Cryptography and Security · Cross-listed from cs.CL
One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety
Samee Arif, Naihao Deng, Zhijing Jin et al. (+1 more)
Large
Language Models (LLMs) are trained to refuse harmful requests, yet they remain vulnerable to jailbreak attacks that exploit weaknesses in conversational safety mechanisms. We introduce Incremental Completion Decomposition ICD, a trajectory-based jailbreak strategy that elicits a sequence of single-word continuations related to a malicious request before eliciting the full response. In addition, we propose ICD variants that use model-generated or attacker-injected intermediate continuations, as well as final-response prefilling. We evaluate these variants across a broad set of open-weight model families, demonstrating superior Attack Success Rate (ASR) on AdvBench, JailbreakBench, and StrongREJECT compared to existing methods. In addition, we provide a theoretical account of why ICD is effective and present mechanistic evidence that successful attack trajectories suppress refusal-related representations and shift activations away from safety-aligned states.
Read the full abstract ▾
All authors Samee Arif, Naihao Deng, Zhijing Jin, Rada Mihalcea
Cryptography and Security · Cross-listed from cs.LO
Type-Checked Compliance: Deterministic Guardrails for Agentic Financial Systems Using Lean 4 Theorem Proving
Devakh Rashie and Veda Rashi
The rapid
evolution of autonomous, agentic artificial intelligence within financial services has introduced an existential architectural crisis: large
language models (LLMs) are probabilistic, non-deterministic systems operating in domains that demand absolute, mathematically verifiable compliance guarantees. Existing guardrail solutions – including NVIDIA NeMo Guardrails and Guardrails AI – rely on probabilistic classifiers and syntactic validators that are fundamentally inadequate for enforcing complex multi-variable regulatory constraints mandated by the SEC, FINRA, and OCC. This paper presents the Lean-
Agent Protocol, a formal-verification-based AI guardrail platform that leverages the Aristotle neural-symbolic model developed by Harmonic AI to auto-formalize institutional policies into Lean 4 code. Every proposed agentic action is treated as a mathematical
conjecture: execution is permitted if and only if the Lean 4 kernel proves that the action satisfies pre-compiled regulatory axioms. This architecture provides cryptographic-level compliance certainty at microsecond latency, directly satisfying SEC Rule 15c3-5, OCC Bulletin 2011-12, FINRA Rule 3110, and CFPB explainability mandates. A three-phase implementation roadmap from shadow verification through enterprise-scale deployment is provided.
Read the full abstract ▾
Cryptography and Security
SelfGrader: LLM Jailbreak Detection via Anchored Token-Level Logits
Zikai Zhang, Rui Hu, Olivera Kotevska et al. (+1 more)
Large
Language Models (LLMs) are powerful tools for answering user queries, yet they remain highly vulnerable to jailbreak attacks. Existing guardrail methods typically rely on internal features or textual responses to detect malicious queries, which either introduce substantial latency or suffer from randomness in text generation. To overcome these limitations, we propose SelfGrader, a lightweight guardrail method that formulates jailbreak detection as a numerical grading problem using anchored
token-level logits. Specifically, SelfGrader evaluates the safety of a user query within a compact set of numerical
tokens (NTs) (e.g., 0-9) and interprets their logit distribution as an internal safety signal. To align these signals with the target safety rubric, SelfGrader constructs Probably Approximately Correct-guided ICL anchor examples and introduces a dual-perspective scoring rule that considers both the maliciousness and benignness of the query, yielding a stable and interpretable score that reflects harmfulness and reduces the false positive rate simultaneously. Extensive experiments across diverse jailbreak
benchmarks, adaptive attacks, benign
prompt benchmarks, multiple LLMs, and state-of-the-art guardrail baselines demonstrate that SelfGrader achieves strong robustness with low false positive rates,
memory overhead, and latency.
