Cryptography and Security
No Provenance Left Behind: Revisiting Reference Monitor Guarantees with Learned Kernel Scheduling
Jinsong Mao, Benjamin E. Ujcich and Shiqing Ma
Provenance plays a critical role in maintaining traceability of a system's actions for root cause analysis of security threats and impacts. Provenance collection is often incorporated into the reference monitor of systems to ensure that an audit trail exists of all events, that events are completely captured, and that logging of such events cannot be bypassed. However, recent research has questioned whether existing state-of-the-art provenance collection systems fail to ensure the security guarantees of a true reference monitor due to the 'super producer threat' in which provenance generation can overload a system to force the system to drop security-relevant events and allow an attacker to hide their actions. One approach towards solving this threat is to enforce resource isolation, but that does not fully solve the problems resulting from hardware dependencies and performance limitations. In this paper, we show how an operating system's kernel scheduler can mitigate this threat, and we introduce Aegis, a learned scheduler for Linux specifically designed for provenance. Unlike conventional schedulers that ignore provenance completeness requirements, Aegis leverages reinforcement learning to learn provenance task behavior and to dynamically optimize resource allocation. We evaluate Aegis's efficacy and show that Aegis significantly improves both the completeness and efficiency of provenance collection systems compared to traditional scheduling, while maintaining reasonable overheads and even improving overall runtime in certain cases compared to the default Linux scheduler.
Read the full abstract ▾
Cryptography and Security · Cross-listed from quant-ph
Lynn Engelberts, Yanlin Chen, Amin Shiraz Gilani et al. (+3 more)
The assumed hardness of the Shortest Vector Problem in high-dimensional
lattices is one of the cornerstones of post-
quantum cryptography. The fastest known heuristic attacks on SVP are via so-called sieving methods. While these still take exponential time in the dimension $d$, they are significantly faster than non-heuristic approaches and their heuristic assumptions are verified by extensive experiments. $k$-Tuple sieving is an iterative method where each iteration takes as input a large number of
lattice vectors of a certain norm, and produces an equal number of
lattice vectors of slightly smaller norm, by taking sums and differences of $k$ of the input vectors. Iterating these ”sieving steps” sufficiently many times produces a short
lattice vector. The fastest attacks (both classical and
quantum) are for $k=2$, but taking larger $k$ reduces the amount of
memory required for the attack. In this paper we improve the
quantum time complexity of 3-tuple sieving from $2^{0.3098 d}$ to $2^{0.2846 d}$, using a two-level amplitude amplification aided by a preprocessing step that associates the given
lattice vectors with nearby ”center points” to focus the search on the neighborhoods of these center points. Our
algorithm uses $2^{0.1887d}$ classical bits and QCRAM bits, and $2^{o(d)}$
qubits. This is the fastest known
quantum algorithm for SVP when total
memory is limited to $2^{0.1887d}$.
Read the full abstract ▾
All authors Lynn Engelberts, Yanlin Chen, Amin Shiraz Gilani, Maya-Iggy van Hoof, Stacey Jeffery, Ronald de Wolf
Cryptography and Security · Cross-listed from quant-ph
Parallel Spooky Pebbling Makes Regev Factoring More Practical
Gregory D. Kahanamoku-Meyer, Seyoon Ragavan and Katherine Van Kirk
Pebble games, an abstraction from classical reversible computing, have found use in the design of
quantum circuits for inherently sequential tasks. Gidney showed that allowing Hadamard basis measurements during pebble games can dramatically improve costs – an extension termed "spooky pebble games" because the measurements leave temporary phase errors called ghosts. Separately, previous work by Blocki et al. studied the benefits of parallelism in pebble games. In this work we define and study parallel spooky pebble games, showing that parallelism and spookiness can yield impressive gains when used together. First, we show by construction that a line graph of length $\ell$ can be pebbled in depth $2\ell$ (exactly optimal) using space $\leq 2.47\log \ell$. Then, to explore pebbling schemes using even less space, we use a highly optimized $A^*$ search implemented in Julia to find the lowest-depth parallel spooky pebbling possible for a range of concrete line graph lengths $\ell$ given a constant number of pebbles $s$. We then show that these techniques can significantly reduce the cost of the arithmetic in Regev's factoring
algorithm. For example, we find that 4096-bit integers $N$ can be factored in multiplication depth 193, which outperforms the 680 required of previous variants of Regev and the 444 reported by Ekerå and Gärtner for Shor's
algorithm. While the space required for Shor's
algorithm is considerably less than any variant of Regev's
algorithm including ours, and thus Shor likely remains the best candidate for the first
quantum factorization of large integers, our results show that implementations of Regev's
algorithm are far from fully optimized, and Regev's
algorithm may have practical importance in the future. We also believe our pebbling techniques are applicable in
quantum cryptanalysis beyond integer factorization, and in
quantum circuit compilation more broadly.
