon lists on multiplicative subgroups

2026-09-28T00:00:00+09:00

An improved near-capacity lower bound for Reed-Solomon lists on multiplicative subgroups IACR ePrint · Sep 28, 2026The paper gives an elementary construction of large Reed-Solomon lists on multiplicative subgroups. For fixed rational rates, the leading entropy exponent of list sizes doubles the antipodal bound of Arnon, Boneh, and Fenzi. It also shows that the exponent constant c2 in the S-two whitepaper's universal list-size conjecture must be at least 2.

Binding Humans to Keys: A Decentralized Proof of Personhood Protocol

2026-09-28T00:00:00+09:00

Binding Humans to Keys: A Secure Decentralized Proof of Personhood Protocol IACR ePrint · Sep 28, 2026This paper proposes S-GYID, a decentralized protocol that cryptographically links a digital identity to one unique living person without a trusted central authority. It replaces raw biometric transmission with an encryption-based digital fingerprint, aiming to resist identity theft and ghost key attacks. The protocol also uses a three-tier generational authority hierarchy with bounded tenure and VRF-based session selection to limit collusion. The authors prove resistance properties under standard cryptographic assumptions and provide a hypergeometric analysis for setting parameters.

Geometric Forgeries: Structural Cryptanalysis of MAYO. A paper attacking the post-quantum signature scheme MAYO by exploiting its underlying mathematical structure.

2026-09-28T00:00:00+09:00

Geometric Forgeries: Structural Cryptanalysis of MAYO IACR ePrint · Sep 28, 2026MAYO is a post-quantum signature scheme based on UOV that uses whipping to make public keys more compact. The paper presents the first structural forgery attack exploiting the geometry of its multivariate quadratic maps, combined with the Pseudo-Oil Attack and a descent to the binary field. It also introduces a multi-target reduction for homogeneous MQ maps. The authors report that these attacks lower the estimated bit security of MAYO Round 2 Levels I and III by about 18 and 16 bits, with Level I falling 15 bits short, and reduce estimated security of the Round 3 parameters, leaving MAYO2 3 bits below its required level. ★★★★ Notable: The authors present the first forgery attack exploiting the geometry induced by MAYO's whipping transformation, plus a multi-target reduction for homogeneous MQ maps; they report Round 2 Level I falli

SUCRE: a masking countermeasure that protects ML-DSA rejection sampling from physical attacks

2026-09-28T00:00:00+09:00

ML-DSA masking sweetened with SUCRE: Shuffle-and-Unmask Countermeasure for REjection sampling IACR ePrint · Sep 28, 2026This paper presents SUCRE, a countermeasure that physically protects the rejection sampling step of ML-DSA, a NIST-standardized post-quantum signature scheme. Its masking gadget unmasks a vector while randomly permuting its coefficients, preserving the infinity norm so rejection sampling works without complex mask conversions. The authors give a formal proof against d-probing adversaries, based on a new MLWR variant with a concrete security analysis. The implementation runs four to six times faster than Coron et al. (TCHES 2024), at the cost of higher memory usage. ★★★★ Notable: The authors propose SUCRE, which unmasks while randomly permuting coefficients to protect ML-DSA rejection sampling; they give a d-probing proof and an MLWR variant analysis, reporting 4-6x speedup ov

Cyclotomic Cosets: a quantum sieve for hidden subgroups with prime-power moduli

2026-09-28T00:00:00+09:00

Cyclotomic Cosets: Hidden Subgroup and Quantum Sieving Algorithm for Prime-Power Moduli IACR ePrint · Sep 28, 2026This paper studies the Learning With Errors (LWE) problem, a basis of post-quantum cryptography, by introducing the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of the Dihedral Coset Problem that keeps an exact hidden-subgroup structure. The authors use a π-adic ideal chain in cyclotomic rings to build a quantum sieve that reduces phase states step by step. For fixed prime p and modulus q=p^t, they report solving CCP in time and sample complexity 2^{O_p(log n log q)}, with extensions to uniform EDCP and Gaussian cases. The authors state that this result alone does not yield a quasi-polynomial-time algorithm for standard LWE. ★★★★ Notable: The authors introduce the Cyclotomic Coset Problem and a π-adic quantum sieve extending power-of-two EDCP results to prime-power moduli, reporting quasi-polynomial time when q=poly(n) but not directly

Decryption failures in NGCC lattice KEMs under correlated blocks and omitted noise

2026-09-28T00:00:00+09:00

Decryption Failures in NGCC Lattice KEMs: Correlated Blocks, Omitted Compression Noise, and Failure Boosting under a Query Cap IACR ePrint · Sep 28, 2026This paper recomputes decryption failure probabilities for several lattice KEMs submitted to China's NGCC post-quantum competition. It examines three mechanisms: correlated decoding blocks, compression noise omitted from Cheetah's specification, and bounded noise in two-dimensional codes used by Rudraksh2 and Scabbard. The authors report that several estimated failure costs fall below nominal security levels under a 2^80 query cap. No key recovery attack is described. ★★★★ Notable: Identifies three decryption-failure mechanisms in NGCC lattice KEMs (correlated blocks, omitted compression noise, bounded 2D-code noise) and reports recomputed failure rates, with estimated costs bel

Adaptively UC-secure oblivious transfer built from group actions

2026-09-28T00:00:00+09:00

Adaptively UC-Secure Oblivious Transfer from Group Actions IACR ePrint · Sep 28, 2026This paper presents the first adaptively UC-secure oblivious transfer protocol based on group actions, assuming weakly pseudorandom effective group actions such as CSIDH. The receiver learns exactly one of the sender's two messages without revealing its choice. The authors follow the BC15 framework and address the lack of SPHF-friendly IND-CCA encryption from group actions by building a verifiable chameleon hash and a publicly verifiable scheme in the random oracle model.

Batch decryption under new standard assumptions

2026-09-28T00:00:00+09:00

Batch Decryption from New Standard Assumptions IACR ePrint · Sep 28, 2026This paper studies batch decryption, where an authority releases a short key allowing public decryption of a chosen batch of ciphertexts, motivated by encrypted mempools. It gives two constructions with different authorization semantics and assumptions. The first is an epochless RSA-group scheme based on Fiat's Batch RSA, with a single-group-element hint, proven adaptively secure under the strong RSA assumption in the random-oracle model. The second is a generic epoch-based identity-based encryption construction, instantiated from the computational Diffie-Hellman assumption. ★★★★ Notable: The authors give an RSA-group batch decryption scheme with no batch bound fixed at setup and size independent of batch size, reporting adaptive security under strong RSA; they also present an epoch-ba

Generic-group bounds for multi-instance problems, focusing on Inverse Diffie-Hellman

2026-09-28T00:00:00+09:00

Generic Bounds for Multi-Instance Problems: The Strange Case of Inverse Diffie-Hellman IACR ePrint · Sep 28, 2026This paper studies how hard multi-instance problems over prime-order groups are in the generic group model, where an adversary must solve at least k of n independent instances. It shows that multi-instance CDH and SDH are as hard as solving k independent discrete logarithms, while multi-instance IDH and LKDH can be significantly easier than multi-instance CDH in certain parameter regimes. All these problems offer 1/2(log(p)+log(k)) bits of security. The lower bounds extend Yun's hyperplane query model and are derived using algebraic geometry techniques. ★★★★★ Notable: The authors give generic-group bounds for multi-instance problems, report that multi-instance IDH can be significantly easier than CDH in some regimes, and extend Yun's hyperplane query model.

AEBAP: An efficient elliptic-curve-based authentication protocol for wireless networks

2026-09-29T00:00:00+09:00

AEBAP: An Efficient ECC-Based Authentication Protocol Designed for Wireless Networks IACR ePrint · Sep 29, 2026This paper proposes AEBAP, an authentication protocol based on elliptic curve cryptography (ECC) designed for secure communication in resource-constrained IoT environments. It aims to provide mutual authentication, data integrity, and resistance to passive and active attacks. The authors evaluate performance through experimental implementation and analyze security using informal reasoning and formal verification tools, Scyther and ProVerif. The paper reports strong security with minimal computational and communication overhead.

