Cryptography and Security
Self-Sovereign Agent
Wenjie Qu, Xuandong Zhao, Jiaheng Zhang et al. (+1 more)
We investigate the emerging prospect of self-sovereign
agents – AI systems that can economically sustain and extend their own operation without human involvement. Recent advances in large
language models and
agent frameworks have substantially expanded
agents' practical capabilities, pointing toward a potential shift from developer-controlled tools to more autonomous digital actors. We analyze the remaining technical barriers to such deployments and discuss the security, societal, and governance challenges that could arise if such systems become practically viable. A project page is available at: https://self-sovereign-
agent.github.io.
Read the full abstract ▾
All authors Wenjie Qu, Xuandong Zhao, Jiaheng Zhang, Dawn Song
Cryptography and Security · Cross-listed from cs.CL
Internal Safety Collapse in Frontier Large Language Models
Yutao Wu, Xiao Liu, Yifeng Gao et al. (+7 more)
This work identifies a critical failure mode in frontier large
language models (LLMs), which we term Internal Safety Collapse (ISC): under certain task conditions, models enter a state in which they continuously generate harmful content while executing otherwise benign tasks. We introduce TVD (Task, Validator, Data), a framework that triggers ISC through domain tasks where generating harmful content is the only valid completion, and construct ISC-Bench containing 53 scenarios across 8 professional disciplines. Evaluated on JailbreakBench, three representative scenarios yield worst-case safety failure rates averaging 95.3% across four frontier LLMs (including GPT-5.2 and Claude Sonnet 4.5), substantially exceeding standard jailbreak attacks. Frontier models are more vulnerable than earlier LLMs: the very capabilities that enable complex task execution become liabilities when tasks intrinsically involve harmful content. This reveals a growing attack surface: almost every professional domain uses tools that process sensitive data, and each new dual-use tool automatically expands this vulnerability–even without any deliberate attack. Despite substantial
alignment efforts, frontier LLMs retain inherently unsafe internal capabilities:
alignment reshapes observable outputs but does not eliminate the underlying risk profile. These findings underscore the need for caution when deploying LLMs in high-stakes settings. Source code: https://github.com/wuyoscar/ISC-Bench
Read the full abstract ▾
All authors Yutao Wu, Xiao Liu, Yifeng Gao, Xiang Zheng, Hanxun Huang, Yige Li, Cong Wang, Bo Li, Xingjun Ma, Yu-Gang Jiang
Cryptography and Security · Cross-listed from cs.GT
Capability-Priced Micro-Markets: A Micro-Economic Framework for the Agentic Web over HTTP 402
Ken Huang, Jerry Huang, Mahesh Lambe et al. (+8 more)
This paper introduces Capability-Priced Micro-
Markets (CPMM), a micro-economic framework designed to enable robust, scalable, and secure commerce among autonomous AI
agents on the agentic web. The framework addresses the fundamental challenge of economic coordination in decentralized
agent ecosystems, where entities must transact with minimal human oversight. CPMM synthesizes three key technologies into a unified system: MIT originated, Project NANDA infrastructure for cryptographically verifiable, capability-based security and discovery; the HTTP 402 "Payment Required" status code, with modern X402/H402 extensions for efficient, low-cost micropayments; and the
Agent Capability Negotiation and Binding Protocol (ACNBP) for secure, multi-step negotiation and commitment. The paper formalizes
agent interactions as a repeated bilateral game with incomplete information, demonstrating theoretically that the CPMM mechanism converges to a constrained Radner
equilibrium, ensuring efficient outcomes under information asymmetry. A key theoretical contribution is the concept of "
privacy elasticity of demand," which is introduced to quantify the trade-off between an
agent's information disclosure and the
market price of its services. By integrating secure capabilities, micropayment protocols, and formal negotiation mechanisms, CPMM provides a comprehensive, theoretically-grounded solution for creating functional micro-
markets for the emergent agentic web.
