Cryptography and Security
MiniScope: Authorizing Agents with Least-Privilege Permissions
Jinhao Zhu, Xiao Huang, Kevin Tseng et al. (+4 more)
AI
agents are increasingly granted autonomous access to sensitive user data and third-party services, making effective permission management a critical security challenge. Existing permission models, however, typically rely on flat permission structures that fail to balance security with usability: fine-grained confirmation induces user fatigue, while coarse-grained or persistent approval leads to overprivileged
agents. To address this tradeoff, we propose a task-centric, hierarchical permission model that treats an
agent as a delegate operating within a task-specific role instead of requiring a separate permission decision for every tool call. Building on this model, we present MiniScope, an end-to-end permission system for
agents that automates permission-hierarchy discovery and enforces contextual least privilege at runtime. Our evaluation shows that MiniScope reduces simulated permission confirmations by 43.4%-89.4% for cautious and typical personas relative to per-tool prompting and mitigates all privilege-escalation attacks with negligible impact on utility and runtime. Applied to real-world deployments, MiniScope further uncovers six overprivileged connector configurations in ChatGPT and Claude.
Read the full abstract ▾
All authors Jinhao Zhu, Xiao Huang, Kevin Tseng, Gil Vernik, Shishir G. Patil, Vivian Fang, Raluca Ada Popa
Cryptography and Security
Automated Penetration Testing with LLM Agents and Classical Planning
Lingzhi Wang, Xinyi Shi, Ziyu Li et al. (+8 more)
While penetration testing plays a vital role in cybersecurity, achieving fully automated, hands-off-the-keyboard execution remains a significant research challenge. In this paper, we introduce the "Planner-Executor-Perceptor (PEP)" design paradigm and use it to systematically review existing work and identify the key challenges in this area. We also evaluate existing penetration testing systems, with a particular focus on the use of Large
Language Model (LLM)
agents for this task. The results show that the out-of-the-box Claude Code and Sonnet 4.5 exhibit superior penetration capabilities observed to date, substantially outperforming all prior systems. However, a detailed analysis of their testing processes reveals specific strengths and limitations; notably, LLM
agents struggle with maintaining coherent long-horizon plans, performing complex
reasoning, and effectively utilizing specialized tools. These limitations significantly constrain its overall capability, efficiency, and stability. To address these limitations, we propose CHECKMATE, a framework that integrates enhanced classical planning with LLM
agents, providing an external, structured "
brain" that mitigates the inherent weaknesses of LLM
agents. Our evaluation shows that CHECKMATE outperforms the state-of-the-art system (Claude Code) in penetration capability, improving
benchmark success rates by over 20%. In addition, it delivers substantially greater stability, cutting both time and monetary costs by more than 50%.
Read the full abstract ▾
All authors Lingzhi Wang, Xinyi Shi, Ziyu Li, Yi Jiang, Shiyu Tan, Yuhao Jiang, Junjie Cheng, Wenyuan Chen, Xiangmin Shen, Zhenyuan LI, Yan Chen
Cryptography and Security
Network and Compiler Optimizations for Efficient Linear Algebra Kernels in Private Transformer Inference
Karthik Garimella, Negar Neda, Austin Ebel et al. (+2 more)
Large
language model (LLM) based services are primarily structured as client-server interactions, with clients sending queries directly to cloud providers that host LLMs. This approach currently compromises data
privacy as all queries must be processed in the cloud and in the clear. Fully Homomorphic Encryption (FHE) is a solution to this data
privacy issue by enabling computations directly upon encrypted queries. However, running encrypted
transformer inference is challenging as programmers must map standard kernels to the constrained instruction set provided by FHE. In this work, we explore implementations of linear
algebra kernels needed for
transformer inference in FHE and understand how network optimization can help mitigate FHE costs while remaining performant. We leverage the Orion PyTorch to FHE framework to
benchmark several linear
algebra kernels in order to profile two linear transformation methods, packed row and BSGS, and find that BSGS outperforms packed row methods by up to $13.7 \times$ at
transformer-level scales. We also incorporate network-level
pruning strategies that reduce FHE runtimes of feed forward layers by up to $11.46\times$. Furthermore, we extend Orion to include ciphertext-ciphertext
matrix-
matrix products, a key component in the self-
attention blocks. Finally, we perform a roofline analysis of FHE primitives and encrypted linear transformations and find that (SIMD encoded) implementations are
memory-bound with primitives having roughly $0.1$ integer operations per byte of DRAM traffic. These findings illustrate the need for exploring alternative encoding schemes and models of computation within CKKS to unlock scalable private
transformer inference. We conduct all experiments using the Orion framework which can be found at: https://github.com/baahl-nyu/orion.
