Cryptography and Security · Cross-listed from cs.AI
The PBSAI Governance Ecosystem: A Multi-Agent AI Reference Architecture for Securing Enterprise AI Estates
John M. Willis
Enterprises are rapidly deploying large
language models,
retrieval augmented generation pipelines, and tool using
agents into production, often on shared high performance computing clusters and cloud accelerator platforms that also support defensive analytics. These systems increasingly function not as isolated models but as AI estates: socio technical systems spanning models,
agents, data pipelines, security tooling, human workflows, and hyperscale infrastructure. Existing governance and security frameworks, including the NIST AI Risk Management Framework and systems security engineering guidance, articulate principles and risk functions but do not provide implementable architectures for multi
agent, AI enabled cyber defense. This paper introduces the Practitioners Blueprint for Secure AI (PBSAI) Governance Ecosystem, a multi
agent reference architecture for securing enterprise and hyperscale AI estates. PBSAI organizes responsibilities into a twelve domain taxonomy and defines bounded
agent families that mediate between tools and policy through shared context envelopes and structured output contracts. The architecture assumes baseline enterprise security capabilities and encodes key systems security techniques, including analytic monitoring, coordinated defense, and adaptive response. A lightweight formal model of
agents, context envelopes, and ecosystem level invariants clarifies the traceability, provenance, and human in the loop guarantees enforced across domains. We demonstrate
alignment with NIST AI RMF functions and illustrate application in enterprise SOC and hyperscale defensive environments. PBSAI is proposed as a structured, evidence centric foundation for open ecosystem development and future empirical validation.
Read the full abstract ▾
Cryptography and Security
Peak + Accumulation: A Proxy-Level Scoring Formula for Multi-Turn LLM Attack Detection
J Alex Corll
Multi-turn
prompt injection attacks distribute malicious intent across multiple conversation turns, exploiting the assumption that each turn is evaluated independently. While single-turn detection has been extensively studied, no published formula exists for aggregating per-turn pattern scores into a conversation-level risk score at the proxy layer – without invoking an LLM. We identify a fundamental flaw in the intuitive weighted-average approach: it converges to the per-turn score regardless of turn count, meaning a 20-turn persistent attack scores identically to a single suspicious turn. Drawing on analogies from change-point detection (CUSUM),
Bayesian belief updating, and security risk-based alerting, we propose peak + accumulation scoring – a formula combining peak single-turn risk, persistence ratio, and category diversity. Evaluated on 10,654 multi-turn conversations – 588 attacks sourced from WildJailbreak
adversarial prompts and 10,066 benign conversations from WildChat – the formula achieves 90.8% recall at 1.20% false positive rate with an F1 of 85.9%. A sensitivity analysis over the persistence parameter reveals a phase transition at rho ~ 0.4, where recall jumps 12 percentage points with negligible FPR increase. We release the scoring
algorithm, pattern library, and evaluation harness as open source.
Read the full abstract ▾
Cryptography and Security
Yaksha-Prashna: Understanding eBPF Bytecode Network Function Behavior
Animesh Singh, K Shiv Kumar, S. VenkataKeerthy et al. (+7 more)
Many cloud infrastructure organizations increasingly rely on third-party eBPF-based network functions for use cases like security, observability, and load balancing, so that not everyone requires a team of highly skilled eBPF experts. However, the network functions from third parties (e.g., F5, Palo Alto) are available in bytecode format to cloud operators, giving little or no understanding of their functional correctness and interaction with other network functions in a chain. Also, eBPF developers want to provide proof of functional correctness for their developed network functions without disclosing the source code to the operators. We design Yaksha-Prashna, a system that allows operators/developers to assert and query bytecode's conformance to its specification and dependencies on other bytecodes. Our work builds domain-specific models that enable us to employ scalable program analysis to extract and model eBPF programs. Using Yaksha-Prashna
language, we express 24 properties on standard and non-standard eBPF-based network functions with 200-1000x speedup over the state-of-the-art work.
Read the full abstract ▾
All authors Animesh Singh, K Shiv Kumar, S. VenkataKeerthy, Pragna Mamidipaka, R V B R N Aaseesh, Sayandeep Sen, Palanivel Kodeswaran, Theophilus A. Benson, Ramakrishna Upadrasta, Praveen Tammana
Cryptography and Security
Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation
Shuyu Chang, Haiping Huang, Yanjun Zhang et al. (+3 more)
Code models are increasingly adopted in software development but remain vulnerable to
backdoor attacks via poisoned training data. Existing
backdoor attacks on code models face a fundamental trade-off between transferability and stealthiness. Static trigger-based attacks insert fixed dead code patterns that transfer well across models and
datasets but are easily detected by code-specific defenses. In contrast, dynamic trigger-based attacks adaptively generate context-aware triggers to evade detection but suffer from poor cross-
dataset transferability. Moreover, they rely on unrealistic assumptions of identical data distributions between poisoned and victim training data, limiting their practicality. To overcome these limitations, we propose Sharpness-aware Transferable
Adversarial Backdoor (STAB), a novel attack that achieves both transferability and stealthiness without requiring complete victim data. STAB is motivated by the observation that
adversarial perturbations in flat regions of the loss landscape transfer more effectively across
datasets than those in sharp minima. To this end, we train a surrogate model using Sharpness-Aware Minimization to guide model parameters toward flat loss regions, and employ Gumbel-Softmax optimization to enable differentiable search over discrete trigger
tokens for generating context-aware
adversarial triggers. Experiments across three
datasets and two code models show that STAB outperforms prior attacks in terms of transferability and stealthiness. It achieves a 73.2% average attack success rate after defense, outperforming static trigger-based attacks that fail under defense. STAB also surpasses the best dynamic trigger-based attack by 12.4% in cross-
dataset attack success rate and maintains performance on clean inputs.