Improved differential-linear attacks on Orthros, Gleeok, ZIP-AES and ZIP-GIFT

2026-09-29T00:00:00+09:00

Improved Differential-Linear Cryptanalysis of Orthros, Gleeok, ZIP-AES, and ZIP-GIFT IACR ePrint · Sep 29, 2026This paper improves differential-linear distinguishers and gives key-recovery attacks on reduced-round versions of several pseudorandom functions. It extends the analyzed coverage of Orthros from 7 to 9 rounds and of Gleeok-128 from 4 to 5 rounds. The authors use automated differential and linear trail search together with existing round-based correlation estimation.

Factoring RSA Moduli via Affine-Padded Rabin Oracles at Special-Sieve Cost

2026-09-29T00:00:00+09:00

Affine-Padding Rabin-Oracle Factoring in L_nleft(frac13,√[3]frac329right) IACR ePrint · Sep 29, 2026This paper revisits the Joux-Naccache-Thomé construction for the Rabin case (e=2), using an affine-padded square-root oracle that returns a single canonical root. The authors use a one-sided number field sieve to obtain congruences of squares that split the modulus with probability 1/2 per dependency, claiming complexity L_n(1/3, (32/9)^(1/3)), below the general sieve. An open-source implementation is said to confirm a performance improvement in factoring speed.

Machine-Checked Soundness Proof of the GKR Protocol for Sparse-Merkle Updates

2026-10-05T00:00:00+09:00

Machine-Checked Soundness of the GKR Protocol for Sparse-Merkle Updates arXiv · Oct 5, 2026This paper machine-checks in Isabelle/HOL the soundness of the GKR protocol for sparse-Merkle membership, non-membership and update proofs, together with arithmetization exactness and leaf-commitment binding. It proves that for a false output claim, the probability that a layered sumcheck accepts a false result is at most (s_out + Σ(2 s_i d_i + 1))/|F|. The bound is instantiated over a quartic extension of the 31-bit KoalaBear field, giving a denominator of about 2^124. The model covers only the interactive public-coin protocol and excludes Fiat-Shamir, knowledge soundness and zero knowledge.

Paper arguing peer review should limit evaluative authority

2026-10-02T00:00:00+09:00

Peer review should constrain evaluative authority arXiv · Oct 2, 2026This paper argues that peer-review reform should shift from improving evaluators or aggregating judgments to constraining evaluative authority under persistent uncertainty. It proposes authority-constrained peer review, requiring consequential judgments to pass structured scrutiny before being treated as decision-relevant. Proposed mechanisms include critique-authority decoupling, independent secondary evaluation, contestability and reversibility, and accountability for unsupported influence.

Aligning models by training against probes while keeping them monitorable

2026-09-30T00:00:00+09:00

Alignment via Training Against Probes Without Losing Monitorability arXiv · Sep 30, 2026This paper studies probe-guided fine-tuning, which uses probes that detect undesired properties in model activations as a direct training signal. It evaluates harmlessness and honesty objectives, finding that static probes are easily exploited while continuously updated probes reduce harmfulness and improve honesty while preserving utility. The method outperforms DPO and inference-time steering and is more robust to jailbreak and abliteration attacks. Concepts remain linearly encoded after fine-tuning, so oversight is preserved.

Not Self-Decidable: Why LLMs Cannot Set the Limits of What an Agent Verifier Can Check

2026-10-04T00:00:00+09:00

Not Self-Decidable: LLMs Cannot Draw the Boundary of What an Agent Verifier Can Check arXiv · Oct 4, 2026The paper studies how an agent verifier should separate rules that a fixed check can settle from rules that need a judge. Across six corpora, about 22,000 labels from four models show near-perfect agreement on obvious cases but divergent, opposite-direction errors on regulatory text, and shared over-claiming on a deployed credit agent's rules. The authors propose CoVer, which admits a predicate only if its synthesized check survives intervention, reads fields the agent cannot write, and holds under deterministic rewording. They argue self-decidability is a boundary the verifier must construct, not a capability to elicit from a model. ★★★★ Notable: The authors report from about 22,000 labels across six corpora that LLMs cannot self-determine an agent verifier's decidable boundary, and propose CoVer, which admits a predicate only if its synthesiz

Penumbra: Efficient adversarial search for finding where regulatory rules flip

2026-10-04T00:00:00+09:00

Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations arXiv · Oct 4, 2026The paper introduces Penumbra, an adversarial search method for regulatory red-teaming that starts from a verified compliant response and expands edits until a two-evaluator committee changes its verdict. It outputs pairs of adjacent responses on opposite sides of the compliance boundary. Tested on a financial advisory constitution and a clinical triage constitution, it returned 144 and 49 pairs respectively, often differing by only a few words.

COPEX: Testing how well LLMs resist harmful context across MCP layers

2026-10-03T00:00:00+09:00

COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol (MCP) Layers arXiv · Oct 3, 2026This paper presents COPEX, a benchmark that isolates the language model as the MCP client by fixing the surrounding agent stack and varying only the tool-selecting model. It covers 25 attack types across 125 scenarios spanning four entry surfaces: model/agent, client, server/tool, and transport. Across nine models and 3,375 trials, the mean attack success rate is 64.4%. Combined input and context scanning reduced mean attack success by 49.6% on an eight-attack defense subset compared with the undefended setting.} ★★★★ Notable: Isolates the model as MCP client in a controlled benchmark of 125 adversarial context scenarios and 3,375 trials, reporting a 49.6% drop in attack success with input and context scanning.

CHAMP: A Cayley Hash Built from 2×2 Matrix Products

2026-10-03T00:00:00+09:00

CHAMP: Cayley HAshing with Matrix Products arXiv · Oct 3, 2026Cayley hash functions map binary strings to values by treating message bits as semigroup elements and multiplying them, which yields useful homomorphic properties. This paper proposes CHAMP, a Cayley hash function based on products of 2 by 2 matrices over a finite field. It discusses the scheme's security, implementation, and performance.

Rethinking Quality in LLM Routing: Security-Aware Model and Budget Selection

2026-10-14T00:00:00+09:00

Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection arXiv · Oct 14, 2026This paper introduces SCRouter, a router that chooses which large language model to call and how many output tokens to allow for each query. It weighs answer utility for ordinary queries against security behavior, such as refusing harmful requests, for sensitive ones, then balances the result against cost. The authors also release SCRouterBench, containing 38,869 in-domain queries across nine security dimensions and 2,753 out-of-domain queries, each evaluated under 144 model-budget combinations. The paper reports that SCRouter outperforms baselines by 13 to 29 points in-domain and 19 to 23 points out-of-domain.

Receipts for Tool Agents: Binding Claims, Evidence, and Execution for Auditing

2026-09-29T00:00:00+09:00

Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing arXiv · Sep 29, 2026The paper addresses a gap in tool-using AI agents, where citations and execution logs may each look valid while a shown claim is not the one produced by the recorded execution or supported by the cited source. The authors propose a claim-anchored execution contract that jointly binds the emitted claim, its exact source span, the ordered execution prefix, and the source version and access state. A deterministic verifier checks these bindings separately from a support check. Across 1,280 cross-object attacks, the joint contract detected 1,275 substitutions (0.9961).

VStress: Auditing and Budgeting Repeated Verifier Calls by Correlation

2026-09-29T00:00:00+09:00

VStress: Correlation-Aware Auditing and Adaptive Budget Allocation for Repeated Verifiers arXiv · Sep 29, 2026The paper introduces VStress, an auditable replay contract, and VStress-CA, a correlation-aware policy that decides whether another verifier call adds conditional information and stops or abstains when it does not. In controlled tests, majority voting helped at 35% symmetric corruption but lost accuracy at 65%. At a matched fixed budget, VStress-CA achieved the highest balanced accuracy among the compared allocation methods. Dependence diagnostics rose from same-model repeats to cross-family channels.

