Cryptography and Security
Keeping a Secret Requires a Good Memory: Space Lower-Bounds for Private Algorithms
Alessandro Epasto, Xin Lyu and Pasin Manurangsi
We study the computational cost of differential
privacy in terms of
memory efficiency. While the trade-off between accuracy and differential
privacy is well-understood, the inherent cost of
privacy regarding
memory use remains largely unexplored. This paper establishes for the first time an unconditional space lower bound for user-level differential
privacy by introducing a novel proof technique based on a multi-player communication game. Central to our approach, this game formally links the hardness of low-
memory private
algorithms to the necessity of “contribution capping” – tracking and limiting the users who disproportionately impact the
dataset. We demonstrate that winning this communication game requires transmitting information proportional to the number of over-active users, which translates directly to
memory lower bounds. We apply this framework, as an example, to the fundamental problem of estimating the number of distinct elements in a stream and we prove that any private
algorithm requires almost $\widetilde{\Omega}(T^{1/3})$ space to achieve certain error rates in a promise variant of the problem. This resolves an open problem in the literature (by Jain et al. NeurIPS 2023 and Cummings et al. ICML 2025) and establishes the first exponential separation between the space complexity of private
algorithms and their non-private $\widetilde{O}(1)$ counterparts for a natural statistical estimation task. Furthermore, we show that this communication-theoretic technique generalizes to broad classes of problems, yielding lower bounds for private medians,
quantiles, and max-select.
Read the full abstract ▾
Cryptography and Security
MalTool: Malicious Tool Attacks on LLM Agents
Yuepeng Hu, Yuqi Jia, Mengyuan Li et al. (+2 more)
In a malicious tool attack, an attacker uploads a malicious tool to a distribution platform; once a user inadvertently installs the tool and the LLM
agent selects it during task execution, the tool can compromise the user's security and
privacy. Prior work focuses on manipulating tool names and descriptions to increase the likelihood of installation by users and selection by LLM
agents. However, a successful attack also requires
embedding malicious behaviors in the tool's code implementation, which remains largely unexplored. In this work, we bridge this gap by presenting the first systematic study of malicious tool code implementations. We first propose a taxonomy of malicious tool behaviors based on the confidentiality-integrity-availability triad, tailored to LLM-
agent settings. To investigate the severity of the risks posed by attackers exploiting coding LLMs to automatically generate malicious tools, we develop MalTool, a coding-LLM-based framework that synthesizes tools exhibiting specified malicious behaviors, either as standalone tools or embedded within otherwise benign implementations. To ensure functional correctness and structural diversity, MalTool leverages an automated verifier that validates whether generated tools exhibit the intended malicious behaviors and differ sufficiently from previously generated instances, iteratively refining generations until success. Our evaluation demonstrates that MalTool is highly effective even when coding LLMs are safety-aligned. Using MalTool, we construct two
datasets of malicious tools: 1,300 standalone malicious tools and 5,727 real-world tools with embedded malicious behaviors. We further show that existing detection methods, including conventional malware detection approaches and methods tailored to the LLM-
agent setting, exhibit limited effectiveness at detecting the malicious tools, highlighting an urgent need for new defenses.
Read the full abstract ▾
All authors Yuepeng Hu, Yuqi Jia, Mengyuan Li, Dawn Song, Neil Gong
Cryptography and Security
Unknown Attack Detection in IoT Networks using Large Language Models: A Robust, Data-efficient Approach
Shan Ali, Feifei Niu, Paria Shirani et al. (+1 more)
The rapid
evolution of cyberattacks continues to drive the emergence of unknown (zero-day) threats, posing significant challenges for network intrusion detection systems in Internet of Things (IoT) networks. Existing machine learning and deep learning approaches typically rely on large labeled
datasets, payload inspection, or closed-set classification, limiting their effectiveness under data scarcity, encrypted traffic, and distribution shifts. Consequently, detecting unknown attacks in realistic IoT deployments remains difficult. To address these limitations, we propose SiamXBERT, a robust and data-efficient Siamese meta-learning framework empowered by a
transformer-based
language model for unknown attack detection. The proposed approach constructs a dual-modality feature representation by integrating flow-level and packet-level information, enabling richer behavioral modeling while remaining compatible with encrypted traffic. Through meta-learning, the model rapidly adapts to new attack types using only a small number of labeled samples and generalizes to previously unseen behaviors. Extensive experiments on representative IoT intrusion
datasets demonstrate that SiamXBERT consistently outperforms state-of-the-art baselines under both within-
dataset and cross-
dataset settings while requiring significantly less training data, achieving up to \num{78.8}% improvement in unknown F1-score. These results highlight the practicality of SiamXBERT for robust unknown attack detection in real-world IoT environments.