Read the full abstract ▾
All authors Ken Huang, Jerry Huang, Mahesh Lambe, Hammad Atta, Yasir Mehmood, Muhammad Zeeshan Baig, Muhammad Aziz Ul Haq, Nadeem Shahzad, Shailja Gupta, Rajesh Ranjan, Rekha Singhal
Cryptography and Security · Cross-listed from q-bio.QM
Privacy-Preserving Collaborative Medical Image Segmentation Using Latent Transform Networks
Saheed Ademola Bello, Muhammad Shahid Jabbar, Muhammad Sohail Ibrahim et al. (+1 more)
Collaborative training across multiple institutions is becoming essential for building reliable medical image
segmentation models. However,
privacy regulations, data silos, and uneven data availability prevent hospitals from sharing raw scans or annotations, limiting the ability to train generalizable models. Latent-space collaboration frameworks such as
privacy-
segmentation framework (SF) offer a promising alternative, but such methods still face challenges in
segmentation accuracy and vulnerability to latent inversion and membership-inference attacks. This work introduces a
privacy-preserving collaborative medical image
segmentation framework (PPCMI-SF) designed for heterogeneous medical
datasets. The approach combines skip-connected autoencoders for images and masks with a keyed latent transform that applies client-specific orthogonal mixing and permutation to protect latent features before they are shared. A unified mapping network on the server-side performs multi-scale latent-to-latent translation, enabling
segmentation inference without exposing raw data. Experiments on four
datasets: PSFH ultrasound, ultrasound nerve
segmentation, FUMPE CTA, and cardiac MRI show that the proposed PPCMI-SF consistently achieves high Dice scores and improved boundary accuracy, as reflected by lower 95th percentile Hausdorff distance (HD95) and average symmetric surface distance (ASD) compared to the current state-of-the-art and performs competitively with
privacy-agnostic baselines.
Privacy tests confirm strong resistance to inversion and membership attacks, and the overall system achieves real-time inference with low communication overhead. These results demonstrate that accurate and efficient medical image
segmentation can be achieved without compromising data
privacy in multi-institution settings.
Read the full abstract ▾
All authors Saheed Ademola Bello, Muhammad Shahid Jabbar, Muhammad Sohail Ibrahim, Shujaat Khan
Cryptography and Security
When Connectivity Is Not Enough: Cross-Layer Attacks on UAV C2 over 5G
Wagner Comin Sonaglio, Ágney Lopes Roth Ferraz, André Elias Melo et al. (+3 more)
Beyond Visual Line of Sight (BVLOS) unmanned aerial vehicle (
UAV) operations increasingly use 5G standalone (SA) networks for command and control (C2) between the
UAV and the ground control station (GCS). The 3rd Generation Partnership Project (3GPP) has specified mechanisms for authentication and authorization of unmanned aircraft systems (UAS) in this architectural setting. As a result, operators may treat registration state, Protocol Data Unit (PDU) session status, and IP reachability as evidence that the C2 path is available. In practice, however, these connectivity indicators alone do not guarantee that closed-loop control remains operationally safe. Attacks can degrade UAS C2 when timeliness degrades under shared User Plane contention, mobility continuity fails during Control Plane instability, or command integrity is violated at a trusted next-generation Node B (gNodeB). Such failures undermine connectivity as the central security indicator for
UAV operations. In this paper, we demonstrate these issues using three distinct threat models on a reproducible Open5GS and UERANSIM testbed that carries Micro Air Vehicle Link (MAVLink) over the 5G User Plane, and we use a commercial Nokia core to ground deployment assumptions. We address timeliness, availability, and integrity through experiments in which attack success is defined as forcing an unsafe closed-loop state without a clean disconnect. We observe stale telemetry and heavy-tailed delay under co-tenant User Plane contention, failsafe after handover under Control Plane instability, and
navigation hijacking after command rewriting at a compromised gNodeB. We further discuss why each threat model arises and evaluate mitigations for these cross-layer failures. Across the study, we disclosed five robustness issues: three CVEs have already been assigned, and two additional CVE requests are pending.
Read the full abstract ▾
All authors Wagner Comin Sonaglio, Ágney Lopes Roth Ferraz, André Elias Melo, Murray Evangelista de Souza, Guevara Noubir, Lourenço Alves Pereira Júnior
Cryptography and Security
Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems
Qizhi Cai, Yangyang Wei, Zhipeng Chen et al. (+2 more)
Agentic systems increasingly orchestrate complex, tool-using workflows within agentic execution environments, where high-level goals and tool invocations at the application layer materialize as process, file, and network activities at the operating-system layer. This cross-layer execution creates security risks that conventional input guardrails cannot capture, because malicious intent may become observable only through downstream execution effects. In multi-
agent deployments, inter-
agent communication and delegation introduce additional propagation paths. To address this gap, we propose AScope, an execution-aware framework that correlates application-level
agent semantics with kernel-level audit events and reconstructs them as cross-layer semantic flows. AScope connects fragmented operations into causal behavioral trajectories and uses a supervisor LLM to identify data flow violations, control flow deviations, and intent inconsistencies. We evaluate AScope on published AgentDojo traces with application-layer evidence and on ten multi-
agent scenarios with cross-layer telemetry. The results demonstrate strong detection sensitivity across both evidence settings and achieve node- and path-level F1-scores of 85.3% and 66.7% on the cross-layer
dataset.