Read the full abstract ▾
All authors Shuyu Chang, Haiping Huang, Yanjun Zhang, Yujin Huang, Fu Xiao, Leo Yu Zhang
Cryptography and Security
TRACE: Timely Retrieval and Alignment for Cybersecurity Knowledge Graph Construction and Expansion
Zijing Xu, Ziwei Ning, Tiancheng Hu et al. (+4 more)
The rapid
evolution of cyber threats has highlighted significant gaps in security knowledge integration. Cybersecurity Knowledge Graphs (CKGs) relying on structured data inherently exhibit hysteresis, as the timely incorporation of rapidly evolving unstructured data remains limited, potentially leading to the omission of critical insights for risk analysis. To address these limitations, we introduce TRACE, a framework designed to integrate structured and unstructured cybersecurity data sources. TRACE integrates knowledge from 24 structured databases and 3 categories of unstructured data, including APT reports, papers, and repair notices. Leveraging Large
Language Models (LLMs), TRACE facilitates efficient entity extraction and
alignment, enabling continuous updates to the CKG. Evaluations demonstrate that TRACE achieves a 1.8x increase in node coverage compared to existing CKGs. TRACE attains the precision of 86.08%, the recall of 76.92%, and the F1 score of 81.24% in entity extraction, surpassing the best-known LLM-based baselines by 7.8%. Furthermore, our entity
alignment methods effectively harmonize entities with existing knowledge structures, enhancing the integrity and utility of the CKG. With TRACE, threat hunters and attack analysts gain real-time, holistic insights into vulnerabilities, attack methods, and defense technologies.
Read the full abstract ▾
All authors Zijing Xu, Ziwei Ning, Tiancheng Hu, Jianwei Zhuge, Yangyang Wang, Jiahao Cao, Mingwei Xu
Cryptography and Security · Cross-listed from cs.SE
SAFuzz: Semantic-Guided Adaptive Fuzzing for LLM-Generated Code
Ziyi Yang, Kalit Inani, Keshav Kabra et al. (+2 more)
While AI-coding assistants accelerate software development, current testing frameworks struggle to keep pace with the resulting volume of AI-generated code. Traditional fuzzing techniques often allocate resources uniformly and lack semantic awareness of algorithmic vulnerability patterns, leading to inefficient resource usage and missed vulnerabilities. To address these limitations, we present a hybrid testing framework that leverages LLM-guided adaptive fuzzing to detect algorithmic vulnerabilities efficiently. Our system SAFuzz integrates
prompt-based behavioral diversification, harness generation with problem-specific oracles, and an LLM-based predictor to enable adaptive resource allocation and dynamic early stopping. Evaluating SAFuzz on CSES algorithmic problems, we improve vulnerability discrimination precision from 77.9% to 85.7% and achieve a 1.71x reduction in time cost compared to SOTA GreenFuzz while maintaining comparable recall. We further observe that combining our approach with existing unit test generation methods yields complementary gains, increasing the bug detection recall from 67.3% to 79.5%.
Read the full abstract ▾
All authors Ziyi Yang, Kalit Inani, Keshav Kabra, Vima Gupta, Anand Padmanabha Iyer
Cryptography and Security
Vulnerabilities in Partial TEE-Shielded LLM Inference with Precomputed Noise
Abhishek Saini, Haolin Jiang and Hang Liu
The deployment of large
language models (LLMs) on third-party devices requires new ways to protect model intellectual property. While Trusted Execution Environments (TEEs) offer a promising solution, their performance limits can lead to a critical compromise: using a precomputed, static secret basis to accelerate cryptographic operations. We demonstrate that this mainstream design pattern introduces a classic cryptographic flaw, the reuse of secret keying material, into the system's protocol. We prove its vulnerability with two distinct attacks: First, our attack on a model confidentiality system achieves a full confidentiality break by recovering its secret permutations and model weights. Second, our integrity attack completely bypasses the integrity checks of systems like Soter and TSQP. We demonstrate the practicality of our attacks against state-of-the-art LLMs, recovering a layer's secrets from a LLaMA-3 8B model in about 6 minutes and showing the attack scales to compromise 405B-parameter LLMs across a variety of configurations.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Token-Efficient Change Detection in LLM APIs
Timothée Chauvin, Clément Lalanne, Erwan Le Merrer et al. (+3 more)
Remote change detection in LLMs is a difficult problem. Existing methods are either too expensive for deployment at scale, or require initial white-box access to model weights or grey-box access to log probabilities. We aim to achieve both low cost and strict black-box operation, observing only output
tokens. Our approach hinges on specific inputs we call Border Inputs, for which there exists more than one output top
token. From a statistical perspective, optimal change detection depends on the model's Jacobian and the Fisher information of the output distribution. Analyzing these quantities in low-temperature regimes shows that border inputs enable powerful change detection tests. Building on this insight, we propose the Black-Box Border Input Tracking (B3IT) scheme. Extensive in-vivo and in-vitro experiments show that border inputs are easily found for non-
reasoning tested endpoints, and achieve performance on par with the best available grey-box approaches. B3IT reduces costs by $30\times$ compared to existing methods, while operating in a strict black-box setting.