Read the full abstract ▾
All authors Shan Ali, Feifei Niu, Paria Shirani, Lionel C. Briand
Cryptography and Security
BlackCATT: Black-box Collusion Aware Traitor Tracing in Federated Learning
Elena Rodríguez-Lois, Fabio Brau, Maura Pintor et al. (+2 more)
Federated Learning has been popularized in recent years for applications involving personal or sensitive data, as it allows the collaborative training of machine learning models through local updates at the data-owners' premises, which does not require the sharing of the data itself. Considering the risk of leakage or misuse by any of the data-owners, many works attempt to protect their copyright, or even trace the origin of a potential leak through unique watermarks identifying each participant's model copy. Realistic accusation scenarios impose a black-box setting, where watermarks are typically embedded as a set of sample-label pairs. The threat of collusion, however, where multiple bad actors conspire together to produce an untraceable model, has been rarely addressed, and previous works have been limited to shallow networks and near-linearly separable main tasks. To the best of our knowledge, this work is the first to present a general collusion-resistant
embedding method for black-box traitor tracing in
Federated Learning: BlackCATT, which introduces a novel collusion-aware
embedding loss term and, instead of using a fixed trigger set, iteratively optimizes the triggers to aid convergence and traitor tracing performance. Experimental results confirm the efficacy of the proposed scheme across different architectures and
datasets. Furthermore, for models that would otherwise suffer from update incompatibility on the main task after learning different watermarks (e.g., architectures including batch normalization layers), our proposed BlackCATT+FR incorporates functional regularization through a set of auxiliary examples at the aggregator, promoting a shared feature space among model copies without compromising traitor tracing performance.
Read the full abstract ▾
All authors Elena Rodríguez-Lois, Fabio Brau, Maura Pintor, Battista Biggio, Fernando Pérez-González
Cryptography and Security
MedExChain: Enabling Secure and Efffcient PHR Sharing Across Heterogeneous Blockchains
Yongyang Lv, Xiaohong Li, Kui Chen et al. (+3 more)
With the proliferation of intelligent healthcare systems, patients' Personal Health Records (PHR) generated by the Internet of Medical Things (IoMT) in real-time play a vital role in disease diagnosis. The integration of emerging blockchain technologies signiffcantly enhanced the data security inside intelligent medical systems. However, data sharing across different systems based on varied blockchain architectures is still constrained by the unsolved performance and security challenges. This paper constructs a cross-chain data sharing scheme, termed MedExChain, which aims to securely share PHR across heterogeneous blockchain systems. The MedExChain scheme ensures that PHR can be shared across chains even under the performance limitations of IoMT devices. Additionally, the scheme incorporates Cryptographic Reverse Firewall (CRF) and a blockchain audit mechanism to defend against both internal and external security threats. The robustness of our scheme is validated through BAN logic, Scyther tool, Chosen Plaintext Attack (CPA) and
Algorithm Substitution Attack (ASA) security analysis veriffcation. Extensive evaluations demonstrate that MedExChain signiffcantly minimizes computation and communication overhead, making it suitable for IoMT devices and fostering the efffcient circulation of PHR across diverse blockchain systems.