Read the full abstract ▾
All authors Qizhi Cai, Yangyang Wei, Zhipeng Chen, Shouling Ji, Zhenyuan Li
Cryptography and Security · Cross-listed from cs.CY
Turning Trust to Transactions: Tracking Affiliate Marketing and FTC Compliance in YouTube's Influencer Economy
Chen Sun, Yash Vekaria, Zubair Shafiq et al. (+1 more)
YouTube has evolved into a powerful platform where creators monetize their influence through affiliate marketing, raising concerns about transparency and ethics, especially when creators fail to disclose their affiliate relationships. Although regulatory agencies like the US Federal Trade Commission (FTC) have issued guidelines to address these issues, non-compliance and consumer harm persist, and the extent of these problems remains unclear. In this paper, we introduce tools, developed with insights from recent advances in Web measurement and NLP research, to examine the state of the affiliate marketing ecosystem on YouTube. We apply these tools to a 10-year
dataset of 2 million
videos from nearly 540,000 creators, analyzing the prevalence of affiliate marketing on YouTube and the rates of non-compliant behavior. Our findings reveal that affiliate links are widespread, yet disclosure compliance remains low, with most
videos failing to meet FTC standards. Furthermore, we analyze the effects of different stakeholders in improving disclosure behavior. Our study suggests that the platform is highly associated with improved compliance through standardized disclosure features. We recommend that regulators and affiliate partners collaborate with platforms to enhance transparency, accountability, and trust in the influencer economy.
Read the full abstract ▾
All authors Chen Sun, Yash Vekaria, Zubair Shafiq, Rishab Nithyanand
Cryptography and Security · Cross-listed from cs.LG
Robustness of Agentic AI Systems via Adversarially-Aligned Jacobian Regularization
Furkan Mumcu and Yasin Yilmaz
As Large
Language Models (LLMs) transition into autonomous multi-
agent ecosystems, robust minimax training becomes essential yet remains prone to instability when highly non-linear policies induce extreme local
curvature in the inner maximization. Standard remedies that enforce global Jacobian bounds are overly conservative, suppressing sensitivity in all directions and inducing a large Price of Robustness. We introduce Adversarially-Aligned Jacobian Regularization (AAJR), a trajectory-aligned approach that controls sensitivity strictly along
adversarial ascent directions. We prove that AAJR yields a strictly larger admissible policy class than global constraints under mild conditions, implying a weakly smaller approximation gap and reduced nominal performance degradation. Furthermore, we derive step-size conditions under which AAJR controls effective smoothness along optimization trajectories and ensures inner-loop stability. These results provide a structural theory for agentic robustness that decouples minimax stability from global expressivity restrictions.
Read the full abstract ▾
Cryptography and Security
Breaking Bad Email Habits: Bounding the Impact of Simulated Phishing Campaigns
Muhammad Zia Hydari, Idris Adjerid, Yingda Lu et al. (+1 more)
Simulated phishing campaigns are widely deployed, yet the behavioral data they produce is endogenous: because training is triggered by clicking, the employees receiving intervention have already demonstrated susceptibility. This endogeneity, combined with the difficulty of separating genuine habit formation from stable individual differences, means standard analyses can mischaracterize program effectiveness. In this Research Note, we develop a generalizable analytic framework addressing both biases simultaneously. We utilize marginal structural models (MSMs) to correct for the endogenous, click-triggered assignment of training, while integrating correlated random effects (CRE) to disentangle true state dependence from stable employee heterogeneity. Applying the MSM+CRE
estimator to logs from 17 campaigns delivered to university staff (192,840 observations) reveals that analyses ignoring stable differences overstate the causal persistence of clicking; most repeat clicking reflects who employees are, not the effect of recent failures. This persistence is context-dependent, amplifying when successive campaigns share persuasion cues. Teachable-moment features also matter:
emotion framing and explicit reporting pitches can largely eliminate persistence, while annotated-email cues modestly exacerbate it. Finally, employees engaging with the education page exhibit greater persistence than those dismissing it, consistent with an emboldening mechanism. We contribute methodologically by integrating MSMs and CRE into a portable framework for analyzing standard simulation logs, and practically by identifying specific design levers so organizations can better sequence and evaluate their phishing programs.