Read the full abstract ▾
All authors Karthik Garimella, Negar Neda, Austin Ebel, Nandan Kumar Jha, Brandon Reagen
Cryptography and Security
Cybersecurity policy adoption in South Africa: Does public trust matter?
Mbali Nkosi and Mike Nkongolo
This study examines how public perception influences the implementation and adoption of cybersecurity frameworks in South Africa. Using the PRISMA methodology, a systematic literature review was conducted across reputable scholarly databases, yielding 34 relevant sources aligned with predefined inclusion criteria. Cybersecurity, governance, trust,
privacy, cybercrime, and public opinion emerged as dominant thematic clusters. Bibliometric and thematic analyses, supported by network visualisations, revealed that while trust and public sentiment affect cybersecurity policy adoption globally, these factors have minimal influence within the South African policy landscape, despite the country's high cybercrime prevalence. In response, the study proposes a trust-centric policymaking framework designed to integrate public perception as a proactive dimension of cybersecurity governance. This framework seeks to prevent trust deficits from obstructing policy effectiveness and provides guidance for restoring trust where it has eroded.
Read the full abstract ▾
Cryptography and Security
An LLVM-Based Optimization Pipeline for SPDZ
Tianye Dai, Hammurabi Mendes and Heuichan Lim
Actively secure arithmetic MPC is now practical for real applications, but performance and usability are still limited by framework-specific compilation stacks, the need for programmers to explicitly express parallelism, and high communication overhead. We design and implement a proof-of-concept LLVM-based optimization pipeline for the SPDZ protocol that addresses these bottlenecks. Our front end accepts a subset of C with lightweight
privacy annotations and lowers it to LLVM IR, allowing us to reuse mature analyses and transformations to automatically batch independent arithmetic operations. Our back end performs data-flow and control-flow analysis on the optimized IR to drive a non-blocking runtime scheduler that overlaps independent operations and aggressively overlaps communication with computation; when enabled, it can map batched operations to GPU kernels. This design preserves a low learning curve by using a mainstream
language and hiding optimization and hardware-specific mechanics from programmers. We evaluate the system on controlled microbenchmarks against MP-SPDZ, focusing on online phase performance. Our CPU back end achieves up to 5.56 times speedup under intermediate and heavy algebraic workloads, shows strong scaling with thread count, and our GPU back end scales better as the input size increases. Overall, these results indicate that leveraging LLVM with protocol-aware scheduling is an effective architectural direction for extracting parallelism without sacrificing usability.
Read the full abstract ▾
Cryptography and Security · Cross-listed from quant-ph
Digital Coherent-State QRNG Using System-Jitter Entropy via Random Permutation
Randy Kuang
We present a fully digital framework that replicates the statistical behavior of coherent-state
quantum random number generation (QRNG) by harnessing system timing jitter through random permutation processes. Our approach transforms computational timing variations from hardware and operating system sources into permutation dynamics that generate Poisson-distributed numbers, accurately reproducing the
photon statistics of optical coherent states. The theoretical foundation is established by the Uniform Convergence
Theorem, which provides exponential convergence to uniformity under modular projection with rigorous error bounds. Extensive experimental validation across multiple parameter regimes and sample sizes up to $10^8$ bytes demonstrates exceptional performance: Shannon
entropy approaching 7.999998 bits/byte and min-
entropy exceeding 7.99 bits/byte, outperforming theoretical bounds at scale. The architecture inherently resists side-channel attacks through compound timing distributions and adaptive permutation behavior, while operating without classical cryptographic post-processing. Our results establish that coherent-state QRNG functionality can be entirely realized through classical computational processes, delivering mathematically provable uniformity and practical cryptographic security without
quantum photonic hardware.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Clip-and-Verify: Linear Constraint-Driven Domain Clipping for Accelerating Neural Network Verification
Duo Zhou, Jorge Chavez, Hesun Chen et al. (+2 more)
State-of-the-art neural network (NN) verifiers demonstrate that applying the branch-and-bound (BaB) procedure with fast bounding techniques plays a key role in tackling many challenging verification properties. In this work, we introduce the linear constraint-driven clipping framework, a class of scalable and efficient methods designed to enhance the efficacy of NN verifiers. Under this framework, we develop two novel
algorithms that efficiently utilize linear constraints to 1) reduce portions of the input space that are either verified or irrelevant to a subproblem in the context of branch-and-bound, and 2) directly improve intermediate bounds throughout the network. The process novelly leverages linear constraints that often arise from bound propagation methods and is general enough to also incorporate constraints from other sources. It efficiently handles linear constraints using a specialized GPU procedure that can scale to large neural networks without the use of expensive external solvers. Our verification procedure, Clip-and-Verify, consistently tightens bounds across multiple
benchmarks and can significantly reduce the number of subproblems handled during BaB. We show that our clipping
algorithms can be integrated with BaB-based verifiers such as $\alpha,\beta$-CROWN, utilizing either the split constraints in activation-space BaB or the output constraints that denote the unverified input space. We demonstrate the effectiveness of our procedure on a broad range of
benchmarks where, in some instances, we witness a 96% reduction in the number of subproblems during branch-and-bound, and also achieve state-of-the-art verified accuracy across multiple
benchmarks. Clip-and-Verify is part of the $\alpha,\beta$-CROWN verifier (http://abcrown.org), the VNN-COMP 2025 winner. Code available at https://github.com/Verified-Intelligence/Clip_and_Verify.