Read the full abstract ▾
Cryptography and Security
ExPrESSO: Zero-Knowledge backed Extensive Privacy Preserving Single Sign-on
Kaustabh Barman, Fabian Piper, Sanjeet Raj Pandey et al. (+1 more)
User authentication is one of the most important aspects for secure communication between services and end-users over the Internet. Service providers leverage Single-Sign On (SSO) to make it easier for their users to authenticate themselves. However, standardized systems for SSO, such as OIDC, do not guarantee user
privacy as identity providers can track user activities. We propose a zero-knowledge-based mechanism that integrates with OIDC to let users authenticate through SSO without revealing information about the service provider. Our system leverages Groth's zk-SNARK to prove membership of subscribed service providers without revealing their identity. We adopt a decentralized and verifiable approach to set up the prerequisites of our construction that further secures and establishes trust in the system. We set up high security targets and achieve them with minimal storage and latency cost, proving that our research can be adopted for production.
Read the full abstract ▾
All authors Kaustabh Barman, Fabian Piper, Sanjeet Raj Pandey, Axel Kuepper
Cryptography and Security
A Haskell to FHE Transpiler
Anne Müller, Mohd Kashif and Nico Döttling
Fully Homomorphic Encryption (FHE) enables the evaluation of programs directly on encrypted data. However, because only basic operations can be performed on ciphertexts, programs must be expressed as boolean or arithmetic
circuits. This low-level representation makes implementing applications for FHE significantly more cumbersome than writing code in a high-level
language. To reduce this burden, several transpilers have been developed that translate high-level code into
circuit representations. In this work, we extend the range of high-level
languages that can target FHE by introducing a transpiler for Haskell, which converts Haskell programs into Boolean
circuits suitable for homomorphic evaluation. Our second contribution is the automatic parallelization of these generated
circuits. We implement an evaluator that executes gates in parallel by parallelizing each layer of the
circuit. We demonstrate the effectiveness of our approach on two key applications: Private Information
Retrieval (PIR) and the AES encryption standard. Prior work has parallelized AES encryption manually. We demonstrate that the automated method outperforms some but not all manual parallelizations of AES evaluations under FHE. We achieve an evaluation time of 28 seconds for a parallel execution with 16 threads and an evaluation time of 8 seconds for a parallel execution with 100 threads
Read the full abstract ▾
Cryptography and Security
New Machine Learning Approaches for Intrusion Detection in ADS-B
Mikaëla Ngamboé, Jean-Simon Marrocco, Jean-Yves Ouattara et al. (+2 more)
With the growing reliance on the vulnerable Automatic Dependent Surveillance-Broadcast (ADS-B) protocol in air traffic management (ATM), ensuring security is critical. This study investigates emerging machine learning models and training strategies to improve AI-based intrusion detection systems (IDS) for ADS-B. Focusing on ground-based ATM systems, we evaluate two deep learning IDS implementations: one using a
transformer encoder and the other an extended Long Short-Term
Memory (xLSTM) network, marking the first xLSTM-based IDS for ADS-B. A transfer learning strategy was employed, involving pre-training on benign ADS-B messages and fine-tuning with labeled data containing instances of tampered messages. Results show this approach outperforms existing methods, particularly in identifying subtle attacks that progressively undermine situational awareness. The xLSTM-based IDS achieves an F1-score of 98.9%, surpassing the
transformer-based model at 94.3%. Tests on unseen attacks validated the generalization ability of the xLSTM model. Inference latency analysis shows that the 7.26-second delay introduced by the xLSTM-based IDS fits within the Secondary Surveillance Radar (SSR) refresh interval (5-12 s), although it may be restrictive for time-critical operations. While the
transformer-based IDS achieves a 2.1-second latency, it does so at the cost of lower detection performance.