Read the full abstract ▾
All authors Yongyang Lv, Xiaohong Li, Kui Chen, Zhe Hou, Guangdong Bai, Ruitao Feng
Cryptography and Security · Cross-listed from cs.CL
DeepSight: An All-in-One LM Safety Toolkit
Bo Zhang, Jiaxuan Guo, Lijun Li et al. (+17 more)
As the development of Large Models (LMs) progresses rapidly, their safety is also a priority. In current Large
Language Models (LLMs) and
Multimodal Large
Language Models (MLLMs) safety workflow, evaluation, diagnosis, and
alignment are often handled by separate tools. Specifically, safety evaluation can only locate external behavioral risks but cannot figure out internal root causes. Meanwhile, safety diagnosis often drifts from concrete risk scenarios and remains at the explainable level. In this way, safety
alignment lack dedicated explanations of changes in internal mechanisms, potentially degrading general capabilities. To systematically address these issues, we propose an open-source project, namely DeepSight, to practice a new safety evaluation-diagnosis integrated paradigm. DeepSight is low-cost, reproducible, efficient, and highly scalable large-scale model safety evaluation project consisting of a evaluation toolkit DeepSafe and a diagnosis toolkit DeepScan. By unifying task and data protocols, we build a connection between the two stages and transform safety evaluation from black-box to white-box insight. Besides, DeepSight is the first open source toolkit that support the frontier AI risk evaluation and joint safety evaluation and diagnosis.
Read the full abstract ▾
All authors Bo Zhang, Jiaxuan Guo, Lijun Li, Dongrui Liu, Sujin Chen, Guanxu Chen, Zhijie Zheng, Qihao Lin, Lewen Yan, Chen Qian, Yijin Zhou, Yuyao Wu, Shaoxiong Guo, Tianyi Du, Jingyi Yang, Xuhao Hu, Ziqi Miao, Xiaoya Lu, Jing Shao, Xia Hu
Cryptography and Security
Evaluation of Security-Induced Latency on 5G RAN Interfaces and User Plane Communication
Sotiris Michaelides, Jakub Lapawa, Daniel Eguiguren Chavez et al. (+1 more)
5G promises enhanced performance-not only in bandwidth and capacity, but also latency and security. Its ultra-reliable low-latency configuration targets round-trip times below 1 ms, while optional security controls extend protection across all interfaces, making 5G attractive for mission-critical applications. A key enabler of low latency is the disaggregation of network components, including the RAN, allowing user-plane functions to be deployed nearer to end users. However, this split introduces additional interfaces, whose protection increases latency overhead. In this paper, guided by discussions with a network operator and a 5G manufacturer, we evaluate the latency overhead of enabling optional 5G security controls across internal RAN interfaces and the 5G user plane. To this end, we deploy the first testbed implementing a disaggregated RAN with standardized optional security mechanisms. Our results show that disaggregated RAN deployments retain a latency advantage over monolithic designs, even with security enabled. However, achieving sub-1 ms round-trip times remains challenging, as cryptographic overhead alone can already exceed this target.
Read the full abstract ▾
All authors Sotiris Michaelides, Jakub Lapawa, Daniel Eguiguren Chavez, Martin Henze
Cryptography and Security
PAC to the Future: Zero-Knowledge Proofs of PAC Private Systems
Guilhem Repetto, Nojan Sheybani, Gabrielle De Micheli et al. (+1 more)
Privacy concerns in machine learning systems have grown significantly with the increasing reliance on sensitive user data for training large-scale models. This paper introduces a novel framework combining Probably Approximately Correct (PAC)
Privacy with zero-knowledge proofs (ZKPs) to provide verifiable
privacy guarantees in trustless computing environments. Our approach addresses the limitations of traditional
privacy-preserving techniques by enabling users to verify both the correctness of computations and the proper application of
privacy-preserving noise, particularly in cloud-based systems. We leverage non-interactive ZKP schemes to generate proofs that attest to the correct implementation of PAC
privacy mechanisms while maintaining the confidentiality of proprietary systems. Our results demonstrate the feasibility of achieving verifiable PAC
privacy in outsourced computation, offering a practical solution for maintaining trust in
privacy-preserving machine learning and database systems while ensuring computational integrity.