Read the full abstract ▾
All authors Duo Zhou, Jorge Chavez, Hesun Chen, Grani A. Hanasusanto, Huan Zhang
Cryptography and Security · Cross-listed from quant-ph
Enhancing the Practical Reliability of Shor's Quantum Algorithm via Generalized Period Decomposition: Theory and Large-Scale Empirical Validation
Chih-Chen Liao, Chia-Hsin Liu and Yun-Cheng Tsai
This work presents a generalized period decomposition approach, significantly improving the practical reliability of Shor's
quantum factoring
algorithm. Although Shor's
algorithm theoretically enables
polynomial-time integer factorization, its real-world performance heavily depends on stringent conditions related to the period obtained via
quantum phase estimation. Our generalized decomposition method relaxes these conditions by systematically exploiting arbitrary divisors of the obtained period, effectively broadening the applicability of each
quantum execution. Extensive classical simulations were performed to empirically validate our approach, involving over one million test cases across integers ranging from 2 to 8 digits. The proposed method achieved near-perfect success rates, exceeding 99.998% for 7-digit numbers and 99.999% for 8-digit numbers, significantly surpassing traditional and recently improved variants of Shor's
algorithm. Crucially, this improvement is achieved without compromising the
algorithm's
polynomial-time complexity and integrates seamlessly with existing
quantum computational frameworks. Moreover, our method enhances the efficiency of
quantum resource usage by minimizing unnecessary repetitions, making it particularly relevant for
quantum cryptanalysis with noisy intermediate-scale
quantum (NISQ) devices. This study thus provides both theoretical advancements and substantial practical benefits, contributing meaningfully to the field of
quantum algorithm research and the broader field of
quantum information processing.
Read the full abstract ▾
Cryptography and Security
TriHaRd: Higher Resilience for TEE Trusted Time
Matthieu Bettinger, Sonia Ben Mokhtar, Pascal Felber et al. (+3 more)
Accurately measuring time passing is critical for many applications. However, in Trusted Execution Environments (TEEs) such as Intel SGX, the time source is outside the Trusted Computing Base: a malicious host can manipulate the TEE's notion of time, jumping in time or affecting perceived time speed. Previous work (Triad) proposes protocols for TEEs to maintain a trustworthy time source by building a cluster of TEEs that collaborate with each other and with a remote Time Authority to maintain a continuous notion of passing time. However, such approaches still allow an attacker to control the operating system and arbitrarily manipulate their own TEE's perceived clock speed. An attacker can even propagate faster passage of time to honest machines participating in Triad's trusted time protocol, causing them to skip to timestamps arbitrarily far in the future. We propose TriHaRd, a TEE trusted time protocol achieving high resilience against clock speed and offset manipulations, notably through Byzantine-resilient clock updates and consistency checks. We empirically show that TriHaRd mitigates known attacks against Triad.
Read the full abstract ▾
All authors Matthieu Bettinger, Sonia Ben Mokhtar, Pascal Felber, Etienne Rivière, Valerio Schiavoni, Anthony Simonet-Boulogne
Cryptography and Security
A Proof of Success and Reward Distribution Protocol for Multi-bridge Architecture in Cross-chain Communication
Damilare Peter Oyinloye, Mohd Sameen Chishti and Jingyue Li
Single-bridge blockchain solutions enable cross-chain communication. However, they are associated with centralization and single-point-of-failure risks. This paper proposes Proof of Success and Reward Distribution (PSCRD), a novel multi-bridge response coordination and incentive distribution protocol designed to address the challenges. PSCRD introduces a fair reward distribution system that equitably distributes the transfer fee among participating bridges, incentivizing honest behavior and sustained commitment. The purpose is to encourage bridge participation for higher decentralization and lower single-point-of-failure risks. The mathematical analysis and simulation results validate the effectiveness of PSCRD using two key metrics: the Gini index, which demonstrates a progressive improvement in the
fairness of the reward distribution as new bridge groups joined the network; and the Nakamoto coefficient, which shows a significant improvement in decentralization over time. These findings highlight that PSCRD provides a more resilient and secure cross-chain bridge system without substantially increasing user costs.