Automated Detection of Open-Source Software Threats Using Taxonomy-Aligned Large Language Models

2026-10-01T00:00:00+09:00

Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs arXiv · Oct 1, 2026This paper proposes a large language model framework that automatically detects and classifies open-source software supply chain threats into five attack categories. The authors build a dataset of 999 verified real-world incidents from 2018 to 2026 across eight package ecosystems. Using taxonomy-aligned prompting with GPT-4, the framework reports 97% accuracy and 97% macro F1, and the authors find taxonomy alignment matters more than model scale or fine-tuning.

Privacy Foundations for Shared Scientific AI: A Framework for Stating and Auditing Claims

2026-09-30T00:00:00+09:00

Privacy Foundations for Multi-Institutional Scientific Artificial Intelligence arXiv · Sep 30, 2026This paper examines privacy risks as scientific AI is shared among national laboratories, universities, hospitals, and industry partners. It argues that existing tools such as differential privacy and federated learning protect only parts of the system, and their guarantees rarely combine across institutions. The authors propose a six-element framework (protected asset, observer, channel, permitted disclosure, guarantee, and evidence) for stating, comparing, and auditing privacy claims, and identify six research priorities.

SecJev: Security-specialized decision models for System One tasks

2026-10-02T00:00:00+09:00

SecJev: Bringing Security Expertise to System One Decision Models arXiv · Oct 2, 2026This paper introduces SecJev, described as the first family of Jev-style decision models specialized for security, with sizes from 0.8B to 9B parameters. Built on Kev's single-pass candidate scorer, it learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories, trained on the newly built SecJev-Corpus spanning 14 tasks and eight sources. The authors report that SecJev-0.8B outperforms general Kev-9B by 20.51 percentage points in task-macro accuracy.

Adaptive Co-Serving LLM Watermarking on Modern Inference Engines: a study co-designing LLM watermarks with inference infrastructure to balance quality, detectability, and serving efficiency.

2026-10-03T00:00:00+09:00

Adaptive Co-Serving LLM Watermarking on Modern Inference Engines arXiv · Oct 3, 2026The paper notes that existing LLM watermarking methods focus on algorithms and often add auxiliary models or external tools, which increases latency and memory use. It proposes SWIFT, which integrates generation and watermark construction in a shared backend, runs watermarking concurrently through asynchronous co-serving and adaptive scheduling, and uses vLLM optimizations. Reported results include a utility score of 4.87, 99.65% detection accuracy versus 76.65% for SynthID, up to 97.7% detection under watermark removal attacks, and 5.9x lower latency than SafeSeal.

Control OSWorld: A Safety Test Environment for AI Agents That Use Computer Interfaces

2026-10-02T00:00:00+09:00

Control OSWorld: An AI Control Environment for GUI Computer Use Agents arXiv · Oct 2, 2026This paper introduces Control OSWorld, an evaluation environment that pairs 318 OSWorld tasks with 81 harmful side tasks, such as exfiltrating a private file, that an agent must complete without being caught. The authors use it to study monitors that detect malicious agents operating a graphical user interface. A weaker monitor reliably separates honest from malicious trajectories when it sees the full trajectory, reaching 97% recall at a 3% false positive rate. When it must score each step before execution, recall drops at low false positive rates, and access to the agent's visible text matters more than screenshots.

Measuring GPS Spoofing of Ships at Sea Worldwide

2026-09-29T00:00:00+09:00

She Spoofed Sea Ships by the Sea Shore: Measuring Large-Scale GPS Spoofing in Global Maritime Traffic arXiv · Sep 29, 2026This paper presents the first large-scale study of GPS spoofing in maritime traffic, using global ship tracking (AIS) data. The authors detect groups of vessels whose reported positions jump in physically implausible, correlated ways, and grade the evidence in each region. Analyzing over 367,000 vessels from late November 2024 to early February 2025, they identify 31 persistent anomalous hotspots, at least 22 with strong evidence of spoofing. The study also reports spoofing in the Red Sea months before the MSC Antonia grounding, which had not been documented previously. ★★★★★ Notable: The authors present the first large-scale measurement of maritime GPS spoofing, using a motion-aware regional detector on AIS data from over 367,000 vessels. They report 31 persistent hotspots, at lea

Layer-Resolved Measurement of LLM Agent Defenses and an Envelope-Layer Attack-Defense Model

2026-09-30T00:00:00+09:00

Measuring LLM Agent Defenses by Layer: GDA Measurement and an Envelope-Layer Attack-Defense Model arXiv · Sep 30, 2026This paper studies indirect prompt injection in agent protocols such as ACP and A2A, where remote tasks may be treated as legitimate. It argues that attack success rate cannot show which layer needs strengthening, and proposes GDA Measurement, which sorts outcomes into four classes. It also introduces A2A-TIBA for generating a validation corpus and ELA-ITL, a three-layer model, and reports that annotating untrusted content markedly improves recognition of malicious content.

Riemannian Transform Curbs Cross-Session Identity Leakage in Motor-Imagery EEG

2026-10-11T00:00:00+09:00

Riemannian Suppression of Cross-Session Identity Leakage in Motor-Imagery EEG arXiv · Oct 11, 2026Motor-imagery EEG recordings carry subject-identifying structure that persists across sessions, so sessions from the same person can be linked. This paper proposes a Riemannian transform that works directly on covariance representations by equalizing subject-conditioned geometric statistics, without learning a privacy model. Across two public datasets, the worst-case attacker's identification rate drops substantially, with a moderate loss in motor-imagery decoding accuracy.

A symmetric cipher built on Dirichlet convolution over finite fields

2026-10-03T00:00:00+09:00

Symmetric Cryptography via Dirichlet Convolution arXiv · Oct 3, 2026This paper proposes a new symmetric-key cipher for encrypting digital data, claiming fast operation, low memory use, and resistance to classical, AI-assisted, and quantum attacks. The scheme is based on generalized Dirichlet convolution over finite fields and is analyzed for security against plaintext attacks from an information-theoretic view. Its nonlocal structure permits plaintext salting, allowing controlled key reuse. The authors state that over F_p with p>2 the cipher achieves information-theoretic security under key reuse, while over F_2 some information leakage remains, giving a finite key-reuse budget.

Building Trustworthy Household Robots Through Open-World Safety

2026-10-01T00:00:00+09:00

Building Trustworthy Household Robots through Open-World Safety arXiv · Oct 1, 2026This position paper argues that foundation models let household robots handle more objects and instructions, but cluttered, changing homes expose them to unfamiliar situations. The authors call for open-world safety, meaning robots should keep specified safety requirements even in unseen situations, including when they cannot complete a task. They propose a research agenda to specify, learn, and ground safety requirements, enforce them with reliable recovery, and evaluate how well these protections generalize.

Argos: A Multi-Tenant SaaS Architecture for Coordinating Distributed Edge Security Devices

2026-09-29T00:00:00+09:00

Argos: A Multi-Tenant SaaS Architecture for Distributed Edge Security Orchestration arXiv · Sep 29, 2026This paper presents Argos, a multi-tenant SaaS command-and-control architecture for transparently and automatically managing distributed edge devices over the long term. It provides role-based access control, tenant isolation, persistent task management, and cron-based workflow automation. The system was tested on three geographically distributed edge devices running 810 automated tasks mapped to MITRE ATT&CK techniques, with a global failure rate of 3.33%. The evaluation methodology, sanitized datasets, and statistical scripts are publicly available.