Read the full abstract ▾
All authors Mikaëla Ngamboé, Jean-Simon Marrocco, Jean-Yves Ouattara, José M. Fernandez, Gabriela Nicolescu
Cryptography and Security
Systematic Assessment of Cache Timing Vulnerabilities on RISC-V Processors
Cédrick Austa, Jan Tobias Mühlberg and Jean-Michel Dricot
While interest in the open RISC-V instruction set architecture is growing, tools to assess the security of concrete processor implementations are lacking. There are dedicated tools and
benchmarks for common microarchitectural side-channel vulnerabilities for popular processor families such as Intel x86-64 or ARM, but not for RISC-V. In this paper we describe our efforts in porting an Intel x86-64
benchmark suite for cache-based timing vulnerabilities to RISC-V. We then use this
benchmark to evaluate the security of three commercially available RISC-V processors, the T-Head C910 and the SiFive U54 and U74 cores. We observe that the C910 processor exhibits more distinct timing types than the other processors, leading to the assumption that code running on the C910 would be exposed to more microarchitectural vulnerability sources. In addition, our evaluation reveals that $65.9\%$ of the vulnerabilities covered by the
benchmark exist in all processors, while only $6.8\%$ are absent from all cores. Our work, in particular the ported
benchmark, aims to support RISC-V processor designers to identify leakage sources early in their designs and to support the development of countermeasures.
Read the full abstract ▾
Cryptography and Security
TracE2E: Easily Deployable Middleware for Decentralized Data Traceability
Daniel Pressensé and Elisavet Kozyri
This paper presents TracE2E, a middleware written in Rust, that can provide both data explainability and compliance across multiple nodes. By mediating inputs and outputs of processes, TracE2E records provenance information and enforces data-protection policies (e.g., confidentiality, integrity) that depend on the recorded provenance. Unlike existing approaches that necessitate substantial application modifications, TracE2E is designed for easy integration into existing and future applications through a wrapper of the Rust standard library's IO module. We describe how TracE2E consistently records provenance information across nodes, and we demonstrate how the compliance layer of TracE2E can accommodate the enforcement of multiple policies.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CL
LLMs Deceive Unintentionally: Emergent Misalignment in Dishonesty from Misaligned Samples to Biased Human-AI Interactions
Xuhao Hu, Peng Wang, Xiaoya Lu et al. (+3 more)
Previous research has shown that LLMs finetuned on malicious or incorrect completions within narrow domains (e.g., insecure code or incorrect medical advice) can become broadly misaligned to exhibit harmful behaviors, which is called emergent misalignment. In this work, we investigate whether this phenomenon can extend beyond safety behaviors to a broader spectrum of dishonesty and deception under high-stakes scenarios (e.g., lying under pressure and deceptive behavior). To explore this, we finetune open-sourced LLMs on misaligned completions across diverse domains. Experimental results demonstrate that LLMs show broadly misaligned behavior in dishonesty. Additionally, we further explore this phenomenon in a downstream combined finetuning setting, and find that introducing as little as 1% of misalignment data into a standard downstream task is sufficient to decrease honest behavior over 20%. Furthermore, we consider a more practical human-AI interaction environment where we simulate both benign and biased users to interact with the assistant LLM. Notably, we find that the assistant can be misaligned unintentionally to exacerbate its dishonesty with only 10% biased user population. In summary, we extend the study of emergent misalignment to the domain of dishonesty and deception under high-stakes scenarios, and demonstrate that this risk arises not only through direct finetuning, but also in downstream mixture tasks and practical human-AI interactions. Refer to https://github.com/hxhcreate/LLM_Deceive_Unintentionally for experimental resources.