Read the full abstract ▾
Cryptography and Security
Virtual camera detection: Catching video injection attacks in remote biometric systems
Daniyar Kurmankhojayev, Andrei Shadrikov, Dmitrii Gordin et al. (+4 more)
Face anti-spoofing (FAS) is a vital component of remote biometric authentication systems based on facial recognition, increasingly used across web-based applications. Among emerging threats,
video injection attacks – facilitated by technologies such as deepfakes and virtual camera software – pose significant challenges to system integrity. While virtual camera detection (VCD) has shown potential as a countermeasure, existing literature offers limited insight into its practical implementation and evaluation. This study introduces a machine learning-based approach to VCD, with a focus on its design and validation. The model is trained on metadata collected during sessions with authentic users. Empirical results demonstrate its effectiveness in identifying
video injection attempts and reducing the risk of malicious users bypassing FAS systems.
Read the full abstract ▾
All authors Daniyar Kurmankhojayev, Andrei Shadrikov, Dmitrii Gordin, Mikhail Shkorin, Danijar Gabdullin, Aigerim Kambetbayeva, Kanat Kuatov
Cryptography and Security · Cross-listed from cs.CV
TriDF: Evaluating Perception, Detection, and Hallucination for Interpretable DeepFake Detection
Jian-Yu Jiang-Lin, Kang-Yang Huang, Ling Zou et al. (+11 more)
Advances in generative modeling have made it increasingly easy to fabricate realistic portrayals of individuals, creating serious risks for security, communication, and public trust. Detecting such person-driven manipulations requires systems that not only distinguish altered content from authentic media but also provide clear and reliable
reasoning. In this paper, we introduce TriDF, a comprehensive
benchmark for interpretable DeepFake detection. TriDF contains high-quality forgeries from advanced synthesis models, covering 16 DeepFake types across image,
video, and audio modalities. The
benchmark evaluates three key aspects: Perception, which measures the ability of a model to identify fine-grained manipulation artifacts using human-annotated evidence; Detection, which assesses classification performance across diverse forgery families and generators; and
Hallucination, which quantifies the reliability of model-generated explanations. Experiments on state-of-the-art
multimodal large
language models show that accurate perception is essential for reliable detection, but
hallucination can severely disrupt decision-making, revealing the interdependence of these three aspects. TriDF provides a unified framework for understanding the interaction between detection accuracy, evidence identification, and explanation reliability, offering a foundation for building trustworthy systems that address real-world synthetic media threats.
Read the full abstract ▾
All authors Jian-Yu Jiang-Lin, Kang-Yang Huang, Ling Zou, Ling Lo, Sheng-Ping Yang, Yu-Wen Tseng, Kun-Hsiang Lin, Chia-Ling Chen, Yu-Ting Ta, Yan-Tsung Wang, Po-Ching Chen, Hongxia Xie, Hong-Han Shuai, Wen-Huang Cheng
Cryptography and Security
Adaptive Intrusion Detection System Leveraging Dynamic Neural Models with Adversarial Learning for 5G/6G Networks
Neha and Tarunpreet Bhatia
Intrusion Detection Systems (IDS) are critical components in safeguarding 5G/6G networks from both internal and external cyber threats. While traditional IDS approaches rely heavily on signature-based methods, they struggle to detect novel and evolving attacks. This paper presents an advanced IDS framework that leverages
adversarial training and dynamic neural networks in 5G/6G networks to enhance network security by providing robust, real-time threat detection and response capabilities. Unlike conventional models, which require costly retraining to update knowledge, the proposed framework integrates incremental learning
algorithms, reducing the need for frequent retraining.
Adversarial training is used to fortify the IDS against poisoned data. By using fewer features and incorporating statistical properties, the system can efficiently detect potential threats. Extensive evaluations using the NSL- KDD
dataset demonstrate that the proposed approach provides better accuracy of 82.33% for multiclass classification of various network attacks while resisting
dataset poisoning. This research highlights the potential of
adversarial-trained, dynamic neural networks for building resilient IDS solutions.