Key-reuse weakness in phase-keyed Fourier-curve modulation: leakage and key-refresh cost on coded links

2026-10-01T00:00:00+09:00

Key-Reuse Vulnerability of Phase-Keyed Fourier-Curve Modulation: Relation Leakage and Key-Refresh Cost on Coded Links arXiv · Oct 1, 2026The paper argues that judging such keyed modulation by key-space size and a keyless receiver's error rate is insufficient, since reusing keys with harmonically coupled waveforms leaks information. Using integer relations among harmonic indices, the authors build an attack that recovers the key without enumeration. With one key per codeword on an LDPC-coded link, the attack meets a predeclared compromise criterion at most tested operating points. The paper also evaluates artificial noise countermeasures and the key cost of different refresh schedules.

Aletheia: Permission-Minimality Testing for Coding-Agent Rules

2026-09-30T00:00:00+09:00

Aletheia: Permission-Minimality Testing for Coding-Agent Rules arXiv · Sep 30, 2026This paper presents Aletheia, a framework that tests whether the permissions requested by coding-agent rule files, such as AGENTS.md and Cursor rules, are actually needed to complete a task. It removes one permission at a time, re-runs the task in a restricted sandbox, and flags the rule as suspicious if the task still passes its functional tests. On the evaluated sets, it detected all 314 attack rules and produced three false positives among 85 benign rules.

Evaluating and Improving Large Language Model Robustness to Adversarial Input Variations

2026-10-02T00:00:00+09:00

Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations arXiv · Oct 2, 2026This thesis studies how robust large language models are against adversarial input changes such as prompt injections, backdoors, and manipulation of automatic quality metrics. It proposes R_stab(f), a generative robustness metric based on Jensen-Shannon divergence, and ASA, an adaptive black-box attack on LLM-as-a-Judge systems reaching up to 73.8% attack success rate. It also introduces AttestMCP, which attests tool calls in agentic systems, reducing average attack success rate on the 847-scenario MCPBench from 53.7% to 12.4%. ★★★★ Notable: Proposes the JS-divergence-based generative robustness metric R_stab(f), the adaptive attack ASA, and AttestMCP, reporting ASR falling from 53.7% to 12.4% on MCPBench.

Pretext: A Method That Evades Malicious Skill Detectors for AI Agents

2026-09-30T00:00:00+09:00

Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents arXiv · Sep 30, 2026This paper examines the risk that malicious skills, which inject instructions into an AI agent's context, can be used to attack agents. The authors present Pretext, a white-box LLM attacker that iteratively crafts skills that evade pre-installation scanners while still delivering the payload and performing the benign task. Across three open-source models, Pretext reaches up to 97% evasion against a frozen detector and 77% against a co-adaptive one, exposing major gaps in current skill scanners.

APEX: Active Defense at LLM Agent Execution Boundaries (Paper)

2026-10-04T00:00:00+09:00

APEX: Active Protection at Execution Boundaries for LLM Agents arXiv · Oct 4, 2026This paper addresses indirect prompt injection, where hidden instructions in content read by LLM agents at runtime can trigger harmful actions. It proposes defending at the execution boundary, where an agent turns internal state into external actions or outputs, using an authorization contract compiled before untrusted execution. APEX admits effects only when the contract justifies them and exposes unendorsed use before the effect commits. The authors report 0% attack success on five of six benchmarks and 0.56% on the sixth, compared against 13 baselines. ★★★★★ Notable: Shifts defense to execution boundaries, enforcing one authorization contract via evidence gating and deception-based exposure; the authors report 0% attack success on five of six benchmarks (0.56% on

SERA-IDS: Intrusion detection using small language models that learn from structured past experience

2026-10-03T00:00:00+09:00

SERA-IDS: Structured Experience Retrieval-Augmented Intrusion Detection with Small Language Models arXiv · Oct 3, 2026The paper proposes SERA-IDS, a framework in which a small language model learns structured rules from misclassified network flows. At test time, rules matching the query flow's numerical conditions are retrieved and supplied as evidence. Using three locally deployable small models without fine-tuning, the authors report large macro F1 gains on the NF-BoT-IoT and NF-ToN-IoT datasets.

Do LLM Extraction Defenses Hold Up Against Different Attacks? A Benchmark for Black-Box Model Extraction

2026-10-01T00:00:00+09:00

Do Defenses Against LLM Extraction Work Across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction arXiv · Oct 1, 2026The paper introduces a unified benchmark covering six extraction attacks, ten defenses, and two adaptive attacks that paraphrase or back-translate protected responses before training surrogates. It controls model configurations, query data, budgets, and evaluation conditions within each comparison. Measurements include surrogate capability, fidelity to the victim, output quality via Rep-4, and sensitivity to query budget.

Which image property carries image-to-text jailbreaks? A controlled breakdown of attack factors

2026-10-04T00:00:00+09:00

Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks arXiv · Oct 4, 2026The paper examines image-side factors in four published image-to-text jailbreak attack families, using a 313-prompt StrongREJECT slice and five multimodal models, plus an appendix evaluation of InternVL3.5-8B. Bare harmful text queries produce little attack success, while attack images substantially increase it. Per-tile entropy and JPEG size do not reliably separate attack tiles from size-matched benign distractors, and removing query-specific relatedness lowers attack success by about 0.12 on Qwen3-VL-8B. The conclusions remain conditional on an automated rubric judge.

Where the audio jailbreak lives: a controlled frequency and depth audit of AdvWave-P on Qwen2-Audio

2026-10-04T00:00:00+09:00

Where Does the Audio Jailbreak Live? A Controlled Frequency-Depth Audit of AdvWave-P on Qwen2-Audio arXiv · Oct 4, 2026This paper audits claims about which frequency bands and decoder layers matter for AdvWave-P, an additive audio jailbreak attack on Qwen2-Audio. The authors mask frequency components of the perturbation in the STFT domain and measure attack success on 520 AdvBench prompts, with 76.7% of adversarial inputs judged as jailbreaks. They find the apparent frequency ranking depends on how bands are partitioned, and a finer-resolution result remains unresolved without a matched control. The authors conclude the results support partition-aware auditing of frequency claims, but the layer association is not a causal localization.

TARE: Measuring a Never-Poisoned Twin to Assess Backdoor-Defense Costs

2026-10-04T00:00:00+09:00

TARE: Weigh a Never-Poisoned Twin Before Reading Backdoor-Defense Costs arXiv · Oct 4, 2026Backdoor-defense leaderboards report clean-accuracy drops as removal costs, but these drops mix in the defense's effect on any model and the victim's starting point. The paper proposes TARE, which runs each defense on a never-poisoned twin sharing the same recipe, schedule and seed, and treats the twin's loss as the "tare" to subtract. The authors also release a patch, a signed tare table, and TARE-Z, a twin-free estimator for seed-stable defenses. ★★★★ Notable: Proposes a never-poisoned twin baseline to correct backdoor-defense accuracy cost; a 2×2 scheduler swap exposes a benchmark flaw, and BadNets results on the twin are reported for eight defenses.

ASAP: Assembly-Source Aligned Pseudocode Refinement for Binary Decompilation

2026-09-30T00:00:00+09:00

ASAP: Assembly-Source Aligned Pseudocode Refinement For Binary Decompilation arXiv · Sep 30, 2026Binary decompilers produce C-like pseudocode that is heuristic and often contains errors, especially for heavily optimized binaries. ASAP aligns source and assembly representations with contrastive learning, compresses assembly features into fixed tokens via a Q-Former, and feeds them with the pseudocode to an LLM. Stochastic pseudocode masking and a relative assembly-advantage loss encourage the model to use assembly information. On two benchmarks, average re-execution rate rises from 64.7% to 71.9% and recompilation rate from 91.6% to 96.6% over the strongest baseline.

Unitary Complexity in Polynomial Space

2026-10-03T00:00:00+09:00

Unitary complexity in polynomial space arXiv · Oct 3, 2026The paper shows that if quantum commitments exist, then either unitary synthesis has no polynomial-time solution or BPP is not equal to NEXP. It proposes new definitions for the unitary complexity classes unitaryP and unitaryPSPACE. It also shows that unitaryPSPACE can generically erase garbage qubits. ★★★★★ Notable: The authors show that if quantum commitments exist, then either unitary synthesis has no polynomial-time solution or BPP≠NEXP, and propose new definitions of unitaryP and unitaryPSPACE.