Read the full abstract ▾
All authors Zikai Zhang, Rui Hu, Olivera Kotevska, Jiahao Xu
Cryptography and Security
Preserving Target Distributions With Differentially Private Count Mechanisms
Nitin Kohli and Paul Laskowski
Differentially private mechanisms are increasingly used to publish tables of counts, where each entry represents the number of individuals belonging to a particular category. A distribution of counts summarizes the information in the count column, unlinking counts from categories. This object is useful for answering a class of research questions, but it is subject to statistical biases when counts are privatized with standard mechanisms. This motivates a novel design criterion we term accuracy of distribution. This study formalizes a two-stage framework for privatizing tables of counts that balances accuracy of distribution with two standard criteria of accuracy of counts and runtime. In the first stage, a distribution privatizer generates an estimate for the true distribution of counts. We introduce a new mechanism, called the cyclic Laplace, specifically tailored to distributions of counts, that outperforms existing general-purpose differentially private histogram mechanisms. In the second stage, a constructor
algorithm generates a count mechanism, represented as a transition
matrix, whose fixed-point is the privatized distribution of counts. We develop a mathematical theory that describes such transition
matrices in terms of simple building blocks we call epsilon-scales. This theory informs the design of a new constructor
algorithm that generates transition
matrices with favorable properties more efficiently than standard optimization
algorithms. We explore the practicality of our framework with a set of experiments, highlighting situations in which a fixed-point method provides a favorable tradeoff among performance criteria.
Read the full abstract ▾
Cryptography and Security
Cooking Up Risks: Benchmarking and Reducing Food Safety Risks in Large Language Models
Weidi Luo, Xiaofei Wen, Tenghao Huang et al. (+6 more)
Food safety directly affects human health in daily life, as unsafe preparation or storage can lead to contamination and foodborne illness. PwC's 2025 consumer survey reports that 47% of respondents are comfortable using generative AI for meal planning, highlighting the need for safe food-related assistance. Yet the safety of large
language models (LLMs) against malicious food-related requests remains underexplored. We introduce FoodGuardBench, an FDA-grounded
benchmark with 2,124 seed malicious questions, 16,992 variants from eight jailbreak strategies, and 1,000 benign questions across five food-safety risk categories. Across twelve LLMs, the mean overall ASR is 25.51%, whereas the average per-model maximum across eight attacks is 60.59%, revealing that testing only one attack can substantially underestimate the full extent of food safety risk. For several models, nearly half or more of unsafe answers are rated as ready-to-use guides for harmful actions. Existing general-purpose guardrails average 96.25% benign utility but only 55.80% detection accuracy against these eight jailbreak attacks. Using FoodGuardBench, we fine-tune FoodGuard-4B, a food-safety-specific guardrail that achieves 97.64% out-of-distribution (OOD) accuracy while maintaining high benign utility. This demonstrates the value of FoodGuardBench for identifying and mitigating food safety risks.
Read the full abstract ▾
All authors Weidi Luo, Xiaofei Wen, Tenghao Huang, Hao Li, Hongyi Wang, Zhen Xiang, Chaowei Xiao, Kristina Gligorić, Muhao Chen
Cryptography and Security
"The System Will Choose Security Over Humanity Every Time": Understanding Security and Privacy for U.S. Incarcerated Users
Yael Eiger, Nino Migineishvili, Emi Yoshikawa et al. (+3 more)
Digital devices like tablets, media players, and kiosks are increasingly deployed in U.S. prisons. These technologies can enable incarcerated people to access education, communicate with loved ones, and develop vital reentry skills. However, they can also introduce new
privacy and security risks for incarcerated people who have little agency over their usage and contracts, and are currently carved out of many consumer protection safeguards. To investigate these issues, we conducted focus groups and interviews with system-impacted people (n=17), i.e., those formerly incarcerated, and their relatives, to investigate experiences with device-related security and
privacy vulnerabilities and the power dynamics that affect their use. In our findings, participants describe pervasive surveillance, censorship, and usability problems with the technology available to them, including shifting and seemingly arbitrary usage policies. These policies strain relationships both inside and outside prisons and contribute to negative downstream effects for incarcerated users. We recommend ways to better balance prison security concerns with
privacy-related needs of system-impacted individuals by promoting accountability for technology-related decisions, providing public oversight of digital purchasing and use policies, and designing digital tools with them – the actual end-users – in mind.