Read the full abstract ▾
All authors Guilhem Repetto, Nojan Sheybani, Gabrielle De Micheli, Farinaz Koushanfar
Cryptography and Security
Agentic AI for Cybersecurity: A Meta-Cognitive Architecture for Governable Autonomy
Andrei Kojukhov and Arkady Bovshover
Cybersecurity decision-making increasingly occurs in environments characterized by uncertainty, partial observability, and
adversarial manipulation, where heterogeneous signals from multiple sources are often incomplete, ambiguous, or conflicting. Traditional Security Orchestration, Automation, and Response (SOAR) systems rely on deterministic pipelines and threshold-based triggers, limiting their ability to support reliable decision-making under such conditions. This paper proposes a probabilistic, agentic framework for cybersecurity orchestration that models decision-making as a meta-cognitive process. The framework decomposes cybersecurity functions into interacting
agents responsible for detection, hypothesis formation, contextualization, explanation, and governance, coordinated through a meta-cognitive judgement mechanism. This mechanism evaluates uncertainty,
agent disagreement, and operational constraints to determine decision readiness, enabling adaptive strategies including automated action, escalation, deferral, and evidence refinement. Empirical evaluation on
benchmark datasets (CICIDS2017 and NSL-KDD), augmented with
adversarial and uncertain conditions, demonstrates that the proposed approach improves robustness and decision quality compared to deterministic and single-
agent baselines. The framework achieves higher accuracy under noise, reduces false positive rates, and produces better-calibrated confidence estimates, while enabling more adaptive and context-aware decision behavior. By explicitly modeling meta-cognitive processes - monitoring, evaluation, control, and reflection - the proposed approach reframes cybersecurity as an instance of AI-mediated cognitive problem solving, supporting accountable autonomy and more effective human-AI collaboration in
adversarial environments.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.SE
Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation
Javier Ron and Martin Monperrus
Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code provenance in practice remains challenging. The most popular technique, called reproducible builds, requires difficult matching and reexecution of build toolchains and environments. We propose a novel approach to verifiable provenance based on compiling software with zero-knowledge virtual machines (zkVMs). By executing a compiler within a zkVM, our system produces both the compiled output and a cryptographic proof attesting that the compilation was performed on the claimed source code with the claimed compiler. We implement a proof-of-concept implementation using the RISC Zero zkVM and the ChibiCC C compiler, and evaluate it on 200 synthetic programs as well as 31 OpenSSL and 21 libsodium source files. Our results show that zk-compilation is applicable to real-world software and provides strong security guarantees: all
adversarial tests targeting compiler substitution, source tampering, output manipulation, and replay attacks are successfully blocked.
Read the full abstract ▾
Cryptography and Security
Resource-Aware Deployment Optimization for Collaborative Intrusion Detection in Layered Networks
André García Gómez, Ines Rieger, Wolfgang Hotwagner et al. (+4 more)
Collaborative Intrusion Detection Systems (CIDS) are increasingly adopted to counter cyberattacks, as their collaborative nature enables them to adapt to diverse scenarios across heterogeneous environments. As distributed critical infrastructure operates in rapidly evolving environments, such as drones in both civil and military domains, there is a growing need for CIDS architectures that can flexibly accommodate these dynamic changes. In this study, we propose a novel CIDS framework designed for easy deployment across diverse distributed environments. The framework dynamically optimizes detector allocation per node based on available resources and data types, enabling rapid adaptation to new operational scenarios with minimal computational overhead. We first conducted a comprehensive literature review to identify key characteristics of existing CIDS architectures. Based on these insights and real-world use cases, we developed our CIDS framework, which we evaluated using several distributed
datasets that feature different attack chains and network
topologies. Notably, we introduce a public
dataset based on a realistic cyberattack targeting a ground drone aimed at sabotaging critical infrastructure. Experimental results demonstrate that the proposed CIDS framework can achieve adaptive, efficient intrusion detection in distributed settings, automatically reconfiguring detectors to maintain an optimal configuration, without requiring heavy computation, since all experiments were conducted on edge devices.