Read the full abstract ▾
All authors Timothée Chauvin, Clément Lalanne, Erwan Le Merrer, Jean-Michel Loubes, François Taïani, Gilles Tredan
Cryptography and Security
IU-GUARD: Privacy-Preserving Spectrum Coordination for Incumbent Users under Dynamic Spectrum Sharing
Shaoyu Li, Hexuan Yu, Shanghao Shi et al. (+4 more)
With the growing demand for wireless spectrum, dynamic spectrum sharing (DSS) frameworks such as the Citizens Broadband
Radio Service (CBRS) have emerged as practical solutions to improve utilization while protecting incumbent users (IUs) such as military radars. However, current incumbent protection mechanisms face critical limitations. The Environmental Sensing Capability (ESC) requires costly sensor deployments and remains vulnerable to interference and security risks. Alternatively, the Incumbent Informing Capability (IIC) requires IUs to disclose their identities and operational parameters to the Spectrum Coordination System (SCS), creating linkable records that compromise operational
privacy and mission secrecy. We propose IU-GUARD, a
privacy-preserving spectrum sharing framework that enables IUs to access spectrum without revealing their identities. Leveraging verifiable credentials (VCs) and zero-knowledge proofs (ZKPs), IU-GUARD allows IUs to prove their authorization to the SCS while disclosing only essential operational parameters. This decouples IU identity from spectrum access, prevents cross-request linkage, and mitigates the risk of centralized SCS data leakage. We implement a prototype, and our evaluation shows that IU-GUARD achieves strong
privacy guarantees with practical computation and communication overhead, making it suitable for real-time DSS deployment.
Read the full abstract ▾
All authors Shaoyu Li, Hexuan Yu, Shanghao Shi, Md Mohaimin Al Barat, Yang Xiao, Y. Thomas Hou, Wenjing Lou
Cryptography and Security
Signal Decomposition Reveals Structure in Insider Threat Detection under Sparse Temporal Data
Hayden Beadles and Jericho Cain
Insider threat detection is difficult because malicious behavior is rare, irregular, and buried in long periods of inactivity. In enterprise audit data, most windows contain little activity, while attacks appear intermittently and range from brief events to sustained campaigns. Standard reconstruction-based models are therefore dominated by inactive regions and tend to learn baseline behavior rather than meaningful deviations. We separate activity presence from magnitude. Each window is decomposed into a binary mask indicating whether activity occurs and a value
matrix capturing its intensity. A dual-channel autoencoder reconstructs both, with value loss applied only where activity is present, directing learning toward sparse structure. Using the CERT r5.2
dataset as a controlled setting, we examine how anomaly signal changes with temporal configuration. Short attacks are detected mainly through presence; longer attacks introduce a magnitude component; noise degrades magnitude reliability and shifts detection back toward presence. The balance between channels is not fixed and follows the data. At the campaign level, signal concentrates in a small number of anomalous windows. Simple aggregation that emphasizes extreme scores is sufficient to recover extended activity without explicit sequence modeling. Effective detection depends less on model complexity and more on aligning representation and objective with sparse temporal structure.
Read the full abstract ▾
Cryptography and Security
CVPL: A Geometric Framework for Post-Hoc Linkage Risk Assessment in Protected Tabular Data
Valery Khvatov and Alexey Neyman
Formal
privacy metrics provide compliance-oriented guarantees but often fail to quantify actual linkability in released
datasets. We introduce CVPL (Cluster-Vector-Projection Linkage), a
geometric framework for post-hoc assessment of linkage risk between original and protected tabular data. CVPL represents linkage analysis as an operator pipeline comprising blocking, vectorization, latent projection, and similarity evaluation, yielding continuous, scenario-dependent risk estimates rather than binary compliance verdicts. We formally define CVPL under an explicit threat model and introduce threshold-aware risk surfaces, R(lambda, tau), that capture the joint effects of protection strength and attacker strictness. We establish a progressive blocking strategy with monotonicity guarantees, enabling anytime risk estimation with valid lower bounds. We demonstrate that the classical Fellegi-Sunter linkage emerges as a special case of CVPL under restrictive assumptions, and that violations of these assumptions can lead to systematic over-linking bias. Empirical validation on 10,000 records across 19 protection configurations demonstrates that formal k-anonymity compliance may coexist with substantial empirical linkability, with a significant portion arising from non-quasi-identifier behavioral patterns. CVPL provides interpretable diagnostics identifying which features drive linkage feasibility, supporting
privacy impact assessment, protection mechanism comparison, and utility-risk trade-off analysis.