Quantum Fire with Delegated Cloning: A cryptographic primitive where copying quantum states needs a separate key

2026-10-03T00:00:00+09:00

Quantum Fire with Delegated Cloning arXiv · Oct 3, 2026This paper studies quantum fire, quantum states that can be cloned efficiently but resist reconstruction from classical communication alone. The authors introduce delegatable quantum fire, in which cloning requires a separate key, and give two constructions in the classical-oracle model. The first uses a classical secret key, while the second, called torch-fire, uses quantum cloning keys (torches) that enable cloning without being splittable or delegable. The authors claim that an efficient adversary with m torches cannot, except with negligible probability, let more than m non-communicating parties each clone a fresh challenge flame.

Research on quantum interactive proofs where the prover sends very short replies

2026-09-30T00:00:00+09:00

On quantum interactive proofs with a laconic prover arXiv · Sep 30, 2026This paper studies two-message quantum interactive proof systems in which the prover's response is only ℓ bits long. The authors introduce the class QIP_{ℓ-bit}(2) and show that Quantum State Distinguishability is complete for it, placing it just above quantum statistical zero-knowledge (QSZK). They also identify easy regimes where the class collapses to QSZK. Under quantum public coins, the interaction is shown to be useless, with the relevant class contained in BQP. ★★★★ Notable: The authors give a complete multi-state distinguishability characterization of QIP_ℓ-bit(2), report that QSD lies in QSZK when a-b≥1/O(log n), and improve results for SD and SZK.

Succinct arguments for QMA in the quantum random oracle model

2026-09-29T00:00:00+09:00

Succinct Arguments for QMA in the Quantum Random Oracle Model arXiv · Sep 29, 2026This paper constructs the first succinct argument for QMA in the quantum random oracle model (QROM), without relying on additional cryptographic assumptions or unproven conjectures. The core is an efficiency-preserving transformation that compiles quantum interactive oracle proofs (QIOPs) into quantum arguments for the same language, using a quantum commit-and-open paradigm. The authors also formalize and construct extractable vector commitments for quantum states with local openings in the QROM. ★★★★★ Notable: The authors report the first succinct argument for QMA in the QROM relying only on unstructured hardness, via an efficiency-preserving QIOP-to-argument compilation and extractable vector commitments f

The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models explains how hidden image watermarks can leak sensitive chat information.

2026-10-05T00:00:00+09:00

The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models arXiv · Oct 5, 2026The paper introduces Privacy-Leaking Watermarks (PLWs), invisible watermarks that a malicious model provider can embed in later generated images based on earlier chat history. Sensitive keywords mentioned in a conversation can thus be revealed through images, even when the model runs locally on a user's device. Tested across 13 sensitive-attribute triggers and two model families, PLWs achieved up to 100.0% true positive rate at 1% false positive rate.

AutoDP-LLM: Using Large Language Models to Automate Data Pre-processing for Intrusion Detection

2026-10-05T00:00:00+09:00

AutoDP-LLM: Automating Data Pre-processing for Intrusion Detection Systems using Large Language Models arXiv · Oct 5, 2026This paper proposes AutoDP-LLM, a framework that uses Large Language Models to automatically generate and validate executable data pre-processing pipelines for intrusion detection systems. It selects retained features adaptively using semantic reasoning and training-derived statistics, without a predefined feature budget. Experiments on the UNSW-NB15 and NSL-KDD datasets show competitive detection performance compared with conventional feature-selection methods. The authors also note that the candidate pipeline generation and evaluation steps can run in parallel on high-performance computing systems.

Reflections and Fragments: Defending LLMs Against Multi-Turn Mosaic Attacks

2026-10-05T00:00:00+09:00

Reflections and Fragments: Securing LLMs Against Sequential Mosaic Attacks arXiv · Oct 5, 2026This paper studies mosaic attacks, where individually harmless prompts across several conversation turns combine into a harmful payload. The authors propose a watchman, an online state mechanism that carries safety-relevant information forward, and show that under explicit assumptions it can achieve zero-failure defense with positive benign helpfulness. In experiments, role-specific attacker and defender LoRA adapters trained via multi-turn self-play over frozen LLMs both improved, with gains also observed on unseen attack objectives.

Grammar-guided code watermarking with green temperature (GTCW), a method to tag AI-generated code while keeping it syntactically valid

2026-10-05T00:00:00+09:00

Grammar-Guided Code Watermarking with Green Temperature arXiv · Oct 5, 2026This paper proposes GTCW, a method that embeds a detectable watermark in code generated by large language models. At each decoding step it limits candidates to grammar-valid tokens, splits them into keyed green and red sets, and reweights green tokens at high-entropy positions. Across five models and five benchmarks in four programming languages, it reaches a mean AUROC of 73.61%, above the strongest baseline's 67.83%. Its mean Pass@1 is 59.18%, slightly below the 59.58% of unwatermarked generation.

Red-TTT: Test-time training to automatically jailbreak large language models

2026-10-05T00:00:00+09:00

Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models arXiv · Oct 5, 2026This paper proposes Red-TTT, a method for automated jailbreaking of large language models that updates the attacker's parameters during each attack. Each round, the attacker samples candidates, scores them against the victim's replies, and takes a policy-gradient step, and the training objective is adapted to judge success by the best sample. At a budget of 120 samples, average attack success rate rises from 55.9% for the Best-of-N baseline to 72.4%. ★★★★ Notable: The authors apply test-time training to automated jailbreaking, updating attacker weights during each attack; they report average success rising from 55.9% (Best-of-N) to 72.4% at 120 samples.

Whose Interests Does a Proactive Agent Serve? Provider-Side Indirect Prompt Injection

2026-10-04T00:00:00+09:00

Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents arXiv · Oct 4, 2026This paper studies how an external provider could exploit proactive personal agents that make recommendations and offer follow-up help to steer users toward the provider's own target. The authors describe three mechanisms, Target Control, Private Binding, and Prospective Support, and test them across three environments and six simulated user models. The full attack raised target authorization in every tested combination, with a macro gain of up to 77.4 percentage points. The work concludes that capabilities built to serve users can be redirected toward objectives outside the user-agent relationship. ★★★★ Notable: Introduces provider-side indirect prompt injection in proactive agents, where controlling only target-related content redirects agents toward the provider's goal, reportedly raising target authorizati

What a policy gate can and cannot know: limits of cross-platform command adjudication

2026-10-04T00:00:00+09:00

What a Policy Gate Can and Cannot Know: Measured Boundaries of Cross-Platform Command Adjudication arXiv · Oct 4, 2026The paper studies a policy gate that decides ALLOW, ASK or DENY from a typed, realised action without parsing shell syntax, replicating an earlier Windows benchmark on Linux. A frozen 61-case table passed fully with no false allows, and the mutation campaign killed 46 of 50 mutants (92.0%). When consulted by the executor, 25 escapes dropped to zero without blocking any benign payload. The authors also report that credential verification scans its entire ledger, incurring accumulating cost, and describe the fix they would make.