Read the full abstract ▾
Cryptography and Security
Perspectives on Objectives and Design Principles in Offline Payments with Central Bank Digital Currency
David-Alexandre Guiraud, Andrea Tundis and Marc Winstel
In this work, fundamental design principles for a central bank digital currency (CBDC) with offline functionality and corresponding countermeasures are discussed. We identify three major objectives relevant for core security and
privacy properties of such CBDC proposals:(i) Access Control Security— protection of a user's funds against unauthorized access by other users; (ii) Security against Depositor Misbehavior—preservation of the integrity of an environment (potentially the wallet) against misbehavior of its owner (for example, double-spending); (iii)
Privacy by Design—ensuring
privacy is embedded into the system architecture. Our central conclusion is based on the
alignment of the objectives to concrete design elements as countermeasures; certain objectives and countermeasures have no or minimal interference with each other. A major consequence of our work is that the integrity of a user's wallet and, accordingly, the mitigation of double-spending race attacks should be addressed through the adaptation and integration of secure hardware or functionally equivalent trusted execution mechanisms within a CBDC system. The developed framework is applied for the analysis of five academic proposals of payment systems.
Read the full abstract ▾
Cryptography and Security
Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs
Han Yang, Shaofeng Li, Tian Dong et al. (+3 more)
Deep Neural Networks (DNNs), as valuable intellectual property, face unauthorized use. Existing protections, such as digital watermarking, are largely passive; they provide only post-hoc ownership verification and cannot actively prevent the illicit use of a stolen model. This work proposes a proactive protection scheme, dubbed “Authority
Backdoor," which embeds access constraints directly into the model. In particular, the scheme utilizes a
backdoor learning framework to intrinsically lock a model's utility, such that it performs normally only in the presence of a specific trigger (e.g., a hardware fingerprint). But in its absence, the DNN's performance degrades to be useless. To further enhance the security of the proposed authority scheme, the certifiable robustness is integrated to prevent an adaptive attacker from removing the implanted
backdoor. The resulting framework establishes a secure authority mechanism for DNNs, combining access control with certifiable robustness against
adversarial attacks. Extensive experiments on diverse architectures and
datasets validate the effectiveness and certifiable robustness of the proposed framework.
Read the full abstract ▾
All authors Han Yang, Shaofeng Li, Tian Dong, Xiangyu Xu, Guangchi Liu, Zhen Ling
Cryptography and Security
LLM-Assisted AHP for Explainable Cyber Range Evaluation
Vyron Kampourakis, Georgios Kavallieratos, Georgios Spathoulas et al. (+2 more)
Cyber Ranges (CRs) have emerged as prominent platforms for cybersecurity training and education, especially for Critical Infrastructure (CI) sectors that face rising cyber threats. One way to address these threats is through hands-on exercises that bridge IT and OT domains to improve defensive readiness. However, consistently evaluating whether a CR platform is suitable and effective remains a challenge. This paper proposes an evaluation framework for CRs, emphasizing mission-critical settings by using a multi-criteria decision-making approach. We define a set of evaluation criteria that capture technical fidelity, training and assessment capabilities, scalability, usability, and other relevant factors. To weight and aggregate these criteria, we employ the Analytic Hierarchy Process (AHP), supported by a simulated panel of multidisciplinary experts implemented through a Large
Language Model (LLM). This LLM-assisted expert
reasoning enables consistent and reproducible pairwise comparisons across criteria without requiring direct expert convening. The framework's output equals quantitative scores that facilitate objective comparison of CR platforms and highlight areas for improvement. Overall, this work lays the foundation for a standardized and explainable evaluation methodology to guide both providers and end-users of CRs.
Read the full abstract ▾
All authors Vyron Kampourakis, Georgios Kavallieratos, Georgios Spathoulas, Vasileios Gkioulos, Sokratis Katsikas
Cryptography and Security
From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection
Chaomeng Lu and Bert Lagaisse
Vulnerability detection methods based on deep learning (DL) have shown strong performance on
benchmark datasets, yet their real-world effectiveness remains underexplored. Recent work suggests that graph neural network-based and
transformer-based models, including large
language models (LLMs), yield promising results when evaluated on curated
benchmark datasets. These
datasets are typically characterized by similar data distributions and may contain synthetic samples, heuristic labels, or labeling noise. In this study, we systematically evaluate four representative DL models—Devign, ReVeal, LineVul, and VulBERTa—across four representative
datasets: Juliet, Devign, BigVul, and ICVul. Each model is trained independently on each
dataset, and the graph-based and CodeBERT representations adopted by these models are analyzed using t-SNE and centroid distance to examine vulnerability-related patterns. To assess realistic applicability, we further evaluate trained ReVeal and LineVul models, along with four open-weight LLMs, on VentiVul, our newly constructed temporally separated out-of-distribution (OOD)
dataset comprising 200 recent vulnerabilities from Linux and Chromium. Our experiments reveal that current representation methods struggle to distinguish vulnerable from non-vulnerable code and that trained models generalize poorly across
datasets with differing distributions and characteristics. When evaluated on VentiVul, performance drops sharply, with most models failing to detect vulnerabilities reliably or distinguish vulnerable functions from their patched counterparts. These results expose a persistent gap between academic
benchmarks and real-world deployment, emphasizing the value of our deployment-oriented evaluation framework and the need for more robust code representations, higher-quality
datasets, and evaluation methods that account for vulnerability-fixing changes.