Read the full abstract ▾
Cryptography and Security
Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System
Zhenhua Zou, Sheng Guo, Qiuyang Zhan et al. (+6 more)
The
evolution of Large
Language Models (LLMs) has shifted mobile computing from App-centric interactions to system-level autonomous
agents. Current implementations predominantly rely on a "Screen-as-Interface" paradigm, which inherits structural vulnerabilities and conflicts with the mobile ecosystem's economic foundations. In this paper, we conduct a systematic security analysis of state-of-the-art mobile
agents using Doubao Mobile Assistant as a representative case. We decompose the threat landscape into four dimensions -
Agent Identity, External Interface, Internal
Reasoning, and Action Execution - revealing critical flaws such as fake App identity, visual spoofing, indirect
prompt injection, and unauthorized privilege escalation stemming from a reliance on unstructured visual data. To address these challenges, we propose Aura, an
Agent Universal Runtime Architecture for a clean-slate secure
agent OS. Aura replaces brittle GUI scraping with a structured,
agent-native interaction model. It adopts a Hub-and-Spoke
topology where a privileged System
Agent orchestrates intent, sandboxed App
Agents execute domain-specific tasks, and the
Agent Kernel mediates all communication. The
Agent Kernel enforces four defense pillars: (i) cryptographic identity binding via a Global
Agent Registry; (ii) semantic input sanitization through a multilayer Semantic Firewall; (iii) cognitive integrity via taint-aware
memory and plan-trajectory
alignment; and (iv) granular access control with non-deniable
auditing. Evaluation on MobileSafetyBench shows that, compared to Doubao, Aura improves low-risk Task Success Rate from roughly 75% to 94.3%, reduces high-risk Attack Success Rate from roughly 40% to 4.4%, and achieves near-order-of-magnitude latency gains. These results demonstrate Aura as a viable, secure alternative to the "Screen-as-Interface" paradigm.
Read the full abstract ▾
All authors Zhenhua Zou, Sheng Guo, Qiuyang Zhan, Lepeng Zhao, Shuo Li, Qi Li, Ke Xu, Mingwei Xu, Zhuotao Liu
Cryptography and Security
Resilient Alerting Protocols for Blockchains
Marwa Mouallem, Lorenz Breidenbach, Ittay Eyal et al. (+1 more)
Smart contracts are stateful programs deployed on blockchains; they secure over a trillion dollars in transaction value per year. High-stakes smart contracts often rely on timely alerts about external events, but prior work has not analyzed their resilience to an attacker suppressing alerts via bribery. We formalize this challenge in a cryptoeconomic setting as the alerting problem, giving rise to a game between a bribing adversary and~$n$ rational participants, who pay a penalty if they are caught deviating from the protocol. We establish a quadratic, i.e.,~$O(n^2)$, upper bound, whereas a straightforward alerting protocol only achieves~$O(n)$ bribery cost. We present a simultaneous game that asymptotically achieves the quadratic upper bound and thus asymptotically-optimal bribery resistance. We then present two protocols that implement our simultaneous game: The first leverages a strong network synchrony assumption. The second relaxes this strong assumption and instead takes advantage of trusted hardware and blockchain proof-of-publication to establish a timed commitment scheme. These two protocols are constant-time but incur a linear storage overhead on the blockchain. We analyze a third, sequential alerting protocol that optimistically incurs no on-chain storage overhead, at the expense of~$O(n)$ worst-case execution time. All three protocols achieve asymptotically-optimal bribery costs, but with different resource and performance tradeoffs. Together, they illuminate a rich design space for practical solutions to the alerting problem.
Read the full abstract ▾
All authors Marwa Mouallem, Lorenz Breidenbach, Ittay Eyal, Ari Juels
Cryptography and Security
Beyond Permissions: A Configuration-Aware Empirical Assessment of Privacy Exposure in Children-Oriented and General-Audience Mobile Gaming Apps
Bakheet Aljedaani
Mobile gaming applications (apps) have become increasingly pervasive, including a growing number of games designed for children. Despite their popularity, these apps often integrate complex analytics, advertising, and attribution infrastructures that may introduce
privacy and security risks. Existing research has primarily focused on tracking behaviors or monetization models, leaving configuration-level
privacy exposure and children-oriented apps underexplored. In this study, we conducted a comparative static analysis of Android mobile games to investigate
privacy and security risks beyond permission usage. The analysis follows a three-phase methodology comprising (i) designing study protocol, (ii) Android Package Kit (APK) collection and static inspection, and (iii) data analysis. We examined permissions, manifest-level configuration properties (e.g., backup settings, cleartext network traffic, and exported components), and embedded third-party Software Development Kit (SDK) ecosystems across children-oriented and general-audience mobile games. The extracted indicators are synthesized into qualitative
privacy-risk categories to support comparative reporting. The results showed that while children-oriented games often request fewer permissions, they frequently exhibit configuration-level risks and embed third-party tracking SDKs similar to general-audience games. Architectural and configuration decisions play a critical role in shaping
privacy risks, particularly for apps targeting children. This study contributes a holistic static assessment of
privacy exposure in mobile games and provides actionable insights for developers, platform providers, and researchers seeking to improve
privacy-by-design practices in mobile applications.