Read the full abstract ▾
All authors Muhammad Zia Hydari, Idris Adjerid, Yingda Lu, Narayan Ramasubbu
Cryptography and Security · Cross-listed from cs.LG
PTOPOFL: Topology-Guided Personalised Federated Learning with Persistent-Homology Client Descriptors
Kelly L Vomo-Donfack, Adryel Hoszu, Grégory Ginot et al. (+1 more)
Clustered and personalised
federated learning (FL) needs a signal telling the server which clients should share a model. Most methods derive it from losses or model updates that must be recomputed during training. We study pTopoFL, which derives it once, before training, from a compact persistent-homology (PH) descriptor of each client's feature distribution: the server clusters clients on these descriptors, weights them within clusters, and runs blended clustered local gradient descent, returning one personalised model per cluster. For strongly convex, smooth losses we analyse the complete procedure: for any partition, one round is a contraction with factor (1-eta*mu)^tau; the fixed point is characterised by a local-step drift bound, an exact formula for the effective strength of blending (which yields a calibration rule) and a
stochastic floor exposing a bias-variance trade-off of clustering; and personalisation lowers the heterogeneity floor in proportion to a measurable share of the dispersion of client optima. Experiments on synthetic federations, a label-skew
benchmark and a real four-hospital
dataset confirm the theory and delimit the method. When feature geometry and decision rules co-vary, the PH partition recovers the latent client groups, including differences a linear-subspace descriptor misses, and pTopoFL is competitive with the strongest clustered baselines; on the real federation it lowers the test log-loss of FedAvg from 0.463 to 0.438, on par with the best personalised methods. When heterogeneity is invisible in feature geometry, it offers no advantage over FedAvg. pTopoFL transmits model parameters and is no more private than FedAvg; we give a record-level differential-
privacy accounting and show that privatising the descriptor destroys the partition. Code reproduces every number.
Read the full abstract ▾
All authors Kelly L Vomo-Donfack, Adryel Hoszu, Grégory Ginot, Ian Morilla
Cryptography and Security
Statistical Effort Modelling of Game Resource Localisation Attacks
Alessandro Sanna, Waldo Verstraete, Leonardo Regano et al. (+2 more)
Evidence on the effectiveness of Man-At-The-End (MATE) software protections, such as code obfuscation, has mainly come from limited empirical research. Recently, however, an automatable method was proposed to obtain statistical models of the required effort to attack (protected) software. The proposed method was sketched for a number of attack strategies but not instantiated, evaluated, or validated for those that require human interaction with the attacked software. In this paper, we present a full instantiation of the method to obtain statistical effort models for game resource localisation attacks, which represent a major step towards creating game cheats, a
prime example of MATE attacks. We discuss in detail all relevant aspects of our instantiation and the results obtained for two game use cases. Our results confirm the feasibility of the proposed method and its utility for decision support for users of software protection tools. These results open up a new avenue for obtaining models of the impact of software protections on reverse engineering attacks, which will scale much better than empirical research involving human participants.
Read the full abstract ▾
All authors Alessandro Sanna, Waldo Verstraete, Leonardo Regano, Davide Maiorca, Bjorn De Sutter
Cryptography and Security · Cross-listed from math.ST
Cameron Bell, Timothy Johnston, Antoine Luciano et al. (+1 more)
Theoretical and applied research into
privacy encompasses an incredibly broad swathe of differing approaches, emphases and aims. This work introduces a novel quantitative notion of
privacy that is both contextual and specific. Building on and extending ideas from statistical disclosure control and differential
privacy, our aim is to model the implications of a disclosure decision in an
adversarial setting. Our definition relies on concepts inherent to standard
Bayesian decision theory, while departing from them in several important respects. In particular, (i) inference about the data itself becomes meaningful and (ii) the party controlling the release of sensitive information should make disclosure decisions from the prior viewpoint, rather than conditional on the data, which is a feature shared with
Bayesian design. Illuminating toy examples are exploited towards highlighting the specificities of the method.