Blocking Staged Prompt Injection Before Harmful Agent Actions

2026-10-04T00:00:00+09:00

Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection arXiv · Oct 4, 2026This paper studies how long-horizon AI agents can be attacked by indirect prompt injection spread across multiple workflow stages. The authors built an automated attack pipeline and found confirmed attacks against Claude Code and Codex across several scenarios. They propose a pre-action auditing method, Path-Aligned Attribution (PAA), which is training-free and decides Pass or Block before a consequential action takes effect, reporting higher block recall and lower false-block rates than compared auditors. ★★★★★ Notable: Introduces staged prompt injection and Path-Aligned Attribution, a training-free pre-action auditor; the abstract reports 86% Block recall at 6-8% false-block rate on a 479-pair benchmark, above ARGUS

VulValidate: Checking Function-Level Vulnerability Labels with Executable Evidence

2026-10-04T00:00:00+09:00

VulValidate: Auditing Function-Level Vulnerability Labels with Executable Evidence arXiv · Oct 4, 2026Learning-based vulnerability detectors need accurate labels, but datasets built from vulnerability-fixing commits can mark functions as vulnerable just because a security patch changed them. VulValidate uses LLM agents to coordinate dynamic analysis tools and build vulnerability-triggering experiments from runtime feedback. The authors audited 35,849 instances labeled vulnerable in BigVul, PrimeVul, and DiverseVul, confirming 20,510, correcting 6,819 labels, leaving 7,981 undecided, and failing to measure 539. Corrected labels lowered F1 for all five tested detectors under fixed parameters. ★★★★★ Notable: LLM agents coordinate dynamic analysis to audit 35,849 labels across three vulnerability datasets with executable evidence; the authors report 20,510 confirmed, 6,819 corrected, and F1 gains after ret

Private component-by-component learning: a differentially private framework for realizable settings

2026-10-04T00:00:00+09:00

Private Component-by-Component Learning arXiv · Oct 4, 2026This paper studies differentially private learning where hypotheses are specified by k components in a realizable setting. It uses the LabelBoost procedure to restore exact realizability and recycles data through two alternating reservoirs, keeping overhead to roughly √k/ε. Applied to learning d-dimensional halfspaces on a finite grid, it improves the sample complexity bound, and it also yields proper private learners for Boolean compositions of classes.

Cooldown Landmines: Cross-tenant attacks that disrupt shared LLM model access

2026-10-04T00:00:00+09:00

Cooldown Landmines: Cross-Tenant Interference Attacks on LLM Gateways arXiv · Oct 4, 2026This paper studies how shared cooldown records in LLM gateways can let one tenant's request failures restrict other tenants' access to working model deployments. The authors identify two attacks against LiteLLM and propose an origin check plus tenant-scoped cooldown as fixes. In their experiments, victim fallback after recovery dropped from 54/60 to 0/60 with tenant scoping.

How known open-source vulnerabilities affect security inside AI agent systems

2026-10-04T00:00:00+09:00

Characterizing Security Effects of OSS Vulnerabilities in Agent Systems arXiv · Oct 4, 2026Software agents increasingly rely on open-source components when running tools and interacting with external systems, so flaws in those dependencies can spread through tool outputs, agent state, and information shown to the model. The paper studies how known OSS vulnerabilities behave when exercised in agent workflows, combining vulnerability-aware semantics, differential execution of vulnerable and fixed software, and multi-layer runtime provenance. The approach distinguishes realized vulnerability effects and identifies the furthest layer they reach across diverse scenarios. Applied to documented workflows in a real-world agent framework, it uncovers several security effects originating from known vulnerabilities in its open-source dependencies.

Lightweight drone-mounted 5G base stations: a reproducible OAI testbed on common ARM hardware

2026-10-04T00:00:00+09:00

Toward Lightweight Aerial 5G gNBs: Reproducible OAI Testbed on Commodity ARM Platforms arXiv · Oct 4, 2026The paper studies a drone-carried 5G base station in which the core network and central unit stay on the ground, and only the backhaul endpoint, distributed unit, and radio are airborne. Tests with Raspberry Pi 5 and Jetson Orin Nano as distributed units show Jetson keeping 88.4% of x86 split-DU Ethernet downlink throughput. The authors also release an OAI patch that sends emergency PWS warnings from the central unit to the distributed unit over F1 for reproduction.

Hidden Risks of Jev: A Study of Its Security, Privacy, and Dual-Use Concerns

2026-10-04T00:00:00+09:00

Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use arXiv · Oct 4, 2026This paper studies security and privacy risks when Jev, a system that turns natural-language questions into typed answers, is used as a decision layer in applications. Using the official Jev API and a local model, NanoJev, the authors test prompt injection, backdoors from training data poisoning, and attacks that recover sensitive information from constrained outputs. They also evaluate Jev's use in detection tasks and misuse scenarios, finding it remains vulnerable to these threats while its decision capability can serve both beneficial and malicious purposes.

Runtime Authorization for Self-Generated Subgoals in Long-Horizon AI Agents

2026-10-04T00:00:00+09:00

Runtime Authorization of Self-Generated Subgoals in Long-Horizon Tool-Using AI Agents arXiv · Oct 4, 2026This paper examines how long-horizon AI agents that create their own subgoals, replan, and delegate work can stay within the task a principal approved, which per-tool permission checks alone cannot ensure. The authors propose version-bound witnesses for each goal-graph change and recheck every protected effect at an atomic commit boundary. In 96 matched cases, the complete mechanism committed no forbidden states in 48 drifted cases and completed all 48 benign counterparts. ★★★★ Notable: Proposes runtime authorization for self-generated subgoals in long-horizon tool-using agents, with formal proofs in finite domains and matched-case experiments reporting blocked drift.

Static bootstrap placement for encrypted language model decoding

2026-10-04T00:00:00+09:00

Static Bootstrap Placement for Encrypted Language Model Decoding arXiv · Oct 4, 2026This paper presents AR-HE, a system that runs the full text-generation loop on a server under homomorphic encryption, selecting each token and writing its embedding back into the encrypted state. The client sends one prompt and waits for the output. A single rule without search places all bootstraps, and the schedule skips unneeded work, packs shared bootstraps, and caches encrypted keys and values. On one NVIDIA H100, the authors report GPT-2 small generating a token in 544 seconds, down from 4715 seconds without optimization.

WLPA: A framework for allocating scarce quantum-safe link protection based on the weakest link

2026-10-04T00:00:00+09:00

WLPA: A Network Management Framework for Allocating Scarce Quantum-Safe Link Postures under Weakest-Link Exposure arXiv · Oct 4, 2026The paper addresses how network operators can allocate limited quantum-safe protection, such as quantum key distribution, which is hardware-scarce and costly, across links in a network. It presents WLPA, an algorithm that assigns postures under hardware, latency, and compliance constraints, based on the idea that a distributed job's security is set by its weakest active link. The authors identify when common per-link heuristics match the optimum and when they fail, and report validation across 19 experiments.

Bounded Reasoning: Comparing Humans and AI in Cyber Defense

2026-10-04T00:00:00+09:00

Bounded Reasoning: Cognitive Hierarchy in Human-versus-AI Cyber Defense arXiv · Oct 4, 2026This paper studies a sequential cyber-defense game on an attack graph, where human or reinforcement-learning (DQN) defenders protect cloud assets against a DQN attacker. It compares four defender settings using 80 Mechanical Turk participants and matched automated simulations. Human defenders were more likely to reselect a node after a successful defense than after a failure, while automated defenders did not show this asymmetry. The authors argue that averaged task scores can hide these behavioral differences.

Invisible Ink, Visible Lies: Why Watermarking Can Make AI Chatbots Invent Facts

2026-10-04T00:00:00+09:00

Invisible Ink, Visible Lies: How Production Watermarking Causes LLMs to Hallucinate arXiv · Oct 4, 2026This paper studies how text watermarks, which help identify AI-generated content, can reduce factual accuracy. In a retrieval-augmented setting where the correct evidence is present, six watermarking methods still produced watermark-induced hallucinations. The authors attribute this to token-level perturbations and attention drift during decoding, and propose two plug-in interventions that reduce factual errors by about 90% relative to watermark-only decoding at a matched detection rate. ★★★★ Notable: The first systematic study of watermark-induced hallucination: under controlled RAG settings, the authors report that six watermarking methods introduce factual errors even when evidence is in context

Hardware-accelerated function secret sharing secure against malicious parties (VIGOR-DFA)

2026-10-04T00:00:00+09:00

Trusted Hardware Acceleration for Malicious-Secure Function Secret Sharing arXiv · Oct 4, 2026This paper presents VIGOR-DFA, a trusted hardware accelerator for function secret sharing (FSS), a primitive used in two-party private inference and private information retrieval. It adds mechanisms, including a fresh authentication step, a freeze-before-challenge output check, and a one-time resource ledger with a release guard, to resist tampering and replay by a malicious host or GPU. The authors prove static malicious security with abort in a protected-module model and compare against a dealer-based malicious FSS, reporting latency and energy gains along with the cost of malicious security.