Read the full abstract ▾
All authors Yael Eiger, Nino Migineishvili, Emi Yoshikawa, Liza Nadtochiy, Kentrell Owens, Franziska Roesner
Cryptography and Security · Cross-listed from cs.CL
No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
Tiankai Yang, Jiate Li, Yi Nian et al. (+5 more)
LLM-based
agents increasingly operate across repeated sessions, maintaining task states to ensure continuity. In many deployments, a single
agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities. This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the
agent reapplies it without regard for scope. We refer to this failure mode as unintentional cross-user contamination (UCC). Unlike
adversarial memory poisoning, UCC requires no attacker; it arises from benign interactions whose scope-bound artifacts persist and are later misapplied. We formalize UCC through a controlled evaluation protocol, introduce a taxonomy of three contamination types, and evaluate the problem in two shared-state mechanisms. Under raw shared state, benign interactions alone produce contamination rates of 57–71%. A write-time sanitization is effective when shared state is conversational, but leaves substantial residual risk when shared state includes executable artifacts, with contamination often manifesting as silent wrong answers. These results indicate that shared-state
agents need artifact-level defenses beyond text-level sanitization to prevent silent cross-user failures.
Read the full abstract ▾
All authors Tiankai Yang, Jiate Li, Yi Nian, Shen Dong, Ruiyao Xu, Ryan Rossi, Kaize Ding, Yue Zhao
Cryptography and Security
Safety, Security, and Cognitive Risks in World Models
Manoj Parmar
World models - learned internal simulators of environment dynamics - are rapidly becoming foundational to autonomous decision-making in robotics, autonomous vehicles, and agentic AI. By predicting future states in compressed latent spaces, they enable sample-efficient planning and long-horizon imagination without direct environment interaction. Yet this predictive power introduces a distinctive set of safety, security, and cognitive risks. Adversaries can corrupt training data, poison latent representations, and exploit compounding rollout errors to cause significant degradation in safety-critical deployments. At the
alignment layer, world model-equipped
agents are more capable of goal misgeneralisation, deceptive
alignment, and reward hacking. At the human layer, authoritative world model predictions foster automation bias, miscalibrated trust, and planning
hallucination. This paper surveys the world model landscape; introduces formal definitions of trajectory persistence and representational risk; presents a five-profile attacker taxonomy; and develops a unified threat model drawing on MITRE ATLAS and the OWASP LLM Top 10. We provide an empirical proof-of-concept demonstrating trajectory-persistent
adversarial attacks on a GRU-based RSSM ($\mathcal{A}_1 = 2.26\times$ amplification, $-59.5\%$ reward reduction under
adversarial fine-tuning), validate architecture-dependence via a
stochastic RSSM proxy ($\mathcal{A}_1 = 0.65\times$), and probe a real DreamerV3 checkpoint (non-zero action drift confirmed). We propose interdisciplinary mitigations spanning
adversarial hardening,
alignment engineering, NIST AI RMF and EU AI Act governance, and human-factors design, arguing that world models require the same rigour as flight-control software or medical devices.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.SD
Evolutionary Multi-Objective Fusion of Deepfake Speech Detectors
Vojtěch Staněk, Martin Perešíni, Lukáš Sekanina et al. (+2 more)
While deepfake
speech detectors built on large self-supervised learning (SSL) models achieve high accuracy, employing standard ensemble fusion to further enhance robustness often results in oversized systems with diminishing returns. To address this, we propose an evolutionary multi-objective score fusion framework that jointly minimizes detection error and system complexity. We explore two encodings optimized by NSGA-II: binary-coded detector selection for score averaging and a real-valued scheme that optimizes detector weights for a weighted sum. Experiments on the ASVspoof 5
dataset with 36 SSL-based detectors show that the obtained Pareto fronts outperform simple averaging and logistic regression baselines. The real-valued variant achieves 2.37% EER (0.0684 minDCF) and identifies configurations that match state-of-the-art performance while significantly reducing system complexity, requiring only half the parameters. Our method also provides a diverse set of trade-off solutions, enabling deployment choices that balance accuracy and computational cost.
