Cryptography and Security
Evaluating Lightweight Block Cipher Payload Encryption for Real-Time CAN Traffic
Kevin Setterstrom and Jeremy Straub
This study evaluates the feasibility of integrating lightweight block cipher payload encryption into a real-time embedded controller area network (CAN) node using a QT PY ESP32-S2 microcontroller. This work seeks to determine whether the use of a block cipher can prevent semantic taxonomy-based reverse engineering, which infers signal meaning from unencrypted CAN traffic using observation and statistical analysis. CAN payloads are encrypted using a lightweight block cipher and evaluated through experiments that measure timing impact, payload pattern observability, and correlation-based inference. Results indicate that encryption masks constant values and predictable signal patterns while preserving a 100 Hz transmission schedule. These findings suggest that lightweight payload encryption can reduce passive, observation based inference of CAN signal semantics on resource-constrained hardware with limited timing overhead impact.
Read the full abstract ▾
Cryptography and Security
ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
Wei Zhao, Zhe Li, Peixin Zhang et al. (+1 more)
Tool-augmented Large
Language Model (LLM)
agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect
prompt injection. Adversaries exploit this weakness by
embedding malicious instructions within tool-returned content, which
agents directly incorporate into their conversation history as trusted observations. To address these vulnerabilities, we introduce ClawGuard, a novel runtime security framework that enforces a user-confirmed rule set at every tool-call boundary, transforming unreliable
alignment-dependent defense into a deterministic, auditable mechanism that intercepts
adversarial tool calls before any real-world effect is produced. By automatically deriving task-specific access constraints from the user's stated objective prior to any external tool invocation, ClawGuard blocks all three injection pathways without model modification or infrastructure change. Experiments across five state-of-the-art
language models on six injection
benchmarks covering web, local, MCP, and skill channels, as well as three utility
benchmarks covering OS, web, and code tasks, demonstrate that ClawGuard achieves robust protection against indirect
prompt injection without compromising
agent utility or introducing significant
token overhead. This work establishes deterministic tool-call boundary enforcement as an effective defense mechanism for secure agentic AI systems. Code is publicly available at github.com/Claw-Guard/ClawGuard/.
Read the full abstract ▾
All authors Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun
Cryptography and Security
Towards Automated Pentesting with Large Language Models
Ricardo Bessa, Rui Claro, João Trindade et al. (+1 more)
Large
Language Models (LLMs) are redefining offensive cybersecurity by allowing the generation of harmful machine code with minimal human intervention. While attackers take advantage of dark LLMs such as XXXGPT and WolfGPT to produce malicious code, ethical hackers can follow similar approaches to automate traditional pentesting workflows. In this work, we present RedShell, a
privacy-preserving, hardware-efficient framework that leverages fine-tuned LLMs to assist pentesters in generating offensive PowerShell code targeting Microsoft Windows vulnerabilities. RedShell was trained on a malicious PowerShell
dataset from the literature, which we further enhanced with manually curated code samples. Experiments show that our framework achieves over 90% syntactic validity in generated samples and strong semantic
alignment with reference pentesting snippets, outperforming state-of-the-art counterparts in distance metrics such as edit distance (above 50% average code similarity). Additionally, functional experiments emphasize the execution reliability of the snippets produced by RedShell in a testing scenario that mirrors real-world settings. This work sheds light on the state-of-the-art research in the field of Generative AI applied to malicious code generation and automated testing, acknowledging the potential benefits that LLMs hold within controlled environments such as pentesting.