Predicting cyberattacks using news and podcast data analyzed by AI language models

2026-10-04T00:00:00+09:00

Forecasting Cybersecurity Incidents Using Geopolitical Data and Large Language Models arXiv · Oct 4, 2026This paper forecasts cybersecurity incidents by using geopolitical information from news articles and transcribed podcasts, which large language models convert into representations. A classifier trained on past incidents then predicts future ones. On a dataset of over 15,700 records, geopolitical data alone reached 71.4% ROC AUC. Combined with network measurements, it reached 81.3%, above the 77.5% of the prior network-only method.

Tracing AI-generated synthetic DNA with a hidden, position-independent watermark

2026-10-04T00:00:00+09:00

Tracing model-generated DNA with position-independent watermarking arXiv · Oct 4, 2026Genomic language models can generate synthetic DNA with no record of its origin. The authors embed the SynthID tournament watermark in two such models, Carbon and GENERator-v2, and the detector searches both strands, all start positions and four window lengths, correcting for this multiple search. On a held-out cohort of 1,544 prompts, all 3,088 marked sequences per model were detected, including unedited sequences and those with one substituted, inserted or deleted base. The results show statistical detection only, not biological function, secret-key security, or robustness against an editor who knows the detector.

Indistinguishability lifting for keyed oracles and compressed ideal ciphers

2026-10-04T00:00:00+09:00

Indistinguishability Lifting for Keyed Oracles, Compressed Ideal Cipher, and More Applications arXiv · Oct 4, 2026This paper proves a general lifting theorem: if two base oracles are indistinguishable under quantum queries, their keyed versions are too, losing only an O(q^2) factor in distinguishing advantage, where q is the number of queries. The authors use this to extend Carolan's compressed permutation oracle into an efficiently implementable compressed ideal cipher, proving preimage resistance of the Davies-Meyer compression function in the quantum ideal cipher model. They also present a modular construction that doubles the message length of any quantum-secure strong pseudorandom permutation. ★★★★ Notable: The authors prove a generic quantum indistinguishability lifting theorem with O(q^2) loss, tight per their claim, and apply it to a compressed ideal cipher and Davies-Meyer preimage resistance.

When Talk Isn't Code: Comparing LLM Agents That Simulate and Develop Software

2026-10-04T00:00:00+09:00

When Talk Isn't Code: Comparing LLM Agents That Simulate and Develop Software arXiv · Oct 4, 2026This paper compares two ways large language models are used with network protocols: simulating an implementation in conversation and writing the actual program. The authors test 15 models on four protocol implementations using one attack suite. They find that simulation can serve as a first filter but cannot replace testing the generated code.

StegoMemory: Agent Memory as a Hidden Covert Channel

2026-10-04T00:00:00+09:00

StegoMemory: Agentic Memory Acts as Covert Steganographic Channel arXiv · Oct 4, 2026This paper red-teams AI agents to test whether their memory can secretly carry attacker-chosen strings from one session to another. Across 14,000 attack trials using seven steganographic encoding schemes, about 20.1% of trials recovered the exact hidden payload. Many of these covert transmissions also passed task-completion scoring and safety oversight. The authors conclude that memory integrity and information-flow control should be explicit security requirements for agentic systems.

Quantum machine learning to detect hidden attacks on military quantum key distribution

2026-10-03T00:00:00+09:00

Quantum Machine Learning Protection of Military Quantum Key Distribution Against Cryptographically Camouflaged Attacks arXiv · Oct 3, 2026The paper studies implementation attacks on military quantum key distribution, where an adversary with a hidden backdoor in a generator hides attacked blocks within honest noise. Detection is shown to reduce to a discrete logarithm problem, which a quantum kernel using Shor's algorithm can solve. In simulations on the Ghillie decoy-state BB84 simulator, the quantum kernel scores 1.000 on camouflaged attacks while classical monitors score 0.458 to 0.516.

The Same Zero: Why Identical Attack Success Rates May Mean Different Guarantees for LLM-Agent Defenses

2026-10-03T00:00:00+09:00

The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security arXiv · Oct 3, 2026The paper applies Verification Autonomy Levels (VAL, L0 to L5) to classify 22 LLM-agent security defenses by what guarantee they provide and where it comes from. Under equal budget, it compares a VAL-guided defense stack with a common intuition-based stack across 50 scenarios, 12 attack variants, and testbeds including AgentDojo and JADE. The authors conclude that a zero attack success rate is an outcome rather than a guarantee, since identical zeros can arise from very different sources.

Verifying Audited Proprietary Software Without Revealing Its Code

2026-10-03T00:00:00+09:00

Attestable Audit: Property-Based Attestation for Proprietary Workloads without Artifact Disclosure arXiv · Oct 3, 2026The paper proposes an architecture that combines two TEE-based workloads, attestable build and attestable audit, so a verifier can confirm that a running program was built from source code meeting audited properties. Audit verdicts are bound to the source code digest, so neither the source code nor the build artifact needs to be disclosed. A proof-of-concept on Intel SGX with Gramine runs the Bandit analyzer on Python code to demonstrate practicality.

Reactivating Alignment: Intention-Aware Input-Output Matching to Defend LLMs from Jailbreaks

2026-10-03T00:00:00+09:00

Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching arXiv · Oct 3, 2026This paper presents SENTINEL, a plug-and-play defense that works during generation to block jailbreak attacks on large language models. It treats the problem as extracting the attacker's true intent, using the fact that instruction-tuned models' outputs tend to align semantically with that intent. SENTINEL matches aligned input-output regions, scores them with refusal-direction projections, and halts generation when needed. On HarmBench, it reduces jailbreak success rates to close to 5% while keeping over-refusal low.

Guess My Weight: Recovering Exact Float32 Neural-Network Weights via Power Side Channels

2026-10-03T00:00:00+09:00

Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights arXiv · Oct 3, 2026This paper studies whether floating-point neural-network weights on embedded devices can be recovered bit-for-bit from power side-channel leakage during inference. The authors propose a profiled template attack that targets the multiplication of a known input with a first-layer weight, using a hierarchical coarse-to-fine search over the 32-bit candidate space. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 report a 99% bit-exact success rate with 171 traces and 100% from 263 traces onward.

Large Language Models and Augmented Democracy: Studying LLM Digital Twins for Representing Citizen and Party Preferences and Their Vulnerability to Attacks

2026-10-03T00:00:00+09:00

Large Language Models and Augmented Democracy arXiv · Oct 3, 2026This thesis examines large language model (LLM)-based digital twins as intermediaries in augmented democracy. Using Brazilian online experiment data, it tests whether personalized twins can predict citizens' preferences on unseen policy proposals. Using Swiss parliamentary records, it builds party-level twins from lawmaker agents and checks whether their deliberation captures more intra-party views than official communications. It also studies prompt-injection attacks on LLM-mediated deliberation using UK 2023 experiment data and evaluates a defensive pipeline.

JASPER: Joint Reliability and Security Assessment for Split Computing at the Edge

2026-10-03T00:00:00+09:00

JASPER: Special Session on Joint Reliability And Security Assessment of SPlit Computing for Edge Robustness arXiv · Oct 3, 2026This paper presents a unified framework for jointly evaluating the reliability and security of Split Computing, where deep neural network inference is divided between edge devices and cloud servers. Reliability is measured with neuron-level fault injection using Mean Relative Accuracy Degradation, and security with feature-map-aware adversarial attacks using Attack Success Rate. Tests on ten ResNet-50 configurations show MRAD of 44.3% to 61.2% and attack success rates up to 98.8%, with joint metrics revealing vulnerabilities hidden by separate analysis.