Read the full abstract ▾
Cryptography and Security
Stealth and Evasion in Rogue AP Attacks: An Analysis of Modern Detection and Bypass Techniques
Kaleb Bacztub, Braden Vester, Matteo Hodge et al. (+1 more)
Wireless networks act as the backbone of modern digital connectivity, making them a primary target for cyber adversaries. Rogue Access Point attacks, specifically the Evil Twin variant, enable attackers to clone legitimate wireless network identifiers to deceive users into connecting. Once a connection is established, the adversary can intercept traffic and harvest sensitive credentials. While modern defensive architectures often employ Network Intrusion Detection Systems (NIDS) to identify malicious activity, the effectiveness of these systems against Layer 2 wireless threats remains a subject of critical inquiry. This project aimed to design a stealth-capable Rogue AP and evaluate its detectability against Suricata, an open-source NIDS/IPS. The methodology initially focused on a hardware-based deployment using Raspberry Pi platforms but transitioned to a virtualized environment due to severe system compatibility issues. Using Wifipumpkin3, the research team successfully deployed a captive portal that harvested user credentials from connected devices. However, the Suricata NIDS failed to flag the attack, highlighting a significant blind spot in traditional intrusion detection regarding wireless management frame attacks. This paper details the construction of the attack, the evasion techniques employed, and the limitations of current NIDS solutions in detecting localized wireless threats
Read the full abstract ▾
All authors Kaleb Bacztub, Braden Vester, Matteo Hodge, Liulseged Abate
Cryptography and Security · Cross-listed from cs.AI
When Reject Turns into Accept: Quantifying the Vulnerability of LLM-Based Scientific Reviewers to Indirect Prompt Injection
Devanshu Sahoo, Manish Prasad, Vasudev Majhi et al. (+5 more)
Driven by surging submission volumes, scientific peer review has catalyzed two parallel trends: individual over-reliance on LLMs and institutional AI-powered assessment systems. This study investigates the robustness of "LLM-as-a-Judge" systems to
adversarial PDF manipulation via invisible text injections and layout aware encoding attacks. We specifically target the distinct incentive of flipping "Reject" decisions to "Accept," a vulnerability that fundamentally compromises scientific integrity. To measure this, we introduce the Weighted
Adversarial Vulnerability Score (WAVS), a novel metric that quantifies susceptibility by weighting score inflation against the severity of decision shifts relative to ground truth. We adapt 15 domain-specific attack strategies, ranging from semantic persuasion to cognitive obfuscation, and evaluate them across 13 diverse
language models (including GPT-5 and DeepSeek) using a curated
dataset of 200 official and real-world accepted and rejected submissions (e.g., ICLR OpenReview). Our results demonstrate that obfuscation techniques like "Maximum Mark Magyk" and "Symbolic Masking & Context Redirection" successfully manipulate scores, achieving decision flip rates of up to 86.26% in open-source models, while exposing distinct "
reasoning traps" in proprietary systems. We release our complete
dataset and injection framework to facilitate further research on the topic (https://anonymous.4open.sciencer/llm-jailbreak-FC9E/).
Read the full abstract ▾
All authors Devanshu Sahoo, Manish Prasad, Vasudev Majhi, Jahnvi Singh, Vinay Chamola, Yash Sinha, Murari Mandal, Dhruv Kumar
Cryptography and Security
Differential Privacy for Secure Machine Learning in Healthcare IoT-Cloud Systems
N Mangala, Murtaza Rangwala, S Aishwarya et al. (+5 more)
Healthcare has become exceptionally sophisticated, as wearables and connected medical devices revolutionize remote patient monitoring, emergency response, medication management, diagnosis, and predictive and prescriptive analytics. Internet of Things and Cloud computing integrated systems (IoT-Cloud) facilitate sensing, automation, and processing for these healthcare applications. While real-time response is crucial for alleviating patient emergencies, protecting patient
privacy is paramount in data-driven healthcare. In this paper, we propose a multi-layer IoT, Edge, and Cloud architecture to enhance emergency healthcare response times by distributing tasks based on response criticality and data permanence requirements. We ensure patient
privacy through a Differential
Privacy framework applied across several machine learning models: K-means, Logistic Regression, Random Forest, and Naive Bayes. We establish a comprehensive threat model identifying three adversary classes and evaluate Laplace, Gaussian, and hybrid noise mechanisms across varying
privacy budgets, with supervised
algorithms achieving up to 83.6% accuracy. The proposed hybrid Laplace-Gaussian noise mechanism with adaptive budget allocation provides a balanced approach, offering moderate tails and better
privacy-utility trade-offs for both low and high-dimension
datasets. At the practical threshold of $\varepsilon$=5.0, supervised
algorithms achieve 80-81% accuracy while reducing attribute inference attacks by up to 18% and data reconstruction correlation by 70%. We further enhance security through Blockchain integration, which ensures trusted communication through time-stamping, traceability, and immutability for analytics applications. Edge computing demonstrates 8$\times$ latency reduction for emergency scenarios, validating the hierarchical architecture for time-critical operations.