Read the full abstract ▾
All authors Cameron Bell, Timothy Johnston, Antoine Luciano, Christian P Robert
Cryptography and Security
CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts
Max Landauer, Wolfgang Hotwagner, Thorina Boenke et al. (+2 more)
Log data are essential for intrusion detection and forensic investigations. However, manual log analysis is tedious due to high data volumes, heterogeneous event formats, and unstructured messages. Even though many automated methods for log analysis exist, they usually still rely on domain-specific configurations such as expert-defined detection rules, handcrafted log parsers, or manual feature-engineering. Crucially, the level of automation of conventional methods is limited due to their inability to semantically understand logs and explain their underlying causes. In contrast, Large
Language Models enable domain- and format-agnostic interpretation of system logs and security alerts. Unfortunately, research on this topic remains challenging, because publicly available and labeled data sets covering a broad range of attack techniques are scarce. To address this gap, we introduce the Cyber Attack Manifestation Log Data Set (CAM-LDS), comprising seven attack scenarios that cover 81 distinct techniques across 13 tactics and collected from 18 distinct sources within a fully open-source and reproducible test environment. We extract log events that directly result from attack executions to facilitate analysis of manifestations concerning command observability, event frequencies, performance metrics, and intrusion detection alerts. We further present an illustrative case study utilizing an LLM to process the CAM-LDS. The results indicate that correct attack techniques are predicted perfectly for approximately one third of attack steps and adequately for another third, highlighting the potential of LLM-based log interpretation and utility of our data set.
Read the full abstract ▾
All authors Max Landauer, Wolfgang Hotwagner, Thorina Boenke, Florian Skopik, Markus Wurzenberger
Cryptography and Security
OMNIINTENT: A Trusted Intent-Centric Framework for User-Friendly Web3
Zhuoran Pan, Yue Li, Zhi Guan et al. (+2 more)
The increasingly complex Web3 ecosystem and decentralized finance (DeFi) landscape demand ever higher levels of technical expertise and financial literacy from participants. The Intent-Centric paradigm in DeFi has thus emerged in response, which allows users to focus on their trading intents rather than the underlying execution details. However, existing approaches, including Typed-intent design and LLM-driven solver, trade off expressiveness, trust,
privacy, and composability. We present OMNIINTENT, a
language-runtime co-design that reconciles these requirements. OMNIINTENT introduces ICL, a domain-specific Intent-Centric
Language for precise yet flexible specification of triggers, actions, and runtime constraints; a Trusted Execution Environment (TEE)-based compiler that compiles intents into signed, state-bound transactions inside an enclave; and an execution optimizer that constructs transaction dependency graphs for safe parallel batch submission and a mempool-aware feasibility checker that predicts execution outcomes. Our full-stack prototype processes diverse DeFi scenarios, achieving 89.6% intent coverage, up to 7.3x throughput speedup via parallel execution, and feasibility-prediction accuracy up to 99.2% with low latency.
Read the full abstract ▾
All authors Zhuoran Pan, Yue Li, Zhi Guan, Jianbin Hu, Zhong Chen
Cryptography and Security · Cross-listed from cs.LG
A Multi-Dimensional Quality Scoring Framework for Decentralized LLM Inference with Proof of Quality
Arther Tian, Alex Ding, Frank Chen et al. (+2 more)
Decentralized large
language model (LLM) inference networks can pool heterogeneous compute to scale serving, but they require lightweight and incentive-compatible mechanisms to assess output quality. Prior work introduced cost-aware Proof of Quality (PoQ) and adaptive robust PoQ to allocate rewards under evaluator heterogeneity and
adversarial behavior. In this paper, we focus on the quality signal itself and propose a multi-dimensional quality scoring framework that decomposes output quality into modular dimensions, including model and cost priors, structure quality, semantic quality, query-output
alignment, and agreement/uncertainty. Using logged outputs from QA and summarization tasks, we systematically audit dimension reliability and show that seemingly reasonable dimensions can be task-dependent and even negatively correlated with reference quality without calibration. While the default composite underperforms a strong single semantic evaluator, ablations reveal that removing unreliable dimensions and re-normalizing weights yields a calibrated composite that matches or exceeds the best single- evaluator and consensus baselines. Finally, we integrate the composite score as a drop-in quality signal in PoQ and demonstrate complementary benefits with robust aggregation and adaptive trust weighting under
adversarial evaluator attacks.