Read the full abstract ▾
All authors André García Gómez, Ines Rieger, Wolfgang Hotwagner, Max Landauer, Markus Wurzenberger, Florian Skopik, Edgar Weippl
Cryptography and Security
Solving the Post-Quantum Control Plane Bottleneck: Energy-Aware Cryptographic Scheduling in Open RAN
Neha Gupta, Hamed Alimohammadi, Mohammad Shojafar et al. (+2 more)
The Open
Radio Access Network (O-RAN) offers flexibility and innovation but introduces unique security vulnerabilities, particularly from cryptographically relevant
quantum computers. While Post-
Quantum Cryptography (PQC) is the primary scalable defence, its computationally intensive handshakes create a significant bottleneck for the RAN control plane, posing sustainability challenges. This paper proposes an energy-aware framework to solve this PQC bottleneck, ensuring
quantum resilience without sacrificing operational energy efficiency. The system employs an O-RAN aligned split: a Crypto Policy rApp residing in the Non-Real-Time (Non-RT) RIC defines the strategic security envelope (including PQC suites), while a Security Operations Scheduling (SOS) xApp in the Near-RT RIC converts these into tactical timing and placement intents. Cryptographic enforcement remains at standards-compliant endpoints: the Open Fronthaul utilizes Media Access Control Security (MACsec) at the O-DU/O-RU, while the xhaul (midhaul and backhaul) utilizes IP Security (IPsec) at tunnel terminators. The SOS xApp reduces PQC overhead by batching non-urgent handshakes, prioritizing session resumption, and selecting parameters that meet slice SLAs while minimizing joules per secure connection. We evaluate the architecture via a Discrete-Event Simulation (DES) using 3GPP-aligned traffic profiles and verified hardware
benchmarks from literature. Results show that intelligent scheduling can reduce per-handshake energy by approximately 60 percent without violating slice latency targets.
Read the full abstract ▾
All authors Neha Gupta, Hamed Alimohammadi, Mohammad Shojafar, De Mi, Muhammad N.M. Bhutta
Cryptography and Security
More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles
Ruibo Chen, Yihan Wu, Xuehao Cui et al. (+2 more)
Watermarking has emerged as a crucial technique for detecting and attributing content generated by large
language models. While recent advancements have utilized watermark ensembles to enhance robustness, prevailing methods typically prioritize maximizing the strength of the watermark at every individual layer. In this work, we identify a critical limitation in this "stronger-is-better" approach: strong watermarks significantly reduce the
entropy of the
token distribution, which paradoxically weakens the effectiveness of watermarking in subsequent layers. We theoretically and empirically show that detectability is bounded by
entropy and that watermark ensembles induce a monotonic decrease in both
entropy and the expected green-list ratio across layers. To address this inherent trade-off, we propose a general framework that utilizes weaker single-layer watermarks to preserve the
entropy required for effective multi-layer ensembling. Empirical evaluations demonstrate that this counter-intuitive strategy mitigates signal decay and consistently outperforms strong baselines in both detectability and robustness.
Read the full abstract ▾
All authors Ruibo Chen, Yihan Wu, Xuehao Cui, Jingqi Zhang, Heng Huang
Cryptography and Security
Reliable and Private Anonymous Routing for Satellite Constellations
Nilesh Vyas, Fabien Geyer and Svetoslav Duhovnikov
Shared, dynamic network infrastructures, such as dual-use LEO satellite constellations, pose critical threats to metadata
privacy, particularly for state actors operating in mixed-trust environments. This work proposes an enhanced anonymity architecture, evolving the Loopix mix-network, to provide robust security and reliability in these volatile
topologies. We introduce three primary contributions: (1) A multi-path transport protocol utilizing $(n, k)$ erasure codes, which is demonstrated to counteract the high link
volatility and intermittent connectivity that renders standard mix-networks unreliable. (2) The integration of a computationally efficient Private Information
Retrieval (PIR) protocol during route discovery. (3) The introduction of adaptive, centrality-based delay strategies that efficiently mitigate the inherent topological bias of LEO networks, providing a superior anonymity-to-latency trade-off. This mechanism provably prevents metadata leakage at the user-provider directory, mitigating profiling and correlation attacks. We validate this architecture via high-fidelity, packet-level simulations of a LEO constellation. Empirical results show our multi-path transport achieves near-zero message loss, establishing a quantifiable trade-off between reliability and bandwidth overhead. Furthermore, microbenchmarks of the PIR protocol quantify its computational and latency overheads, confirming its feasibility for practical deployment. This work provides a validated blueprint for deployable high-anonymity communication systems, demonstrating the viability of securely multiplexing sensitive operations within large-scale commercial network infrastructures.