Read the full abstract ▾
All authors Vojtěch Staněk, Martin Perešíni, Lukáš Sekanina, Anton Firc, Kamil Malinka
Cryptography and Security
AgentWatcher: A Rule-based Prompt Injection Monitor
Yanting Wang, Wei Zou, Runpeng Geng et al. (+1 more)
Large
language models (LLMs) and their applications, such as
agents, are highly vulnerable to
prompt injection attacks. State-of-the-art
prompt injection detection methods have the following limitations: (1) their effectiveness degrades significantly as context length increases, and (2) they lack explicit rules that define what constitutes
prompt injection, causing detection decisions to be implicit, opaque, and difficult to reason about. In this work, we propose AgentWatcher to address the above two limitations. To address the first limitation, AgentWatcher attributes the LLM's output (e.g., the action of an
agent) to a small set of causally influential context segments. By focusing detection on a relatively short text, AgentWatcher can be scalable to long contexts. To address the second limitation, we define a set of rules specifying what does and does not constitute a
prompt injection, and use a monitor LLM to reason over these rules based on the attributed text, making the detection decisions more explainable. We conduct a comprehensive evaluation on tool-use
agent benchmarks and long-context understanding
datasets. The experimental results demonstrate that AgentWatcher can effectively detect
prompt injection and maintain utility without attacks. The code is available at https://github.com/wang-yanting/AgentWatcher.
Read the full abstract ▾
All authors Yanting Wang, Wei Zou, Runpeng Geng, Jinyuan Jia
Cryptography and Security · Cross-listed from cs.SE
SERSEM: Selective Entropy-Weighted Scoring for Membership Inference in Code Language Models
K{\i}vanç Kuzey Dikici, Serdar Kara, Semih Çağlar et al. (+2 more)
As Large
Language Models (LLMs) for code increasingly utilize massive, often non-permissively licensed
datasets, evaluating data contamination through Membership Inference Attacks (MIAs) has become critical. We propose SERSEM (Selective
Entropy-Weighted Scoring for Membership Inference), a novel white-box attack framework that suppresses uninformative syntactical boilerplate to amplify specific memorization signals. SERSEM utilizes a dual-signal methodology: first, a continuous character-level weight mask is derived through static Abstract Syntax Tree (AST) analysis, spellchecking-based
multilingual logic detection, and offline linting. Second, these heuristic weights are used to pool internal
transformer activations and calibrate
token-level Z-scores from the output logits. Evaluated on a 25,000-sample balanced
dataset, SERSEM achieves a global AUC-ROC of 0.7913 on the StarCoder2-3B model and 0.7867 on the StarCoder2-7B model, consistently outperforming the implemented probability-based baselines Loss, Min-K% Prob, and PAC. Our findings demonstrate that focusing on human-centric coding anomalies provides a significantly more robust indicator of verbatim memorization than sequence-level probability averages.