Read the full abstract ▾
All authors Ricardo Bessa, Rui Claro, João Trindade, João Lourenço
Cryptography and Security
A Synthetic Conversational Smishing Dataset for Social Engineering Detection
Carl Lochstampfor and Ayan Roy
Smishing (SMS phishing) has become a serious cybersecurity threat, especially for elderly and cyber-unaware individuals, causing financial loss and undermining user trust. Although prior work has focused on detecting smishing at the level of individual messages, real-world attackers often rely on multi-stage social engineering, gradually manipulating victims through extended conversations before attempting to steal sensitive information. Despite the existence of several
datasets for single-message smishing detection,
datasets capturing conversational smishing remain largely unavailable, limiting research on multi-turn attack detection. To address this gap, this paper presents a synthetically generated
dataset of 3,201 labeled multi-round conversations designed to emulate realistic conversational smishing attacks. The
dataset reflects diverse attacker strategies and victim responses across multiple stages of interaction. Using this
dataset, we establish baseline performance by evaluating eight models, including traditional machine learning approaches (Logistic Regression, Random Forest, Linear SVM, and XGBoost) and
transformer-based architectures (DistilBERT and Longformer), with both engineered conversational features and TF-IDF text representations. Experimental results show that TF-IDF-based models consistently outperform those using engineered features alone. The best-performing model, XGBoost with TF-IDF features, achieves 72.5% accuracy and a macro F1 score of 0.691, surpassing both
transformer models. Our analysis suggests that
transformer performance is limited primarily by input-length constraints and the relatively small size of the training data. Overall, the results highlight the value of lexical signals in conversational smishing detection and demonstrate the usefulness of the proposed
dataset for advancing research on defenses against multi-turn social engineering attacks.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.CV
On the Robustness of Watermarking for Autoregressive Image Generation
Andreas Müller, Denis Lukovnikov, Shingo Kodama et al. (+5 more)
The proliferation of autoregressive (AR) image generators demands reliable detection and attribution of their outputs to mitigate misinformation, and to filter synthetic images from training data to prevent model collapse. To address this need, watermarking techniques, specifically designed for AR models, embed a subtle signal at generation time, enabling downstream verification through a corresponding watermark detector. In this work, we study these schemes and demonstrate their vulnerability to both watermark removal and forgery attacks. We assess existing attacks and further introduce three new attacks: (i) a vector-quantized regeneration removal attack, (ii)
adversarial optimization-based attack, and (iii) a frequency injection attack. Our evaluation reveals that removal and forgery attacks can be effective with access to a single watermarked reference image and without access to original model parameters or watermarking secrets. Our findings indicate that existing watermarking schemes for AR image generation do not reliably support synthetic content detection for
dataset filtering. Moreover, they enable Watermark Mimicry, whereby authentic images can be manipulated to imitate a generator's watermark and trigger false detection to prevent their inclusion in future model training.
Read the full abstract ▾
All authors Andreas Müller, Denis Lukovnikov, Shingo Kodama, Minh Pham, Anubhav Jain, Jonathan Petit, Niv Cohen, Asja Fischer
Cryptography and Security
AmBox: Device-to-Blockchain Ambient Sensing for Food Traceability
João Miguel Guerreiro Fernandes, Samih Eisa and Miguel L. Pardal
From production to consumption, ensuring food quality and traceability depends on reliable monitoring of environmental conditions across the supply chain. Ambient sensing devices can collect relevant data such as temperature and humidity, but ensuring its integrity among stakeholders remains a challenge. This work presents AmBox, a system that enables device-to-blockchain ambient sensing for food traceability. AmBox connects sensors to a blockchain, ensuring secure, verifiable, and tamper-resistant data collection with minimal intermediaries. It manages sensor commissioning and operation with the adequate business context. AmBox can operate with standalone nodes or within a distributed node-mote architecture, allowing flexible deployment at different points along the supply chain. A prototype using Raspberry Pi and ESP32 hardware can record sensor data directly on Hyperledger Fabric. Experimental results show that AmBox provides timely and reliable data that can increase transparency and trust between the supply chain stakeholders.
Read the full abstract ▾
Cryptography and Security
GPU Acceleration of Sparse Fully Homomorphic Encrypted DNNs
Lara D'Agata, Carlos Agulló-Domingo, Óscar Vera-López et al. (+7 more)
Fully homomorphic encryption (FHE) has recently attracted significant
attention as both a cryptographic primitive and a systems challenge. Given the latest advances in accelerated computing, FHE presents a promising opportunity for progress, with applications ranging from machine learning to information security. We target the most computationally intensive operation in deep neural networks from a hardware perspective,
matrix multiplication (matmul), and adapt it for execution on AMD GPUs. We propose a new optimized method that improves the runtime and complexity of ciphertext matmul by using FIDESlib, a recent open-source FHE library designed specifically for GPUs. By exploiting sparsity in both operands, our sparse matmul implementation outperforms its CPU counterpart by up to $3.0\times$ and reduces the time complexity from cubic to semi-linear, demonstrating an improvement over existing FHE matmul implementations.