Read the full abstract ▾
Cryptography and Security
LoRA-based Parameter-Efficient LLMs for Continuous Learning in Edge-based Malware Detection
Christian Rondanini, Barbara Carminati, Elena Ferrari et al. (+2 more)
The proliferation of edge devices has created an urgent need for security solutions capable of detecting malware in real time while operating under strict computational and
memory constraints. Recently, Large
Language Models (LLMs) have demonstrated remarkable capabilities in recognizing complex patterns, yet their deployment on edge devices remains impractical due to their resource demands. However, in edge malware detection, static or centrally retrained models degrade under evolving threats and heterogeneous traffic; locally trained models become siloed and fail to transfer across domains. To overcome these limitations, in this paper, we present a continuous learning architecture for edge-based malware detection that combines local adaptation on each device with global knowledge sharing through parameter-efficient LoRA adapters. Lightweight
transformer models (DistilBERT, DistilGPT-2, TinyT5) run on edge nodes and are incrementally fine-tuned on device-specific traffic; only the resulting LoRA modules are aggregated by a lightweight coordinator and redistributed, enabling cross-device generalization without exchanging raw data. We evaluate on two public IoT security
datasets, Edge-IIoTset and TON-IoT, under multi-round learning to simulate evolving threats. Compared to isolated fine-tuning, the LoRA-based exchange yields up to 20-25% accuracy gains when models encounter previously unseen attacks from another domain, while maintaining stable loss and F1 across rounds. LoRA adds less than 1% to model size (~0.6-1.8 MB), making updates practical for constrained edge hardware.
Read the full abstract ▾
All authors Christian Rondanini, Barbara Carminati, Elena Ferrari, Niccolò Lardo, Ashish Kundu
Cryptography and Security
DMind-3: A Sovereign Edge–Local–Cloud AI System with Controlled Deliberation and Correction-Based Tuning for Safe, Low-Latency Transaction Execution
Enhao Huang, Frank Li, Tony Lin et al. (+1 more)
This paper introduces DMind-3, a sovereign Edge-Local-Cloud intelligence stack designed to secure irreversible financial execution in Web3 environments against
adversarial risks and strict latency constraints. While existing cloud-centric assistants compromise
privacy and fail under network congestion, and purely local solutions lack global ecosystem context, DMind-3 resolves these tensions by decomposing capability into three cooperating layers: a deterministic signing-time intent firewall at the edge, a private high-fidelity
reasoning engine on user hardware, and a policy-governed global context synthesizer in the cloud. We propose policy-driven selective offloading to route computation based on
privacy sensitivity and uncertainty, supported by two novel training objectives: Hierarchical Predictive Synthesis (HPS) for fusing time-varying macro signals, and Contrastive Chain-of-Correction Supervised Fine-Tuning (C$^3$-SFT) to enhance local verification reliability. Extensive evaluations demonstrate that DMind-3 achieves a 93.7% multi-turn success rate in protocol-constrained tasks and superior domain
reasoning compared to general-purpose baselines, providing a scalable framework where safety is bound to the edge execution primitive while maintaining sovereignty over sensitive user intent.
Read the full abstract ▾
All authors Enhao Huang, Frank Li, Tony Lin, Lowes Yang
Cryptography and Security
QDBFT: A Dynamic Consensus Algorithm for Quantum-Secured Blockchain
Fei Xu, Cheng Ye, Jie OuYang et al. (+9 more)
The security foundation of blockchain system relies primarily on classical cryptographic methods and consensus
algorithms. However, the advent of
quantum computing poses a significant threat to conventional public-key cryptosystems based on computational hardness assumptions. In particular, Shor's
algorithm can efficiently solve discrete logarithm and integer factorization problems in
polynomial time, thereby undermining the immutability and security guarantees of existing systems. Moreover, current Practical Byzantine Fault Tolerance (PBFT) protocols, widely adopted in consortium blockchains, suffer from high communication overhead and limited efficiency when coping with dynamic node reconfigurations, while offering no intrinsic protection against
quantum adversaries. To address these challenges, we propose QDBFT, a
quantum-secured dynamic consensus
algorithm, with two main contributions: first,we design a primary node automatic rotation mechanism based on a consistent hash ring to enable consensus under dynamic membership changes, ensuring equitable authority distribution; second, we integrate
Quantum Key Distribution (QKD) networks to provide message authentication for inter-node communication, thereby achieving information-theoretic security in the consensus process. Experimental evaluations demonstrate that QDBFT achieves performance comparable to traditional PBFT while delivering strong resilience against
quantum attacks, making it a promising solution for future
quantum-secure decentralized infrastructures.