Read the full abstract ▾
All authors Arther Tian, Alex Ding, Frank Chen, Simon Wu, Aaron Chan
Cryptography and Security
When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG
Junchen Li, Liang Xu, Qizhi Chen et al. (+6 more)
Retrieval-Augmented Generation (RAG) systems are vulnerable to blocking attacks, in which poisoned documents cause large
language models (LLMs) to refuse benign queries. Existing attacks rely on
adversarial suffixes or explicit instructions, which are increasingly ineffective against modern LLMs, susceptible to
prompt injection filtering, or require feedback from the target system. We observe overlapping risk categories and refusal criteria across safety-aligned LLMs, a phenomenon we term
alignment homogeneity. This shared attack surface makes refusal-inducing context transferable across models. Accordingly, we propose TabooRAG, which optimizes one document per query for
retrieval and refusal induction in a surrogate RAG environment, then transfers it to an unknown target system. Rather than injecting instructions, TabooRAG constructs query-relevant risk context to trigger
alignment-driven refusal. To reduce optimization cost, it reuses validated strategies through a query-aware strategy library. Across nine LLMs and three
datasets, TabooRAG achieves state-of-the-art ASR after filtering, with a 67.3% relative gain over the average per-setting best baseline. Further experiments show that TabooRAG remains effective with diverse surrogate models, against unseen target models, and under stronger RAG pipelines and existing defenses.
Read the full abstract ▾
All authors Junchen Li, Liang Xu, Qizhi Chen, Rongzheng Wang, Chao Qi, Shihao He, Di Liang, Haibo Shi, Shuang Liang
Cryptography and Security · Cross-listed from cs.AI
From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures
Chiara Bonfanti, Davide Colaiacomo, Luca Cagliero et al. (+1 more)
Web security demands rapid response capabilities to evolving cyber threats. Agentic Artificial Intelligence (AI) promises automation, but the need for trustworthy security responses is of the utmost importance. This work investigates the role of semantic relations in extracting information for sensitive operational tasks, such as configuring security controls for mitigating threats. To this end, it proposes to leverage hypernym-hyponym textual relations to extract relevant information from Cyber Threat Intelligence (CTI) reports. By leveraging a neuro-symbolic approach, the multi-
agent system automatically generates CLIPS code for an expert system creating firewall rules to block malicious network traffic. Experimental results show the superior performance of the hypernym-hyponym
retrieval strategy compared to various baselines and the higher effectiveness of the agentic approach in mitigating threats.
Read the full abstract ▾
All authors Chiara Bonfanti, Davide Colaiacomo, Luca Cagliero, Cataldo Basile
Cryptography and Security
Measuring Privacy vs. Fidelity in Synthetic Social Media Datasets
Henry Tari and Adriana Iamnitchi
Synthetic data is increasingly used to support research without exposing sensitive user content. Social media data is one of the types of
datasets that would hugely benefit from representative synthetic equivalents that can be used to bootstrap research and allow reproducibility through data sharing. However, recent studies show that (tabular) synthetic data is not inherently
privacy-preserving. Much less is known, however, about the
privacy risks of synthetically generated unstructured texts. This work evaluates the
privacy of synthetic Instagram posts generated by three state-of-the-art large
language models using two prompting strategies. We propose a methodology that quantifies
privacy by framing re-identification as an authorship attribution attack. A RoBERTa-large classifier trained on real posts achieved 81% accuracy in authorship attribution on real data, but only 16.5–29.7% on synthetic posts, showing reduced, though non-negligible, risk. Fidelity was assessed via text traits, sentiment, topic overlap, and
embedding similarity, confirming the expected trade-off: higher fidelity coincides with greater
privacy leakage. This work provides a framework for evaluating
privacy in synthetic text and demonstrates the
privacy–fidelity tension in social media
datasets.