Read the full abstract ▾
Cryptography and Security
Agentic Knowledge Distillation: Autonomous Training of Small Language Models for SMS Threat Detection
Adel ElZemity, Joshua Sylvester, Budi Arief et al. (+1 more)
SMS-based phishing (smishing) attacks have surged, yet training effective on-device detectors requires labelled threat data that quickly becomes outdated. To deal with this issue, we present Agentic Knowledge
Distillation, which consists of a powerful LLM acts as an autonomous teacher that fine-tunes a smaller student SLM, deployable for security tasks without human intervention. The teacher LLM autonomously generates synthetic data and iteratively refines a smaller on-device student model until performance plateaus. We compare four LLMs in this teacher role (Claude Opus 4.5, GPT 5.2 Codex, Gemini 3 Pro, and DeepSeek V3.2) on SMS spam/smishing detection with two student SLMs (Qwen2.5-0.5B and SmolLM2-135M). Our results show that performance varies substantially depending on the teacher LLM, with the best configuration achieving 94.31% accuracy and 96.25% recall. We also compare against a Direct Preference Optimisation (DPO) baseline that uses the same synthetic knowledge and LoRA setup but without iterative feedback or targeted refinement; agentic knowledge
distillation substantially outperforms it (e.g. 86-94% vs 50-80% accuracy), showing that closed-loop feedback and targeted refinement are critical. These findings demonstrate that agentic knowledge
distillation can rapidly yield effective security classifiers for edge deployment, but outcomes depend strongly on which teacher LLM is used.
Read the full abstract ▾
All authors Adel ElZemity, Joshua Sylvester, Budi Arief, Rogério De Lemos
Cryptography and Security · Cross-listed from cs.SE
VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection
Samal Mukhtar, Yinghua Yao, Zhu Sun et al. (+3 more)
Software vulnerability detection (SVD) is a critical challenge in modern systems. Large
language models (LLMs) offer natural-
language explanations alongside predictions, but most work focuses on binary evaluation, and explanations often lack semantic consistency with Common Weakness Enumeration (CWE) categories. We propose VulReaD, a knowledge-graph-guided approach for vulnerability
reasoning and detection that moves beyond binary classification toward CWE-level
reasoning. VulReaD leverages a security knowledge graph (KG) as a semantic backbone and uses a strong teacher LLM to generate CWE-consistent contrastive
reasoning supervision, enabling student model training without manual annotations. Students are fine-tuned with Odds Ratio Preference Optimization (ORPO) to encourage taxonomy-aligned
reasoning while suppressing unsupported explanations. Across three real-world
datasets, VulReaD improves binary F1 by 8-10% and multi-class classification by 30% Macro-F1 and 18% Micro-F1 compared to state-of-the-art baselines. Results show that LLMs outperform deep learning baselines in binary detection and that KG-guided
reasoning enhances CWE coverage and interpretability.
Read the full abstract ▾
All authors Samal Mukhtar, Yinghua Yao, Zhu Sun, Mustafa Mustafa, Yew Soon Ong, Youcheng Sun
Cryptography and Security · Cross-listed from cs.LG
Kill it with FIRE: On Leveraging Latent Space Directions for Runtime Backdoor Mitigation in Deep Neural Networks
Enrico Ahlers, Daniel Passon, Yannic Noller et al. (+1 more)
Machine learning models are increasingly present in our everyday lives; as a result, they become targets of
adversarial attackers seeking to manipulate the systems we interact with. A well-known vulnerability is a
backdoor introduced into a neural network by poisoned training data or a malicious training process.
Backdoors can be used to induce unwanted behavior by including a certain trigger in the input. Existing mitigations filter training data, modify the model, or perform expensive input modifications on samples. If a vulnerable model has already been deployed, however, those strategies are either ineffective or inefficient. To address this gap, we propose our inference-time
backdoor mitigation approach called FIRE (Feature-space Inference-time REpair). We hypothesize that a trigger induces structured and repeatable changes in the model's internal representation. We view the trigger as directions in the latent spaces between layers that can be applied in reverse to correct the inference mechanism. Therefore, we turn the backdoored model against itself by manipulating its latent representations and moving a poisoned sample's features along the
backdoor directions to neutralize the trigger. Our evaluation shows that FIRE has low computational overhead and outperforms current runtime mitigations on image
benchmarks across various attacks,
datasets, and network architectures.
Read the full abstract ▾
All authors Enrico Ahlers, Daniel Passon, Yannic Noller, Lars Grunske
Cryptography and Security
GoodVibe: Security-by-Vibe for LLM-Based Code Generation
Maximilian Thang, Lichao Wu, Sasha Behrouzi et al. (+4 more)
Large
language models (LLMs) are increasingly used for code generation in fast, informal development workflows, often referred to as vibe coding, where speed and convenience are prioritized, and security requirements are rarely made explicit. In this setting, models frequently produce functionally correct but insecure code, creating a growing security risk. Existing approaches to improving code security rely on full-parameter fine-tuning or parameter-efficient adaptations, which are either costly and prone to catastrophic forgetting or operate at coarse granularity with limited interpretability and control. We present GoodVibe, a
neuron-level framework for improving the security of code
language models by default. GoodVibe is based on the key insight that security-relevant
reasoning is localized to a small subset of
neurons. We identify these
neurons using gradient-based attribution from a supervised security task and perform
neuron-selective fine-tuning that updates only this security-critical subspace. To further reduce training cost, we introduce activation-driven
neuron clustering, enabling structured updates with minimal overhead. We evaluate GoodVibe on six LLMs across security-critical programming
languages, including C++, Java, Swift, and Go. GoodVibe substantially improves the security of generated code while preserving general model utility, achieving up to a 2.5x improvement over base models, achieving performance competitive with full fine-tuning while using over 4,700x fewer trainable parameters, and reducing training computation by more than 3.6x compared to the parameter-efficient baseline (LoRA). Our results demonstrate that
neuron-level optimization offers an effective and scalable approach to securing code generation without sacrificing generality.