Read the full abstract ▾
All authors Lara D'Agata, Carlos Agulló-Domingo, Óscar Vera-López, Kaustubh Shivdikar, Ardhi W. B. Yudha, Ferhat Yaman, David Kaeli, José L. Abellán, Ian Colbert, José Cano
Cryptography and Security
RLSpoofer: A Lightweight Evaluator for LLM Watermark Spoofing Resilience
Hanbo Huang, Xuan Gong, Yiran Zhang et al. (+2 more)
Large
language model (LLM) watermarking has emerged as a promising approach for detecting and attributing AI-generated text, yet its robustness to black-box spoofing remains insufficiently evaluated. Existing evaluation methods often demand extensive
datasets and white-box access to algorithmic internals, limiting their practical applicability. In this paper, we study watermark resilience against spoofing fundamentally from a distributional perspective. We first establish a local capacity bottleneck, which theoretically characterizes the probability mass that can be reallocated under KL-bounded local updates while preserving semantic fidelity. Building on this, we propose RLSpoofer, a reinforcement learning-based black-box spoofing attack that requires only 100 human-watermarked paraphrase training pairs and zero access to the watermarking internals or detectors. Despite weak supervision, it empowers a 4B model to achieve a 62.0% spoof success rate with minimal semantic shift on PF-marked texts, dwarfing the 6% of baseline models trained on up to 10,000 samples. Our findings expose the fragile spoofing resistance of current LLM watermarking paradigms, providing a lightweight evaluation framework and stressing the urgent need for more robust schemes.
Read the full abstract ▾
All authors Hanbo Huang, Xuan Gong, Yiran Zhang, Hao Zheng, Shiyu Liang
Cryptography and Security
Security Implications of 5G Communication in Industrial Systems
Stefan Lenz, Sotiris Michaelides, Moritz Rickert et al. (+2 more)
Traditionally, industrial control systems (ICS) were designed without security in mind, prioritizing availability and real-time communication. As these systems increasingly become targets of powerful adversaries, security can no longer be neglected. Driven by flexibility and automation needs, ICS are transitioning from wired to 5G communication, introducing new attack surfaces and a less reliable communication medium, thereby exacerbating existing security challenges. Given their critical role in society, a comprehensive evaluation of their security is imperative. To this end, we introduce SWICS, a fully virtual testbed simulating an ICS in a realistic 5G environment, and study how this transition affects security under varying channel conditions. Our results show three key findings: under optimal channel conditions, industrial 5G networks can achieve resilience comparable to wired systems, while degraded channel conditions can amplify traditional attacks, threaten system stability, and undermine detection mechanisms based on predictable traffic patterns. We further demonstrate the inherent limits of securing 5G channels for ICS through eavesdropping and jamming on the open-air interface. Our work highlights the interplay between security and 5G channel conditions, showing that traditional security controls may no longer be sufficient and motivating further research.
Read the full abstract ▾
All authors Stefan Lenz, Sotiris Michaelides, Moritz Rickert, Jonas Holtwick, Martin Henze
Cryptography and Security
RedShell: A Generative AI-Based Approach to Ethical Hacking
Ricardo Bessa, Rui Claro, João Trindade et al. (+1 more)
The application of Machine Learning techniques in code generation is now a common practice for most developers. Tools such as ChatGPT from OpenAI leverage the natural
language processing capabilities of Large
Language Models to generate machine code from natural
language descriptions. In the cybersecurity field, red teams can also take advantage of generative models to build malicious code generators, providing more automation to Pentest audits. However, the application of Large
Language Models in malicious code generation remains challenging due to the lack of data to train and evaluate offensive code generators. In this work, we propose RedShell, a tool that allows ethical hackers to generate malicious PowerShell code. We also introduce a ground truth
dataset, combining publicly available code samples to fine-tune models in malicious PowerShell generation. Our experiments demonstrate the strong capabilities of RedShell in generating syntactically valid PowerShell, with fewer than 10% of the generated samples resulting in parse errors. Furthermore, our specialized model was able to produce samples that were semantically consistent with reference snippets, achieving a competitive performance on standard output similarity metrics such as Edit Distance and METEOR, with their mean similarity scores exceeding 50% and 40%, respectively. This work sheds light on the state-of-the-art research in the field of Generative AI applied to Pentesting, and also serves as a steppingstone for future advancements, highlighting the potential benefits these models hold within such controlled environments.