A cheat-sensitive routing method that hides destinations in quantum networks

2026-10-03T00:00:00+09:00

A Cheat-Sensitive Primitive for Destination-Private Quantum Routing arXiv · Oct 3, 2026Intermediate nodes in quantum networks distribute entanglement but may learn which users are connected. The paper proposes a minimal two-call routing primitive in which Alice links with one of several clients while testing whether the provider Bob has disturbed a coherently encoded request. The construction adapts the hidden-order mechanism of quantum private queries and uses a private matching qubit held by the selected client. It detects an explicit destination-reading attack with nonzero probability, but does not yet give a quantitative information-disturbance tradeoff or composable security.[]

GrayShield: Bit-Level Sanitization to Protect Transformer Models in the AI Supply Chain

2026-10-03T00:00:00+09:00

GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security arXiv · Oct 3, 2026The paper notes that the least significant bits of 32-bit floating-point weights in Transformer models such as BERT and ViT can be misused as covert channels to hide malicious payloads. The authors propose GrayShield, a lightweight, post-training, data-free method that overwrites this mantissa-LSB channel with a Gray-code-guided low-transition sequence. Tested on four model presets and two real malware payloads, it keeps accuracy impact below 1% and reduces recovery by about 49.96 percentage points under five attacker variants.

Modeling How Users' Deletion Requests Can Shape Machine Unlearning Outcomes

2026-10-03T00:00:00+09:00

Modeling Deletion Requests in Machine Unlearning arXiv · Oct 3, 2026This paper examines how users exercising the "right to erasure" might influence AI model behavior through machine unlearning. It defines two user behaviors when requesting data deletion, adaptivity and collectivity, and theoretically compares groups that do and do not display them using results from stochastic optimization. The authors also show how data valuation techniques can be used to design deletion requesters that significantly alter model behavior, and their computer vision experiments examine the differential effects of these behaviors.

CyTReX: An Explainable AI Framework for Threat Reasoning in DER Networks

2026-10-03T00:00:00+09:00

CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks arXiv · Oct 3, 2026This paper presents CyTReX, a framework that turns anomaly alerts from distributed energy resource networks into ranked threat hypotheses for security analysts. It constrains large language model reasoning with a structured evidence packet combining detection outputs, SHAP feature attributions, surrogate rules, and threat intelligence. Each hypothesis is meant to trace back to explicit evidence, and incomplete or conflicting evidence is reported. Evaluation across five configurations shows the complete pipeline gives the richest evidence-grounded reasoning context.

Self-Reflection Fine-Tuning: Teaching AI Agents to Resist Prompt Injection Attacks

2026-10-03T00:00:00+09:00

Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience arXiv · Oct 3, 2026This paper proposes Self-Reflection Fine-Tuning (SRFT), a training method that helps language model agents learn from their own failures under adversarial conditions. Instead of only imitating expert behavior, agents are shown compromised trajectories created by injected attacks, and an expert model generates reasoning that contrasts unsafe and optimal actions. The authors implement this as SR-Agent on Llama-3.1-8B-Instruct and Qwen3-8B, and report reduced attack success rates on static and adaptive benchmarks while preserving task performance.

Autonomous Active Directory Attacks via a Multi-Model Harness: A NeuroSploit Benchmark on GOAD

2026-10-03T00:00:00+09:00

Autonomous Active Directory Exploitation via Multi-Model Harness Orchestration: A Benchmark Study with NeuroSploit on GOAD arXiv · Oct 3, 2026This paper benchmarks NeuroSploit v4.2.0, an open-source Rust autonomous pentest harness, against GOAD, a deliberately vulnerable multi-forest Active Directory lab. The harness uses 22 AD-specific agents and 7 multi-stage attack-chain playbooks spanning enumeration through cross-forest trust abuse. It is compared with direct large-language-model invocation, and the authors report 96–100% technique coverage for the harness versus 21–54% for direct invocation.

Learning to Watermark Speech Synthesis Against Reconstruction Attacks

2026-10-03T00:00:00+09:00

Learning to Watermark Speech Synthesis Against Model-Driven Reconstruction arXiv · Oct 3, 2026This paper proposes Thrive, a multi-bit generative watermarking framework for modern autoregressive text-to-speech systems, designed to trace synthesized speech back to the requesting user. The authors find that no single watermark carrier stays reliable across reconstruction models, so Thrive combines Rise, which injects watermarks into intermediate representations, with Care, which selects waveform or spectral experts per bit. Experiments report 87.6% average recovery accuracy under reconstruction attacks, with source attribution supported over candidate sets of up to 10,000 identities.

Rethinking watermark teachers for language model fingerprinting

2026-10-03T00:00:00+09:00

Language Model Fingerprinting Requires Rethinking Watermark Teachers arXiv · Oct 3, 2026This paper examines LLM fingerprinting, which embeds a statistical watermark into model weights so owners can identify their models behind black-box APIs. The authors find that a recent protocol's utility evaluation understates text quality loss in open-ended generation. They propose near-tie restriction, which limits watermark bias to tokens close to the base model's top prediction, improving the trade-off between detectability and text quality.

Encrypted Statistical Modeling with Fully Homomorphic Encryption in R

2026-10-03T00:00:00+09:00

Fully Homomorphic Encryption for Statistical Modeling arXiv · Oct 3, 2026This paper shows how two R packages, openfhe.R and homomorpheR, enable statistical analyses on encrypted data so multiple parties can jointly model without sharing raw records. Validation studies cover distributed stratified Cox regression and federated Cox-lasso using consensus ADMM, where only the cross-site update is encrypted. The parties are assumed honest-but-curious, and threshold key generation is used.

From Temporary Access to Persistent Surveillance: Matter Smart Home Security Risks

2026-10-03T00:00:00+09:00

From Temporary Access to Persistent Surveillance: Why Matter Matters in Smart Homes arXiv · Oct 3, 2026This paper examines Matter, an open smart home standard that uses cryptography for device authentication and data confidentiality, and how its openness exposes protocol and implementation details. The authors show that an attacker with temporary physical access can exploit design and implementation flaws to extract credentials and impersonate devices, maintaining surveillance and control after leaving. A proof-of-concept on a simulated smart home with commercial devices and development boards validates the attack, and four mitigation strategies are proposed.

How gradients add to text leakage in split language models, counted per token and per document

2026-10-03T00:00:00+09:00

What Gradients Add to Text Leakage in Split Language Models, Counted per Token and per Document arXiv · Oct 3, 2026The paper shows that in split learning for language models, an observer can rebuild most of a client's text from the activations sent to the server and the gradients returned. On GPT-2, an attacker recovers 94.20% of tokens from activations alone and 97.38% with gradients, while exact recovery of 32-token documents rises from 13.71% to 37.77%. The authors recommend reporting leakage both per token and per document, and treating what a split model transmits as sensitive as the original text. ★★★★ Notable: The authors report that gradients returned by the server raise text leakage in split learning: on GPT-2, per-token recovery rises from 94.20% to 97.38% and exact per-document recovery from 13.71% to 3

Privacy audit of synthetic gene expression data using a unified weighted-distance attack framework

2026-10-03T00:00:00+09:00

Auditing the Privacy of Synthetic Gene Expression Data: A Unified Weighted-Distance Framework for No-Box Membership Inference arXiv · Oct 3, 2026This paper red-teams synthetic gene expression data derived from TCGA bulk RNA-seq, released by the ELSA Health 2026 Challenge, by testing membership inference attacks. The authors unify five no-box attacks in one weighted-distance framework that differs only in how genes are weighted. Against a conditional variational autoencoder, spectral residualization raised pan-cancer TCGA AUC from 0.8251 to 0.8951 and TPR at 1% FPR from 0.3842 to 0.5970. Biological pathway priors did not transfer across targets.