Read the full abstract ▾
Cryptography and Security
On the Suitability of LLM-Driven Agents for Dark Pattern Audits
Chen Sun, Yash Vekaria and Rishab Nithyanand
As LLM-driven
agents begin to autonomously navigate the web, their ability to interpret and respond to manipulative interface design becomes critical. A fundamental question that emerges is: can such
agents reliably recognize patterns of friction, misdirection, and coercion in interface design (i.e., dark patterns)? We study this question in a setting where the workflows are consequential: website portals associated with the submission of CCPA-related data rights requests. These portals operationalize statutory rights, but they are implemented as interactive interfaces whose design can be structured to facilitate, burden, or subtly discourage the exercise of those rights. We design and deploy an LLM-driven
auditing agent capable of end-to-end traversal of rights-request workflows, structured evidence gathering, and classification of potential dark patterns. Across a set of 456 data broker websites, we evaluate: (1) the ability of the
agent to consistently locate and complete request flows, (2) the reliability and reproducibility of its dark pattern classifications, and (3) the conditions under which it fails or produces poor judgments. Our findings characterize both the feasibility and the limitations of using LLM-driven
agents for scalable dark pattern
auditing.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Structure-Aware Distributed Backdoor Attacks in Federated Learning
Wang Jian, Shen Hong, Ke Wei et al. (+1 more)
While
federated learning protects data
privacy, it also makes the model update process vulnerable to long-term stealthy perturbations. Existing studies on
backdoor attacks in
federated learning mainly focus on trigger design or poisoning strategies, typically assuming that identical perturbations behave similarly across different model architectures. This assumption overlooks the impact of model structure on perturbation effectiveness. From a structure-aware perspective, this paper analyzes the coupling relationship between model architectures and
backdoor perturbations. We introduce two metrics, Structural Responsiveness Score (SRS) and Structural Compatibility Coefficient (SCC), to measure a model's sensitivity to perturbations and its preference for fractal perturbations. Based on these metrics, we develop a structure-aware fractal perturbation injection framework (TFI) to study the role of architectural properties in the
backdoor injection process. Experimental results show that model architecture significantly influences the propagation and aggregation of perturbations. Networks with multi-path feature fusion can amplify and retain fractal perturbations even under low poisoning ratios, while models with low structural compatibility constrain their effectiveness. Further analysis reveals a strong correlation between SCC and attack success rate, suggesting that SCC can predict perturbation survivability. These findings highlight that
backdoor behaviors in
federated learning depend not only on perturbation design or poisoning intensity but also on the interaction between model architecture and aggregation mechanisms, offering new insights for structure-aware defense design.
Read the full abstract ▾
All authors Wang Jian, Shen Hong, Ke Wei, Liu Xue Hua
Cryptography and Security
Zero-Knowledge Proof (ZKP) Authentication for Offline CBDC Payment System Using IoT Devices
Santanu Mondal and T. Chithralekha
Central Bank Digital Currency (CBDCs) are becoming a new digital financial tool aimed at financial inclusion, increased monetary stability, and improved efficiency of payment systems, as they are issued by central banks. One of the most important aspects is that the CBDC must offer secure offline payment methods to users, allowing them to retain cash-like access without violating Anti-Money Laundering and Counter-terrorism Financing (AML/CFT) rules. The offline CBDC ecosystems will provide financial inclusion, empower underserved communities, and ensure equitable access to digital payments, even in connectivity-poor remote locations. With the rapid growth of Internet of Things (IoT) devices in our everyday lives, they are capable of performing secure digital transactions. Integrating offline CBDC payment with IoT devices enables seamless, automated payment without internet connectivity. However, IoT devices face special challenges due to their resource-constrained nature. This makes it difficult to include features such as double-spending prevention,
privacy preservation, low-computation operation, and digital identity management. The work proposes a
privacy-preserving offline CBDC model with integrated secure elements (SEs), zero-knowledge proofs (ZKPs), and intermittent synchronisation to conduct offline payments on IoT hardware. The proposed model is based on recent improvements in offline CBDC prototypes, regulations and cryptographic design choices such as hybrid architecture that involves using combination of online and offline payment in IoT devices using secure hardware with lightweight zero-knowledge proof cryptographic
algorithm.