Read the full abstract ▾
All authors N Mangala, Murtaza Rangwala, S Aishwarya, B Eswara Reddy, Rajkumar Buyya, KR Venugopal, SS Iyengar, LM Patnaik
Cryptography and Security
D2M: A Decentralized, Privacy-Preserving, Incentive-Compatible Data Marketplace for Collaborative Learning
Yash Srivastava, Shalin Jain, Sneha Awathare et al. (+1 more)
The rising demand for collaborative machine learning and data analytics calls for secure and decentralized data sharing frameworks that balance
privacy, trust, and incentives. Existing approaches, including
federated learning (FL) and blockchain-based data
markets, fall short: FL often depends on trusted aggregators and lacks Byzantine robustness, while blockchain frameworks struggle with computation-intensive training and incentive integration. We present \prot, a decentralized data marketplace that unifies
federated learning, blockchain arbitration, and economic incentives into a single framework for
privacy-preserving data sharing. \prot\ enables data buyers to submit bid-based requests via blockchain smart contracts, which manage auctions, escrow, and dispute resolution. Computationally intensive training is delegated to \cone\ (\uline{Co}mpute \uline{N}etwork for \uline{E}xecution), an off-chain distributed execution layer. To safeguard against
adversarial behavior, \prot\ integrates a modified YODA protocol with exponentially growing execution sets for resilient consensus, and introduces Corrected OSMD to mitigate malicious or low-quality contributions from sellers. All protocols are incentive-compatible, and our game-theoretic analysis establishes honesty as the dominant strategy. We implement \prot\ on Ethereum and evaluate it over
benchmark datasets – MNIST, Fashion-MNIST, and CIFAR-10 – under varying
adversarial settings. \prot\ achieves up to 99% accuracy on MNIST and 90% on Fashion-MNIST, with less than 3% degradation up to 30% Byzantine nodes, and 56% accuracy on CIFAR-10 despite its complexity. Our results show that \prot\ ensures
privacy, maintains robustness under
adversarial conditions, and scales efficiently with the number of participants, making it a practical foundation for real-world decentralized data sharing.
Read the full abstract ▾
All authors Yash Srivastava, Shalin Jain, Sneha Awathare, Nitin Awathare
Cryptography and Security
Bit of a Close Talker: A Practical Guide to Serverless Cloud Co-Location Attacks
Wei Shao, Najmeh Nazari, Behnam Omidi et al. (+4 more)
Serverless computing has revolutionized cloud computing by offering users an efficient, cost-effective way to develop and deploy applications without managing infrastructure details. However, serverless cloud users remain vulnerable to various types of attacks, including micro-architectural side-channel attacks. These attacks typically rely on the physical co-location of victim and attacker instances, and attackers need to exploit cloud schedulers to achieve co-location with victims. Therefore, it is crucial to study vulnerabilities in serverless cloud schedulers and assess the security of different serverless scheduling
algorithms. This study addresses the gap in understanding and constructing co-location attacks in serverless clouds. We present a comprehensive methodology to uncover exploitable features in serverless scheduling
algorithms and to devise strategies for constructing co-location attacks via normal user interfaces. In our experiments, we successfully reveal exploitable vulnerabilities and achieve instance co-location on prevalent open-source infrastructures and Microsoft Azure Functions. We also present a mitigation strategy, the Double-Dip scheduler, to defend against co-location attacks in serverless clouds. Our work highlights critical areas for security enhancements in current cloud schedulers, offering insights to fortify serverless computing environments against potential co-location attacks.