Read the full abstract ▾
All authors K{\i}vanç Kuzey Dikici, Serdar Kara, Semih Çağlar, Eray Tüzün, Sinem Sav
Cryptography and Security
Obfuscating Code Vulnerabilities against Static Analysis in JavaScript Code
Francesco Pagano, Lorenzo Pisu, Leonardo Regano et al. (+3 more)
Code obfuscation is widely adopted in modern software development to protect intellectual property and hinder reverse engineering, but it also provides attackers with a powerful means to conceal malicious logic inside otherwise legitimate JavaScript code. In a software supply chain where a single compromised package can affect thousands of applications, this raises a critical question: how robust are the Static Application Security Testing (SAST) tools that CI/CD pipelines rely on as automated security gatekeepers? This paper answers that question by empirically quantifying the impact of JavaScript obfuscation on state-of-practice SAST. We define a realistic supply-chain threat model in which an adversary injects vulnerable code and iteratively obfuscates it until the pipeline reports a clean scan. To measure the resulting degradation, we introduce the Vulnerability Detection Loss (VDL) metric and conduct a two-phase study. First, we analyze 16 vulnerable-by-design Node.js web applications from the OWASP directory; second, we extend the analysis to 260 in-the-wild JavaScript/Node.js projects from GitHub. Across both
datasets, we apply eight semantics-preserving obfuscation techniques and their combinations and evaluate two representative SAST tools, Njsscan and Bearer. Even a single obfuscation technique typically suppresses most baseline findings, including high-severity issues, while stacking techniques yield near-total evasion, with VDL often approaching 100%. Our results show that current JavaScript SAST is fundamentally not robust against commonplace obfuscations and that "clean" reports on obfuscated code may offer only a false sense of security. Finally, we discuss practical mitigation guidelines and directions for obfuscation-aware analysis.
Read the full abstract ▾
All authors Francesco Pagano, Lorenzo Pisu, Leonardo Regano, Davide Maiorca, Alessio Merlo, Giorgio Giacinto
Cryptography and Security
Multi-Agent LLM Governance for Safe Two-Timescale Reinforcement Learning in SDN-IoT Defense
Saeid Jamshidi, Negar Shahabi, Foutse Khomh et al. (+2 more)
Software-Defined Networking (SDN) is increasingly adopted to secure Internet-of-Things (IoT) networks due to its centralized control and programmable forwarding. However, SDN-IoT defense is inherently a closed-loop control problem in which mitigation actions impact controller workload, queue dynamics, rule-installation delay, and future traffic observations. Aggressive mitigation may destabilize the control plane, degrade Quality of Service (QoS), and amplify systemic risk. Existing learning-based approaches prioritize detection accuracy while neglecting controller coupling and short-horizon Reinforcement Learning (RL) optimization without structured, auditable policy
evolution. This paper introduces a self-reflective two-timescale SDN-IoT defense solution separating fast mitigation from slow policy governance. At the fast timescale, per-switch Proximal Policy Optimization (PPO)
agents perform controller-aware mitigation under safety constraints and action masking. At the slow timescale, a multi-
agent Large
Language Model (LLM) governance engine generates machine-parsable updates to the global policy constitution Pi, which encodes admissible actions, safety thresholds, and reward priorities. Updates (Delta Pi) are validated through stress testing and deployed only with non-regression and safety guarantees, ensuring an auditable
evolution without retraining RL
agents. Evaluation under heterogeneous IoT traffic and
adversarial stress shows improvements of 9.1% Macro-F1 over PPO and 15.4% over static baselines. Worst-case degradation drops by 36.8%, controller backlog peaks by 42.7%, and RTT p95 inflation remains below 5.8% under high-intensity attacks. Policy
evolution converges within five cycles, reducing catastrophic overload from 11.6% to 2.3%.
Read the full abstract ▾
All authors Saeid Jamshidi, Negar Shahabi, Foutse Khomh, Carol Fung, Mohammad Hamdaqa
Cryptography and Security
LightGuard: Transparent WiFi Security via Physical-Layer LiFi Key Bootstrapping
Shiqi Xu, Yuyang Du, Mingyue Zhang et al. (+2 more)
WiFi is inherently vulnerable to eavesdropping because RF signals may penetrate many physical boundaries, such as walls and floors. LiFi, by contrast, is an optical method confined to line-of-sight and blocked by opaque surfaces. We present LightGuard, a dual-link architecture built on this insight: cryptographic key establishment can be offloaded from WiFi to a physically confined LiFi channel to mitigate the risk of key exposure over RF. LightGuard derives session keys over a LiFi link and installs them on the WiFi interface, ensuring cryptographic material never traverses the open RF medium. A prototype with off-the-shelf WiFi NICs and our LiFi transceiver frontend validates the design.