Read the full abstract ▾
All authors Xuhao Hu, Peng Wang, Xiaoya Lu, Dongrui Liu, Xuanjing Huang, Jing Shao
Cryptography and Security
LLM-Assisted Web Measurements
Simone Bozzolan, Stefano Calzavara and Lorenzo Cazzaro
Web measurements are a well-established methodology for assessing the security and
privacy landscape of the Internet. However, existing top lists of popular websites are unlabeled and lack semantic information about the nature of the included websites, making targeted web measurements challenging, as researchers often rely on ad-hoc techniques to bias
datasets toward specific website classes of interest. In this paper, we investigate the use of Large
Language Models (LLMs) to enable targeted web measurement studies. Building on prior literature, we identify key website classification tasks relevant to web measurements and highlight limitations in state-of-the-art classification approaches. We construct carefully curated
datasets to evaluate different LLMs on these tasks. Our results show that LLMs can achieve strong performance across multiple classification scenarios, but the choice of model and configuration plays a significant role. Motivated by the observed trade-off between classification accuracy and computational efficiency, we propose a practical two-step methodology for scalable targeted web measurements starting from the Tranco list. Finally, we conduct LLM-assisted web measurement studies inspired by prior work using our methodology and assess the validity of the resulting research inferences, showing that LLMs can effectively enable targeted measurements of security and
privacy trends on the Web.
Read the full abstract ▾
Cryptography and Security
A Novel Ensemble Learning Approach for Enhanced IoT Attack Detection: Redefining Security Paradigms in Connected Systems
Hikmat A. M. Abdeljaber, Md. Alamgir Hossain, Sultan Ahmad et al. (+4 more)
The rapid expansion of Internet of Things (IoT) devices has transformed industries and daily life by enabling widespread connectivity and data exchange. However, this increased interconnection has introduced serious security vulnerabilities, making IoT systems more exposed to sophisticated cyber attacks. This study presents a novel ensemble learning architecture designed to improve IoT attack detection. The proposed approach applies advanced machine learning techniques, specifically the Extra Trees Classifier, along with thorough preprocessing and hyperparameter optimization. It is evaluated on several
benchmark datasets including CICIoT2023, IoTID20, BotNeTIoT L01, ToN IoT, N BaIoT, and BoT IoT. The results show excellent performance, achieving high recall, accuracy, and precision with very low error rates. These outcomes demonstrate the model efficiency and superiority compared to existing approaches, providing an effective and scalable method for securing IoT environments. This research establishes a solid foundation for future progress in protecting connected devices from evolving cyber threats.
Read the full abstract ▾
All authors Hikmat A. M. Abdeljaber, Md. Alamgir Hossain, Sultan Ahmad, Ahmed Alsanad, Md Alimul Haque, Sudan Jha, Jabeen Nazeer
Cryptography and Security · Cross-listed from quant-ph
A Unified Approach to Quantum Key Leasing with a Classical Lessor
Fuyuki Kitagawa, Jiahui Liu, Shota Yamada et al. (+1 more)
Secure key leasing allows a cryptographic key to be leased as a
quantum state in such a way that the key can later be revoked in a verifiable manner. In this work, we propose a modular framework for constructing secure key leasing with a classical-lessor, where the lessor is entirely classical and, in particular, the
quantum secret key can be both leased and revoked using only classical communication. Based on this framework, we obtain classical-lessor secure key leasing schemes for public-key encryption (PKE), pseudorandom function (PRF), and digital signature. We adopt the strong security notion known as security against verification key revealing attacks (VRA security) proposed by Kitagawa et al. (Eurocrypt 2025) into the classical-lessor setting, and we prove that all three of our schemes satisfy this notion under the learning with errors assumption. Our PKE scheme improves upon the previous construction by Goyal et al. (Eurocrypt 2025), and our PRF and digital signature schemes are respectively the first PRF and digital signature with classical-lessor secure key leasing property.