Read the full abstract ▾
All authors Wei Shao, Najmeh Nazari, Behnam Omidi, Setareh Rafatirad, Khaled N. Khasawneh, Houman Homayoun, Chongzhou Fang
Cryptography and Security
FLARE: A Wireless Side-Channel Fingerprinting Attack on Federated Learning
Md Nahid Hasan Shuvo, Moinul Hossain, Anik Mallik et al. (+2 more)
Federated Learning (FL) enables collaborative model training across distributed devices while safeguarding data and user
privacy. However, FL remains susceptible to
privacy threats that can compromise data via direct means. That said, indirectly compromising the confidentiality of the FL model architecture (e.g., a convolutional neural network (CNN) or a recurrent neural network (RNN)) on a client device by an outsider remains unexplored. If leaked, this information can enable next-level attacks tailored to the architecture. This paper proposes a novel side-channel fingerprinting attack, leveraging flow-level and packet-level statistics of encrypted wireless traffic from an FL client to infer its deep learning model architecture. We name it
FLARE, a fingerprinting framework based on FL Architecture REconnaissance. Evaluation across various CNN and RNN variants-including pre-trained and custom models trained over IEEE 802.11 Wi-Fi-shows that
FLARE achieves over 98% F1-score in closed-world and up to 91% in open-world scenarios. These results reveal that CNN and RNN models leak distinguishable traffic patterns, enabling architecture fingerprinting even under realistic FL settings with hardware, software, and data heterogeneity. To our knowledge, this is the first work to fingerprint FL model architectures by sniffing encrypted wireless traffic, exposing a critical side-channel vulnerability in current FL systems.
Read the full abstract ▾
All authors Md Nahid Hasan Shuvo, Moinul Hossain, Anik Mallik, Jeffrey Twigg, Fikadu Dagefu
Cryptography and Security
Graph Neural Network Based Adaptive Threat Detection for Cloud Identity and Access Management Logs
Venkata Tanuja Madireddy
The rapid expansion of cloud infrastructures and distributed identity systems has significantly increased the complexity and attack surface of modern enterprises. Traditional rule based or signature driven detection systems are often inadequate in identifying novel or evolving threats within Identity and Access Management logs, where anomalous behavior may appear statistically benign but contextually malicious. This paper presents a Graph Neural Network Based Adaptive Threat Detection framework designed to learn latent user resource interaction patterns from IAM audit trails in real time. By modeling IAM logs as heterogeneous dynamic graphs, the proposed system captures temporal, relational, and contextual dependencies across entities such as users, roles, sessions, and access actions. The model incorporates
attention based aggregation and graph
embedding updates to enable continual adaptation to changing cloud environments. Experimental evaluation on synthesized and real world IAM
datasets demonstrates that the proposed method achieves higher detection precision and recall than baseline LSTM and GCN classifiers, while maintaining scalability across multi tenant cloud environments. The frameworks adaptability enables proactive mitigation of insider threats, privilege escalation, and lateral movement attacks, contributing to the foundation of AI driven zero trust access analytics. This work bridges the gap between graph based machine learning and operational cloud security intelligence.
Read the full abstract ▾
Cryptography and Security · Cross-listed from econ.TH
On Sybil Proofness in Competitive Combinatorial Exchanges
Abhimanyu Nag
We study Sybil manipulation in BRACE, a competitive
equilibrium mechanism for combinatorial exchanges, by treating identity creation as a finite perturbation of the empirical distribution of reported types. Under standard regularity assumptions on the excess demand map and smoothness of principal utilities, we obtain explicit linear bounds on price and welfare deviations induced by bounded Sybil invasion. Using these bounds, we prove a sharp contrast: strategyproofness in the large holds if and only if each principal's share of identities vanishes, whereas any principal with a persistent positive share can construct deviations yielding strictly positive limiting gains. We further show that the feasibility of BRACE fails in the event of an unbounded population of Sybils and provide a precise cost threshold that ensures disincentivization of such attacks in large
markets.
Read the full abstract ▾
Cryptography and Security
Watermarks for Language Models via Probabilistic Automata
Yangkun Wang and Jingbo Shang
A recent watermarking scheme for
language models achieves distortion-free
embedding and robustness to edit-distance attacks. However, it suffers from limited generation diversity and high detection overhead. In parallel, recent research has focused on undetectability, a property ensuring that watermarks remain difficult for adversaries to detect and spoof. In this work, we introduce a new class of watermarking schemes constructed through probabilistic automata. We present two instantiations: (i) a practical scheme with exponential generation diversity and computational efficiency, and (ii) a theoretical construction with formal undetectability guarantees under cryptographic assumptions. Extensive experiments on LLaMA-3B and Mistral-7B validate the superior performance of our scheme in terms of robustness and efficiency.
Read the full abstract ▾