Read the full abstract ▾
All authors Shiqi Xu, Yuyang Du, Mingyue Zhang, Hongwei Cui, Soung Chang Liew
Cryptography and Security
Automated Generation of Cybersecurity Exercise Scenarios
Charilaos Skandylas and Mikael Asplund
There is a growing need for cybersecurity professionals with practical knowledge and experience to meet societal needs and comply with new standards and regulations. At the same time, the advances in software technology and artificial intelligence point towards a future where software
agents will play an important role in protecting the computer systems that are critical for society to function. The training and development of both humans and software
agents requires the design and execution of cybersecurity exercises that differ in properties such as size, scope, objectives, difficultly, etc. Cybersecurity scenarios are critical for the operation of cybersecurity exercises as they describe the scope, context, operational environment and storyline of each exercise. In this work, we present an approach to automatically generate cybersecurity scenarios that model enterprise IT systems. Our approach is able to generate a large number of scenarios that differ in multiple criteria including size, scope, difficulty, complexity and diversity. We further release as open source: a simulation and a virtualization environment that can run cybersecurity exercises based on the generated scenarios and a
dataset containing 100000 sample scenarios.
Read the full abstract ▾
Cryptography and Security
VibeGuard: A Security Gate Framework for AI-Generated Code
Ying Xie
"Vibe coding," in which developers delegate code generation to AI assistants and accept the output with little manual review, has gained rapid adoption in production settings. On March 31, 2026, Anthropic's Claude Code CLI shipped a 59.8 MB source map file in its npm package, exposing roughly 512,000 lines of proprietary TypeScript. The tool had itself been largely vibe-coded, and the leak traced to a misconfigured packaging rule rather than a logic bug. Existing static-analysis and secret-scanning tools did not cover this failure mode, pointing to a gap between the vulnerabilities AI tends to introduce and the vulnerabilities current tooling is built to find. We present VibeGuard, a pre-publish security gate that targets five such blind spots: artifact hygiene, packaging-configuration drift, source-map exposure, hardcoded secrets, and supply-chain risk. In controlled experiments on eight synthetic projects (seven vulnerable, one clean control), VibeGuard achieved 100% recall, 89.47% precision (F1 = 94.44%), and correct pass/fail gate decisions on all eight projects across three policy levels. We discuss how these results inform a defense-in-depth workflow for teams that rely on AI code generation.
Read the full abstract ▾
Cryptography and Security
Evaluation and Hardening of LLM System Instructions Against Extraction via Encoding Attacks
Anubhab Sahu, Diptisha Samanta and Reza Soosahabi
System Instructions in Large
Language Models (LLMs) are commonly used to enforce safety policies, define
agent behavior, and protect sensitive operational context in agentic AI applications. These instructions may contain sensitive information such as API credentials, internal policies, and privileged workflow definitions, making system instruction leakage a critical security risk highlighted in the OWASP Top 10 for LLM Applications. Without incurring the overhead costs of
reasoning models, many LLM applications rely on refusal-based instructions that block direct requests for system instructions, implicitly assuming that prohibited information can only be extracted through explicit queries. We introduce an automated evaluation framework that tests whether system instructions remain confidential when extraction requests are re-framed as encoding or structured output tasks. Across seven common models and 46 verified system instructions, we observe high attack success rates (>0.7) for structured serialization where models refuse direct extraction requests but disclose protected content in the requested serialization formats. We further demonstrate a mitigation strategy based on one-shot instruction reshaping using a Chain-of-Thought
reasoning model, indicating that even subtle changes in wording and structure of system instructions can significantly reduce attack success rate without requiring model retraining.
Read the full abstract ▾