Read the full abstract ▾
All authors Fuyuki Kitagawa, Jiahui Liu, Shota Yamada, Takashi Yamakawa
Cryptography and Security · Cross-listed from cs.LG
Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defenses
Stanisław Pawlak, Jan Dubiński, Daniel Marczak et al. (+1 more)
Model merging (MM) recently emerged as an effective method for combining large deep learning models. However, it poses significant security risks. Recent research shows that it is highly susceptible to
backdoor attacks, which introduce a hidden trigger into a single fine-tuned model instance that allows the adversary to control the output of the final merged model at inference time. In this work, we propose a simple framework for understanding
backdoor attacks by treating the attack itself as a task vector. $Backdoor\ Vector\ (BV)$ is calculated as the difference between the weights of a fine-tuned backdoored model and fine-tuned clean model. BVs reveal new insights into attacks understanding and a more effective framework to measure their similarity and transferability. Furthermore, we propose a novel method that enhances
backdoor resilience through merging dubbed $Sparse\ Backdoor\ Vector\ (SBV)$ that combines multiple attacks into a single one. We identify the core vulnerability behind
backdoor threats in MM: $inherent\ triggers$ that exploit
adversarial weaknesses in the base model. To counter this, we propose $Injection\ BV\ Subtraction\ (IBVS)$ - an assumption-free defense against
backdoors in MM. Our results show that SBVs surpass prior attacks and is the first method to leverage merging to improve
backdoor effectiveness. At the same time, IBVS provides a lightweight, general defense that remains effective even when the
backdoor threat is entirely unknown.
Read the full abstract ▾
All authors Stanisław Pawlak, Jan Dubiński, Daniel Marczak, Bartłomiej Twardowski
Cryptography and Security
Composition Law of Conjugate Observables in Random Permutation Sorting Systems
Yurang R. Kuang
We present the discovery of a fundamental composition law governing conjugate observables in the Random Permutation Sorting System (RPSS). The law links the discrete permutation count Np and the continuous elapsed time T through a functional relation connecting the characteristic function of timing distributions to the probability generating function of permutation counts. This framework enables
entropy purification, transforming microarchitectural timing fluctuations into uniform randomness via
geometric convergence. We establish convergence
theorems with explicit bounds and validate the results experimentally, achieving Shannon
entropy above 7.9998 bits per byte and chi-square uniformity across diverse platforms. The composition law provides a universal foundation for generating provably uniform randomness from general-purpose computation, securing cryptographic purity from emergent computational dynamics.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Fewer Weights, More Problems: A Practical Attack on LLM Pruning
Kazuki Egashira, Robin Staab, Thibaud Gloaguen et al. (+2 more)
Model
pruning, i.e., removing a subset of model weights, has become a prominent approach to reducing the
memory footprint of large
language models (LLMs) during inference. Notably, popular inference engines, such as vLLM, enable users to conveniently prune downloaded models before they are deployed. While the utility and efficiency of
pruning methods have improved significantly, the security implications of
pruning remain underexplored. In this work, for the first time, we show that modern LLM
pruning methods can be maliciously exploited. In particular, an adversary can construct a model that appears benign yet, once pruned, exhibits malicious behaviors. Our method is based on the idea that the adversary can compute a proxy metric that estimates how likely each parameter is to be pruned. With this information, the adversary can first inject a malicious behavior into those parameters that are unlikely to be pruned. Then, they can repair the model by using parameters that are likely to be pruned, effectively canceling out the injected behavior in the unpruned model. We demonstrate the severity of our attack through extensive evaluation on five models; after any of the
pruning in vLLM are applied (Magnitude, Wanda, and SparseGPT), it consistently exhibits strong malicious behaviors in a diverse set of attack scenarios (success rates of up to $95.7\%$ for jailbreak, $98.7\%$ for benign instruction refusal, and $99.5\%$ for targeted content injection). Our results reveal a critical deployment-time security gap and underscore the urgent need for stronger security awareness in model compression.