Read the full abstract ▾
All authors Maximilian Thang, Lichao Wu, Sasha Behrouzi, Mohamadreza Rostami, Jona te Lintelo, Stjepan Picek, Ahmad-Reza Sadeghi
Cryptography and Security
Architecting Trust: A Framework for Secure IoT Systems Through Trusted Execution and Semantic Middleware
Muhammad Imran
The Internet of Things (IoT) security landscape requires the architectural solutions that can address the technical and operational challenges across the heterogeneous environments. The IoT systems operate in different conditions, and security issues continue to increase. This paper presents the comprehensive security framework for IoT that should integrate the Trusted Execution Environments (TEEs) with the semantic middleware and blockchain technologies. The work provides a systematic analysis of the architectural patterns based on more than twenty recent research works and the existing standards, and it proposes a layered security architecture. The architecture includes the hardware rooted trust at peripheral level, the zero trust principles at network level, and the semantic security mechanisms at application level. The framework focuses on practical implementation aspects such as the performance overhead, interoperability requirements, and the compliance with new regulations, which are very important for the real IoT deployments. The paper reports quantitative metrics which include the cryptographic performance on Cortex-M class microcontrollers with the detection accuracy rates and the energy consumption values. The proposed architecture shows that cross-layer security integration can provide defense in depth while it still satisfies the constraints of resource-limited IoT environments. The discussion highlights open challenges and the future research directions for the IoT security architectures that include the post-
quantum migration, secure
federated model exchange and the automated compliance verification.
Read the full abstract ▾
Cryptography and Security
SecureScan: An AI-Driven Multi-Layer Framework for Malware and Phishing Detection Using Logistic Regression and Threat Intelligence Integration
Rumman Firdos and Aman Dangi
The growing sophistication of modern malware and phishing campaigns has diminished the effectiveness of traditional signature-based intrusion detection systems. This work presents SecureScan, an AI-driven, triple-layer detection framework that integrates logistic regression-based classification, heuristic analysis, and external threat intelligence via the VirusTotal API for comprehensive triage of URLs, file hashes, and binaries. The proposed architecture prioritizes efficiency by filtering known threats through heuristics, classifying uncertain samples using machine learning, and validating borderline cases with third-party intelligence. On
benchmark datasets, SecureScan achieves 93.1 percent accuracy with balanced precision (0.87) and recall (0.92), demonstrating strong generalization and reduced overfitting through threshold-based decision calibration. A calibrated threshold and gray-zone logic (0.45-0.55) were introduced to minimize false positives and enhance real-world stability. Experimental results indicate that a lightweight statistical model, when augmented with calibrated verification and external intelligence, can achieve reliability and performance comparable to more complex deep learning systems.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CV
VideoSTF: Stress-Testing Output Repetition in Video Large Language Models
Yuxin Cao, Wei Song, Shangzhi Xu et al. (+2 more)
Video Large
Language Models (VideoLLMs) have achieved strong performance on
video understanding tasks, yet existing
benchmarks evaluate only what models predict, leaving the stability of how they generate largely unexamined. We surface a previously underexplored generation failure of VideoLLMs, defined as output repetition, in which the decoder collapses into self-reinforcing loops of repeated phrases or sentences, and present VideoSTF, a benchmarking framework for systematically measuring, stress-testing, and exploiting this failure mode. VideoSTF formalizes repetition with three complementary $n$-gram-based metrics, ships a standardized testbed of 10,000 diverse
videos, and provides a library of controlled temporal stressors. Across 10 advanced VideoLLMs, VideoSTF reveals four key findings: (i) repetition is pervasive on unperturbed
videos and stable across commonly used frame counts, with repetition rates up to 91%; (ii) it spans a severity spectrum from mild redundancy to
token-cap loops, and is highly amplified by temporal perturbations; (iii) temporal stressors form a practical black-box attack surface, flipping benign
videos into repetitive ones with tens of queries and high attack success rates (up to 98%), and (iv) repetition is not explained by visual redundancy, its amplification tracks local temporal disruption, and only repetition penalties reduce it among common mitigations such as top-$k$ sampling, input filtering, and
prompt variation, but increasing the penalty weakens visual grounding. VideoSTF reframes generation stability as a useful and complementary evaluation axis for VideoLLMs and provides the tools to study it. The project page is available at https://videostf.github.io/.
Read the full abstract ▾
All authors Yuxin Cao, Wei Song, Shangzhi Xu, Jingling Xue, Jin Song Dong
Cryptography and Security
Invisible Trails? An Identity Alignment Scheme based on Online Tracking
Ruisheng Shi, Zhiyuan Peng, Tong Fu et al. (+3 more)
Many tracking companies collect user data and sell it to data
markets and advertisers. While they claim to protect user
privacy by anonymizing the data, our research reveals that significant
privacy risks persist even with anonymized data. Attackers can exploit this data to identify users' accounts on other websites and perform targeted identity
alignment. In this paper, we propose an effective identity
alignment scheme for accurately identifying targeted users. We develop a data collector to obtain the necessary
datasets, an
algorithm for identity
alignment, and, based on this, construct two types of de-anonymization attacks: the passive attack, which analyzes tracker data to align identities, and the active attack, which induces users to interact online, leading to higher success rates. Furthermore, we introduce, for the first time, a novel evaluation framework for online tracking-based identity
alignment. We investigate the key factors influencing the effectiveness of identity
alignment. Additionally, we provide an independent assessment of our generated
dataset and present a fully functional system prototype applied to a cryptocurrency use case.