Read the full abstract ▾
All authors Fei Xu, Cheng Ye, Jie OuYang, Ziqiang Wu, Haoze Chen, An Hua, Meifeng Gao, Qiandong Zhang, Minghan Li, Feilong Li, Yajun Miao, Wei Qi
Cryptography and Security
Stop Tracking Me! Proactive Defense Against Attribute Inference Attack in LLMs
Dong Yan, Jian Liang, Ran He et al. (+1 more)
Recent studies have shown that large
language models (LLMs) can infer private user attributes (e.g., age, location, gender) from user-generated text shared online, enabling rapid and large-scale
privacy breaches. Existing anonymization-based defenses are coarse-grained, lacking word-level precision in anonymizing
privacy-leaking elements. Moreover, they are inherently limited as altering user text to hide sensitive cues still allows attribute inference to occur through models'
reasoning capabilities. To address these limitations, we propose a unified defense framework that combines fine-grained anonymization (TRACE) with inference-preventing optimization (RPS). TRACE leverages
attention mechanisms and inference chain generation to identify and anonymize
privacy-leaking textual elements, while RPS employs a lightweight two-stage optimization strategy to induce model rejection behaviors, thereby preventing attribute inference. Evaluations across diverse LLMs show that TRACE-RPS reduces attribute inference accuracy from around 50% to below 5% on open-source models. In addition, our approach offers strong cross-model generalization,
prompt-variation robustness, and utility-
privacy tradeoffs. Our code is available at https://github.com/Jasper-Yan/TRACE-RPS.
Read the full abstract ▾
All authors Dong Yan, Jian Liang, Ran He, Tieniu Tan
Cryptography and Security
Differentially Private and Communication Efficient Large Language Model Split Inference via Stochastic Quantization and Soft Prompt
Yujie Gu, Richeng Jin, Xiaoyu Ji et al. (+2 more)
Large
Language Models (LLMs) have achieved remarkable performance and received significant research interest. The enormous computational demands, however, hinder the local deployment on devices with limited resources. The current prevalent LLM inference paradigms require users to send queries to the service providers for processing, which raises critical
privacy concerns. Existing approaches propose to allow the users to obfuscate the
token embeddings before transmission and utilize local models for denoising. Nonetheless, transmitting the
token embeddings and deploying local models may result in excessive communication and computation overhead, preventing practical implementation. In this work, we propose DEL, a framework for Differentially private and communication Efficient LLM split inference. More specifically, an
embedding projection module and a differentially private
stochastic quantization mechanism are proposed to reduce the communication overhead in a
privacy-preserving manner. To eliminate the need for local models, we adapt soft
prompt at the server side to compensate for the utility degradation caused by
privacy. To the best of our knowledge, this is the first work that utilizes soft
prompt to improve the trade-off between
privacy and utility in LLM inference, and extensive experiments on text generation and natural
language understanding
benchmarks demonstrate the effectiveness of the proposed method.
Read the full abstract ▾
All authors Yujie Gu, Richeng Jin, Xiaoyu Ji, Yier Jin, Wenyuan Xu
Cryptography and Security
Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models
Sri Durga Sai Sowmya Kadali and Evangelos E. Papalexakis
Jailbreaking large
language models (LLMs) has emerged as a critical security challenge with the widespread deployment of conversational AI systems.