Read the full abstract ▾
All authors Kazuki Egashira, Robin Staab, Thibaud Gloaguen, Mark Vero, Martin Vechev
Cryptography and Security
One Risk Down, Another Up: Cross-Risk Interactions Induced by LLM Defenses
Xiangtao Meng, Tianshuo Cong, Li Wang et al. (+4 more)
Large
Language Models (LLMs) are increasingly deployed in high-stakes settings, where they face diverse risks. Numerous defense strategies have been proposed to mitigate these risks, but they are almost always evaluated in isolation. This isolated view leaves a critical question open: does mitigating one risk inadvertently change a model's exposure to others? Beyond the well-studied risk-utility trade-off, we present the first systematic study of cross-risk interactions induced by LLM defenses. We propose CrossRiskEval, an evaluation paradigm that situates a defended model in a multi-dimensional risk space and quantifies how a defense built for one risk shifts the others. Among 166 cross-risk evaluations covering 32 defended models, 77.1% exhibit statistically significant cross-risk interactions. Most of these interactions amplify non-target risks, with increases exceeding 100% in some cases. Beyond behavioral evaluation, we conduct
neuron-level analyses in seven selected cases to investigate one possible pathway associated with these interactions. We identify conflict-entangled
neurons whose activation interventions produce opposing effects on proxies for the target and non-target risks. In conflict cases, restoring these
neurons to their base-model activations partially reduces the corresponding risk increases, providing evidence that defense-induced changes to these
neurons may contribute to the observed interactions. Building on this evidence, we propose Conflict-Aware Freezing, a training-time strategy that prevents direct updates to the parameters associated with the identified
neurons. Across five conflict cases, it offsets 35%-196% of non-target risk amplification while meeting the original defense criterion.
Read the full abstract ▾
All authors Xiangtao Meng, Tianshuo Cong, Li Wang, Wenyu Chen, Zheng Li, Shanqing Guo, Xiaoyun Wang
Cryptography and Security
Decentralised Blockchain Management Through Digital Twins
Georgios Diamantopoulos, Nikos Tziritas, Rami Bahsoon et al. (+1 more)
The necessity of blockchain systems to remain decentralised limits current solutions to blockchain governance and dynamic management, forcing a trade-off between control and decentralisation. In light of the above, this work proposes a dynamic and decentralised blockchain management mechanism based on digital twins. To ensure decentralisation, the proposed mechanism utilises multiple digital twins that the system's stakeholders control. To facilitate decentralised decision-making, the twins are organised in a secondary blockchain system that orchestrates agreement on, and propagation of decisions to the managed blockchain. This enables the management of blockchain systems without centralised control. A preliminary evaluation of the performance and impact of the overheads introduced by the proposed mechanism is conducted through simulation. The results demonstrate the proposed mechanism's ability to reach consensus on decisions quickly and reconfigure the primary blockchain with minimal overhead.
Read the full abstract ▾
All authors Georgios Diamantopoulos, Nikos Tziritas, Rami Bahsoon, Georgios Theodoropoulos
Cryptography and Security · Cross-listed from cs.LG
MetaDefense: Defending Finetuning-based Jailbreak Attack Before and During Generation
Weisen Jiang and Sinno Jialin Pan
This paper introduces MetaDefense, a novel framework for defending against finetuning-based jailbreak attacks in large
language models (LLMs). We observe that existing defense mechanisms fail to generalize to harmful queries disguised by unseen attack templates, despite LLMs being capable of distinguishing disguised harmful queries in the
embedding space. Based on these insights, we propose a two-stage defense approach: (i) pre-generation defense that detects harmful queries before response generation begins, and (ii) mid-generation defense that monitors partial responses during generation to prevent outputting more harmful content. Our MetaDefense trains the LLM to predict the harmfulness of both queries and partial responses using specialized
prompts, enabling early termination of potentially harmful interactions. Extensive experiments across multiple LLM architectures (LLaMA-2-7B, Qwen-2.5-3B-Instruct, and LLaMA-3.2-3B-Instruct) demonstrate that MetaDefense significantly outperforms existing defense mechanisms, achieving robust defense against harmful queries with seen and unseen attack templates while maintaining competitive performance on benign tasks. Code is available at https://github.com/ws-jiang/MetaDefense.