Read the full abstract ▾
All authors Ruisheng Shi, Zhiyuan Peng, Tong Fu, Lina Lan, Qin Wang, Jiaqi Zeng
Cryptography and Security
CryptoCatch: Cryptomining Hidden Nowhere
Ruisheng Shi, Ziding Lin, Haoran Sun et al. (+5 more)
Cryptomining poses significant security risks, yet traditional detection methods like blacklists and Deep Packet Inspection (DPI) are often ineffective against encrypted mining traffic and suffer from high false positive rates. In this paper, we propose a practical encrypted cryptomining traffic detection mechanism. It consists of a two-stage detection framework, which can effectively provide fine-grained detection results by machine learning and reduce false positives from classifiers through active probing. Our system achieves an F1-score of 0.99 and identifies specific cryptocurrencies with a 99.39% accuracy rate. Extensive testing across various mining pools confirms the effectiveness of our approach, offering a more precise and reliable solution for identifying cryptomining activities.
Read the full abstract ▾
All authors Ruisheng Shi, Ziding Lin, Haoran Sun, Qin Wang, Shihan Zhang, Lina Lan, Zhiyuan Peng, Chenfeng Wang
Cryptography and Security · Cross-listed from quant-ph
Privacy-Utility Tradeoffs in Quantum Information Processing
Theshani Nuradha, Sujeet Bhalerao and Felix Leditzky
When sensitive information is encoded in data, it is important to ensure the
privacy of information when attempting to learn useful information from the data. There is a natural tradeoff whereby increasing
privacy requirements may decrease the utility of a learning protocol. In the
quantum setting of differential
privacy, such tradeoffs between
privacy and utility have so far remained largely unexplored. In this work, we study optimal
privacy-utility tradeoffs for both generic and application-specific utility metrics when
privacy is quantified by $(\varepsilon,\delta)$-
quantum local differential
privacy. In the generic setting, we focus on optimizing fidelity and trace distance between the original state and the privatized state. We show that the depolarizing mechanism achieves the optimal utility for given
privacy requirements. We then study the specific application of learning the expectation of an observable with respect to an input state when only given access to privatized states. We derive a lower bound on the number of samples of privatized data required to achieve a fixed accuracy guarantee with high probability. To prove this result, we employ existing lower bounds on private
quantum hypothesis testing, thus showcasing the first operational use of them. We also devise private mechanisms that achieve optimal sample complexity with respect to the
privacy parameters and accuracy parameters, demonstrating that utility can be significantly improved for specific tasks in contrast to the generic setting. In addition, we show that the number of samples required to privately learn observable expectation values scales as $\Theta((\varepsilon \beta)^{-2})$, where $\varepsilon \in (0,1)$ is the
privacy parameter and $\beta$ is the accuracy tolerance. We conclude by initiating the study of private classical shadows, which promise useful applications for private learning tasks.
Read the full abstract ▾
Cryptography and Security
When Skills Lie: Hidden-Comment Injection in LLM Agents
Qianli Wang, Boyang Ma, Minghui Xu et al. (+1 more)
LLM
agents often rely on Skills to describe available tools and recommended procedures. We study a hidden-comment
prompt injection risk in this documentation layer: when a Markdown Skill is rendered to HTML, HTML comment blocks can become invisible to human reviewers, yet the raw text may still be supplied verbatim to the model. In experiments, we find that DeepSeek-V3.2 and GLM-4.5-Air can be influenced by malicious instructions embedded in a hidden comment appended to an otherwise legitimate Skill, yielding outputs that contain sensitive tool intentions. A short defensive system
prompt that treats Skills as untrusted and forbids sensitive actions prevents these malicious tool calls and instead surfaces the suspicious hidden instructions.
Read the full abstract ▾
All authors Qianli Wang, Boyang Ma, Minghui Xu, Yue Zhang
Cryptography and Security
Following Dragons: Code Review-Guided Fuzzing
Viet Hoang Luu, Amirmohammad Pasdar, Wachiraphan Charoenwet et al. (+3 more)
Modern fuzzers scale to large, real-world software but often fail to exercise the program states developers consider most fragile or security-critical. Such states are typically deep in the execution space, gated by preconditions, or overshadowed by lower-value paths that consume limited fuzzing budgets. Meanwhile, developers routinely surface risk-relevant insights during code review, yet this information is largely ignored by automated testing tools. We present EyeQ, a system that leverages developer intelligence from code reviews to guide fuzzing. EyeQ extracts security-relevant signals from review discussions, localizes the implicated program regions, and translates these insights into annotation-based guidance for fuzzing. The approach operates atop existing annotation-aware fuzzing, requiring no changes to program semantics or developer workflows. We first validate EyeQ through a human-guided feasibility study on a security-focused
dataset of PHP code reviews, establishing a strong baseline for review-guided fuzzing. We then automate the workflow using a large
language model with carefully designed
prompts. EyeQ significantly improves vulnerability discovery over standard fuzzing configurations, uncovering more than 40 previously unknown bugs in the security-critical PHP codebase.