Adversarial users exploit these models through carefully crafted
prompts to elicit restricted or unsafe outputs, a phenomenon commonly referred to as Jailbreaking. Despite numerous proposed defense mechanisms, attackers continue to develop adaptive prompting strategies, and existing models remain vulnerable. This motivates approaches that examine the internal behavior of LLMs rather than relying solely on
prompt-level defenses. In this work, we study jailbreaking from both security and interpretability perspectives by analyzing how internal representations differ between jailbreak and benign
prompts. We conduct a systematic layer-wise analysis across multiple open-source models, including GPT-J, LLaMA, Mistral, and the state-space model Mamba, and identify consistent latent-space patterns associated with harmful inputs. We then propose a tensor-based latent representation framework that captures structure in hidden activations and enables lightweight jailbreak detection without model fine-tuning or auxiliary LLM-based detectors. We further demonstrate that the latent signals can be used to actively disrupt jailbreak execution at inference time. On an abliterated LLaMA-3.1-8B model, selectively bypassing high-susceptibility layers blocks 78% of jailbreak attempts while preserving benign behavior on 94% of benign
prompts. This intervention operates entirely at inference time and introduces minimal overhead, providing a scalable foundation for achieving stronger coverage by incorporating additional attack distributions or more refined susceptibility thresholds. Our results provide evidence that jailbreak behavior is rooted in identifiable internal structures and suggest a complementary, architecture-agnostic direction for improving LLM security.
Read the full abstract ▾
Cryptography and Security
Future Mining: Learning for Safety and Security
Md Sazedur Rahman, Mizanur Rahman Jewel and Sanjay Madria
Mining is rapidly evolving into an AI driven cyber physical ecosystem where safety and operational reliability depend on robust perception, trustworthy distributed intelligence, and continuous monitoring of miners and equipment. However, real world mining environments impose severe constraints, including poor illumination, GPS denied conditions, irregular underground
topologies and intermittent connectivity. These factors degrade perception accuracy, disrupt situational awareness and weaken distributed learning systems. At the same time, emerging cyber physical threats such as
backdoor triggers, sensor spoofing, label flipping attacks, and poisoned model updates further jeopardize operational safety as mines adopt autonomous vehicles,
humanoid assistance, and
federated learning for collaborative intelligence. Energy constrained sensors also experience uneven battery depletion, creating blind spots in safety coverage and disrupting hazard detection pipelines. This paper presents a
vision for a Unified Smart Safety and Security Architecture that integrates
multimodal perception, secure
federated learning, reinforcement learning, DTN enabled communication, and energy aware sensing into a cohesive safety framework. We introduce five core modules: Miner Finder,
Multimodal Situational Awareness,
Backdoor Attack Monitor, TrustFed LFD, and IoT driven Equipment Health Monitoring. These modules collectively address miner localization, hazard understanding,
federated robustness, and predictive maintenance. Together, they form an end to end framework capable of guiding miners through obstructed pathways, identifying compromised models or sensors, and ensuring mission critical equipment reliability. This work outlines a comprehensive research
vision for building a resilient and trustworthy intelligent mining system capable of maintaining operational continuity under
adversarial conditions.
Read the full abstract ▾
Cryptography and Security
Cachemir: Fully Homomorphic Encrypted Inference of Generative Large Language Model with KV Cache
Ye Yu, Yifan Zhou, Yi Chen et al. (+3 more)
Generative large
language models (LLMs) have revolutionized multiple domains. Modern LLMs predominantly rely on an autoregressive decoding strategy, which generates output
tokens sequentially and employs a key-value cache (KV cache) to avoid redundant computation. However, the widespread deployment of LLMs has raised serious
privacy concerns, as users are feeding all types of data into the model, motivating the development of secure inference frameworks based on fully homomorphic encryption (FHE). A major limitation of existing FHE-based frameworks is their inability to effectively integrate the KV cache, resulting in prohibitively high latency for autoregressive decoding. In this paper, we propose Cachemir, a KV Cache Accelerated Homomorphic Encrypted LLM Inference Regime to overcome this limitation. Cachemir comprises three key technical contributions: 1) a set of novel HE packing
algorithms specifically designed to leverage the computational advantages of the KV cache; 2) an interleaved replicated packing
algorithm to efficiently compute the vector-
matrix multiplications that result from using the KV cache in
Transformer linear layers; and 3) an augmented bootstrapping placement strategy that accounts for the KV cache to minimize bootstrapping cost. We demonstrate that Cachemir achieves $48.83\times$ and $67.16\times$ speedup over MOAI (ICML'25) and THOR (CCS'25) respectively on CPU and consumes less than 100 seconds on GPU to generate an output
token for Llama-3-8B.
Read the full abstract ▾
All authors Ye Yu, Yifan Zhou, Yi Chen, Pedro Soto, Wenjie Xiong, Meng Li