Read the full abstract ▾
Cryptography and Security
Invisible to Humans, Triggered by Agents: Stealthy Jailbreak Attacks on Mobile Vision-Language Agents
Renhua Ding, Xiao Yang, Zhengwei Fang et al. (+3 more)
Large
Vision-
Language Models (LVLMs) empower autonomous mobile
agents, yet their security under realistic mobile deployment constraints remains underexplored. While
agents are vulnerable to visual
prompt injections, stealthily executing such attacks without requiring system-level privileges remains challenging, as existing methods rely on persistent visual manipulations that are noticeable to users. We uncover a consistent discrepancy between human and
agent interactions: automated
agents generate near-zero contact touch signals. Building on this insight, we propose a new attack paradigm,
agent-only perceptual injection, where malicious content is exposed only during
agent interactions, while remaining not readily perceived by human users. To accommodate mobile UI constraints and one-shot interaction settings, we introduce HG-IDA*, an efficient one-shot optimization method for constructing jailbreak
prompts that evade LVLM safety filters. Experiments demonstrate that our approach induces unauthorized cross-app actions, achieving 82.5% planning and 75.0% execution hijack rates on GPT-4o. Our findings highlight a previously underexplored attack surface in mobile
agent systems and underscore the need for defenses that incorporate interaction-level signals.
Read the full abstract ▾
All authors Renhua Ding, Xiao Yang, Zhengwei Fang, Jun Luo, Kun He, Jun Zhu
Cryptography and Security
Ancora: Accurate Intrusion Recovery for Web Applications
Yihao Peng, Biao Ma, Hai Wan et al. (+1 more)
Modern web application recovery presents a critical dilemma. Coarse-grained snapshot rollbacks cause unacceptable data loss for legitimate users. Surgically removing an attack's impact is hindered by a fundamental challenge in high-concurrency environments: it is difficult to attribute resulting file and database modifications to a specific attack-related request. We present Ancora, a system for precise intrusion recovery in web applications without invasive instrumentation. Ancora first isolates the full sequence of syscalls triggered by a single malicious request. Based on this sequence, Ancora addresses file and database modifications separately. To trace file changes, it builds a provenance graph that reveals all modifications, including those by exploit-spawned processes. To attribute database operations, a more difficult challenge due to connection pooling, Ancora introduces a novel spatiotemporal anchor. This anchor uses the request's network connection tuple and active time window to pinpoint exact database operations. With all malicious file and database operations precisely identified, Ancora performs a unified rewind and selective replay recovery. It reverts the system to a clean snapshot taken before the attack, then selectively re-applies only legitimate operations to both the file system and database. This completely removes the attack's effects while preserving concurrent legitimate data. We evaluated Ancora on 10 web applications and 20 CVE-based attack scenarios with concurrency up to 150 connections. Experiments demonstrate Ancora achieves 99.9% recovery accuracy with manageable overhead: up to 19.8% response latency increase and 17.8% QPS decrease in worst cases, and recovery throughput of 110.7 database operations per second and 27.2 affected files per second, effectively preserving legitimate data.
Read the full abstract ▾
All authors Yihao Peng, Biao Ma, Hai Wan, Xibin Zhao
Cryptography and Security
Man Hu, Xinyi Wu, Zuofeng Suo et al. (+5 more)
With the rise of advanced
reasoning capabilities, large
language models (LLMs) are receiving increasing
attention. However, although
reasoning improves LLMs' performance on downstream tasks, it also introduces new security risks, as adversaries can exploit these capabilities to conduct
backdoor attacks. Existing surveys on
backdoor attacks and
reasoning security offer comprehensive overviews but lack in-depth analysis of
backdoor attacks and defenses targeting LLMs'
reasoning abilities. In this paper, we take the first step toward providing a comprehensive review of
reasoning-based
backdoor attacks in LLMs by analyzing their underlying mechanisms, methodological frameworks, and unresolved challenges. Specifically, we introduce a new taxonomy that offers a unified perspective for summarizing existing approaches, categorizing
reasoning-based
backdoor attacks into associative, passive, and active. We also present defense strategies against such attacks and discuss current challenges alongside potential directions for future research. This work offers a novel perspective, paving the way for further exploration of secure and trustworthy LLM communities.
Read the full abstract ▾
All authors Man Hu, Xinyi Wu, Zuofeng Suo, Jinbo Feng, Linghui Meng, Yanhao Jia, Anh Tuan Luu, Shuai Zhao