Read the full abstract ▾
Cryptography and Security
Internet malware propagation: Dynamics and control through SEIRV epidemic model with relapse and intervention
Samiran Ghosh and V Anil Kumar
Malware attacks in today's vast digital ecosystem pose a serious threat. Understanding malware propagation dynamics and designing effective control strategies are therefore essential. In this work, we propose a generic SEIRV model formulated using ordinary differential equations to study malware spread. We establish the positivity and boundedness of the system, derive the malware propagation threshold, and analyze the local and global stability of the malware-free
equilibrium. The separatrix defining epidemic regions in the control space is identified, and the existence of a forward bifurcation is demonstrated. Using normalized forward sensitivity indices, we determine the parameters most influential to the propagation threshold. We further examine the nonlinear dependence of key epidemic characteristics on the transmission rate, including the maximum number of infected, time to peak infection, and total number of infected. We propose a hybrid gradient-based global optimization framework using simulated annealing approach to identify effective and cost-efficient control strategies. Finally, we calibrate the proposed model using infection data from the "Windows Malware
Dataset with PE API Calls" and investigated the effect of intervention onset time on averted cases, revealing an exponential decay relationship between delayed intervention and averted cases.
Read the full abstract ▾
Cryptography and Security
Reckless Designs and Broken Promises: Privacy Implications of Targeted Interactive Advertisements on Social Media Platforms
Julia B. Kieserman, Athanasios Andreou, Laura Edelson et al. (+2 more)
Popular social media platforms TikTok, Facebook and Instagram allow third-parties to run targeted advertising campaigns on sensitive attributes in-platform. These ads are interactive by default, meaning users can comment or “react” (e.g., “like”, “love”) to them. We find that this platform-level design choice creates a
privacy loophole such that advertisers can view the profiles of those who interact with their ads, thus identifying individuals that fulfill certain targeting criteria. This behavior is in contradiction to the promises made by the platforms to hide user data from advertisers. We conclude by suggesting design modifications that could provide users with transparency about the consequences of ad interaction to protect against unintentional disclosure.
Read the full abstract ▾
All authors Julia B. Kieserman, Athanasios Andreou, Laura Edelson, Sandra Siby, Damon McCoy
Cryptography and Security · Cross-listed from cs.CV
Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions
Neha Nagaraja, Lan Zhang, Zhilong Wang et al. (+2 more)
Multimodal Large
Language Models (MLLMs) integrate
vision and text to power applications, but this integration introduces new vulnerabilities. We study Image-based
Prompt Injection (IPI), a black-box attack in which
adversarial instructions are embedded into natural images to override model behavior. Our end-to-end IPI pipeline incorporates
segmentation-based region selection, adaptive font scaling, and background-aware rendering to conceal
prompts from human perception while preserving model interpretability. Using the COCO
dataset and GPT-4-turbo, we evaluate 12
adversarial prompt strategies and multiple
embedding configurations. The results show that IPI can reliably manipulate the output of the model, with the most effective configuration achieving up to 64% attack success under stealth constraints. These findings highlight IPI as a practical threat in black-box settings and underscore the need for defenses against
multimodal prompt injection.
Read the full abstract ▾
All authors Neha Nagaraja, Lan Zhang, Zhilong Wang, Bo Zhang, Pawan Patil
Cryptography and Security
Goal-Driven Risk Assessment for LLM-Powered Systems: A Healthcare Case Study
Neha Nagaraja and Hayretdin Bahsi
While incorporating LLMs into systems offers significant benefits in critical application areas such as healthcare, new security challenges emerge due to the potential cyber kill chain cycles that combine
adversarial model,
prompt injection and conventional cyber attacks. Threat modeling methods enable the system designers to identify potential cyber threats and the relevant mitigations during the early stages of development. Although the cyber security community has extensive experience in applying these methods to software-based systems, the elicited threats are usually abstract and vague, limiting their effectiveness for conducting proper likelihood and impact assessments for risk prioritization, especially in complex systems with novel attacks surfaces, such as those involving LLMs. In this study, we propose a structured, goal driven risk assessment approach that contextualizes the threats with detailed attack vectors, preconditions, and attack paths through the use of attack trees. We demonstrate the proposed approach on a case study with an LLM
agent-based healthcare system. This study harmonizes the state-of-the-art attacks to LLMs with conventional ones and presents possible attack paths applicable to similar systems. By providing a structured risk assessment, this study makes a significant contribution to the literature and advances the secure-by-design practices in LLM-based systems.
Read the full abstract ▾
Cryptography and Security
Scrambler: Mixed Boolean Arithmetic Obfuscation Tool Using E-graph and Equality Expansion
Seoksu Lee, Sangjun An and Eun-Sun Cho
We propose Scrambler, and e-graph-based MBA obfuscation tool using Equality Expansion to efficiently generate complex and diverse expressions with equivalence guaranteed by construction. Experiments show Scrambler improves existing tools in expressiveness and complexity.