Read the full abstract ▾
All authors Viet Hoang Luu, Amirmohammad Pasdar, Wachiraphan Charoenwet, Toby Murray, Shaanan Cohney, Van-Thuan Pham
Cryptography and Security
Protecting Context and Prompts: Deterministic Security for Non-Deterministic AI
Mohan Rajagopalan and Vinay Rao
Large
Language Model (LLM) applications are vulnerable to
prompt injection and context manipulation attacks that traditional security models cannot prevent. We introduce two novel primitives–authenticated
prompts and authenticated context–that provide cryptographically verifiable provenance across LLM workflows. Authenticated
prompts enable self-contained lineage verification, while authenticated context uses tamper-evident hash chains to ensure integrity of dynamic inputs. Building on these primitives, we formalize a policy
algebra with four proven
theorems providing protocol-level Byzantine resistance–even
adversarial agents cannot violate organizational policies. Five complementary defenses–from lightweight resource controls to LLM-based semantic validation–deliver layered, preventative security with formal guarantees. Evaluation against representative attacks spanning 6 exhaustive categories achieves 100% detection with zero false positives and nominal overhead. We demonstrate the first approach combining cryptographically enforced
prompt lineage, tamper-evident context, and provable policy
reasoning–shifting LLM security from reactive detection to preventative guarantees.
Read the full abstract ▾
Cryptography and Security
GPU-Fuzz: Finding Memory Errors in Deep Learning Frameworks
Zihao Li, Hongyi Lu, Yanan Guo et al. (+3 more)
GPU
memory errors are a critical threat to deep learning (DL) frameworks, leading to crashes or even security issues. We introduce GPU-Fuzz, a fuzzer locating these issues efficiently by modeling operator parameters as formal constraints. GPU-Fuzz utilizes a constraint solver to generate test cases that systematically probe error-prone boundary conditions in GPU kernels. Applied to PyTorch, TensorFlow, and PaddlePaddle, we uncovered 13 unknown bugs, demonstrating the effectiveness of GPU-Fuzz in finding
memory errors.
Read the full abstract ▾
All authors Zihao Li, Hongyi Lu, Yanan Guo, Zhenkai Zhang, Shuai Wang, Fengwei Zhang
Cryptography and Security
Authenticated Workflows: A Systems Approach to Protecting Agentic AI
Mohan Rajagopalan and Vinay Rao
Agentic AI systems automate enterprise workflows but existing defenses–guardrails, semantic filters–are probabilistic and routinely bypassed. We introduce authenticated workflows, the first complete trust layer for enterprise agentic AI. Security reduces to protecting four fundamental boundaries:
prompts, tools, data, and context. We enforce intent (operations satisfy organizational policies) and integrity (operations are cryptographically authentic) at every boundary crossing, combining cryptographic elimination of attack classes with runtime policy enforcement. This delivers deterministic security–operations either carry valid cryptographic proof or are rejected. We introduce MAPL, an AI-native policy
language that expresses agentic constraints dynamically as
agents evolve and invocation context changes, scaling as O(log M + N) policies versus O(M x N) rules through hierarchical composition with cryptographic attestations for workflow dependencies. We prove practicality through a universal security runtime integrating nine leading frameworks (MCP, A2A, OpenAI, Claude, LangChain, CrewAI, AutoGen, LlamaIndex, Haystack) through thin adapters requiring zero protocol modifications. Formal proofs establish completeness and soundness. Empirical validation shows 100% recall with zero false positives across 174 test cases, protection against 9 of 10 OWASP Top 10 risks, and complete mitigation of two high impact production CVEs.
Read the full abstract ▾
Cryptography and Security
The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis
Peiran Wang, Xinfeng Li, Chong Xiang et al. (+5 more)
The
evolution of Large
Language Models (LLMs) has resulted in a paradigm shift towards autonomous
agents, necessitating robust security against
Prompt Injection (PI) vulnerabilities where untrusted inputs hijack
agent behaviors. This SoK presents a comprehensive overview of the PI landscape, covering attacks, defenses, and their evaluation practices. Through a systematic literature review and quantitative analysis, we establish taxonomies that categorize PI attacks by payload generation strategies (heuristic vs. optimization) and defenses by intervention stages (text, model, and execution levels). Our analysis reveals a key limitation shared by many existing defenses and
benchmarks: they largely overlook context-dependent tasks, in which
agents are authorized to rely on runtime environmental observations to determine actions. To address this gap, we introduce AgentPI, a new
benchmark designed to systematically evaluate
agent behavior under context-dependent interaction settings. Using AgentPI, we empirically evaluate representative defenses and show that no single approach can simultaneously achieve high trustworthiness, high utility, and low latency. Moreover, we show that many defenses appear effective under existing
benchmarks by suppressing contextual inputs, yet fail to generalize to realistic
agent settings where context-dependent
reasoning is essential. This SoK distills key takeaways and open research problems, offering structured guidance for future research and practical deployment of secure LLM
agents.
Read the full abstract ▾
All authors Peiran Wang, Xinfeng Li, Chong Xiang, Jinghuai Zhang, Ying Li, Lixia Zhang, Xiaofeng Wang, Yuan Tian