Read the full abstract ▾
All authors Ricardo Bessa, Rui Claro, João Trindade, João Lourenço
Cryptography and Security
Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering
Vladimir Stantchev
AI
agents that pay for resources via the x402 protocol embed payment metadata - resource URLs, descriptions, and reason strings - in every HTTP payment request. This metadata is transmitted to the payment server and to the centralised facilitator API before any on-chain settlement occurs; neither party is typically bound by a data processing agreement. We present presidio-hardened-x402, the first open-source middleware that intercepts x402 payment requests before transmission to detect and redact personally identifiable information (PII), enforce declarative spending policies, and block duplicate replay attempts. To evaluate the PII filter, we construct a labeled synthetic corpus of 2,000 x402 metadata triples spanning seven use-case categories, and run a 42-configuration precision/recall sweep across two detection modes (regex, NLP) and five confidence thresholds. The recommended configuration (mode=nlp, min_score=0.4, all entity types) achieves micro-F1 = 0.894 with precision 0.972, at a p99 latency of 5.73ms - well within the 50ms overhead budget. The middleware, corpus, and all experiment code are publicly available at https://github.com/presidio-v/presidio-hardened-x402.
Read the full abstract ▾
Cryptography and Security
Short Message Service (SMS) Phishing Attacks and Defenses: A Systematic Review
Mir Mehedi A. Pritom, Seyed Mohammad Sanjari, Maraz Mia et al. (+4 more)
SMS Phishing (also known as 'smishing') is a growing deceptive social engineering (SE) attack that leverages mobile SMS to conduct cybercrimes such as stealing sensitive information or spreading malware by tricking users into interacting with attackers' messages (e.g., responding to or clicking URLs). This threat has increased rapidly in recent years, causing $470M in financial losses for United States users in 2024 alone. This threat is also evolving rapidly, meaning that attackers continually adapt their tactics, reshaping the landscape. There is a significant body of literature on investigating smishing attacks and defenses. However, there is no systematic review that reflects the current attack and defense landscape along with available resources (i.e., relevant
datasets). This motivates us to systematize the current smishing research efforts, including the following four research pillars: (a) user perception and susceptibility, (b) attack characterization, (c) defense landscape, and (d) smishing
datasets. This leads us to propose novel future research directions towards effectively mitigating smishing attacks.
Read the full abstract ▾
All authors Mir Mehedi A. Pritom, Seyed Mohammad Sanjari, Maraz Mia, Ashfak Md Shibli, S M Mostaq Hossain, Muhammad Ismail, Shouhuai Xu
Cryptography and Security · Cross-listed from cs.AI
Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrieval
Dzenan Hamzic, Florian Skopik, Max Landauer et al. (+2 more)
Cyber threat intelligence (CTI) analysts must answer complex questions over large collections of narrative security reports.
Retrieval-augmented generation (RAG) systems help
language models access external knowledge, but traditional vector
retrieval often struggles with queries that require
reasoning over relationships between entities such as threat actors, malware, and vulnerabilities. This limitation arises because relevant evidence is often distributed across multiple text fragments and documents. Knowledge graphs address this challenge by enabling structured multi-hop
reasoning through explicit representations of entities and relationships. However, multiple
retrieval paradigms, including graph-based, agentic, and hybrid approaches, have emerged with different assumptions and failure modes. It remains unclear how these approaches compare in realistic CTI settings and when graph grounding improves performance. We present a systematic evaluation of four RAG architectures for CTI analysis: standard vector
retrieval, graph-based
retrieval over a CTI knowledge graph, an agentic variant that repairs failed graph queries, and a hybrid approach combining graph queries with text
retrieval. We evaluate these systems on 3,300 CTI question-answer pairs spanning factual lookups, multi-hop relational queries, analyst-style synthesis questions, and unanswerable cases. Results show that graph grounding improves performance on structured factual queries. The hybrid graph-text approach improves answer quality by up to 35 percent on multi-hop questions compared to vector RAG, while maintaining more reliable performance than graph-only systems.
Read the full abstract ▾
All authors Dzenan Hamzic, Florian Skopik, Max Landauer, Markus Wurzenberger, Andreas Rauber
Cryptography and Security
Optimizing IoT Intrusion Detection with Tabular Foundation Models for Smart City Forensics
Asma Al-Dahmani, Abdulla Bin Safwan, Mohammad Obeidat et al. (+1 more)
Security operations in smart cities demand detection systems that balance accuracy with response time. While ensemble methods like Random Forest achieve high accuracy, their computational overhead impedes real-time forensic triage. We present the first systematic evaluation of TabPFNv2.5, a
transformer-based foundation model, against traditional ensemble classifiers for IoT intrusion detection. Using the TON IoT
dataset, we demonstrate that TabPFNv2.5 achieves 40 faster inference than Random Forest while maintaining 97% binary classification accuracy. We propose a hybrid pipeline in which TabPFNv2.5 performs rapid threat screening, while ensemble models handle detailed classification. Our analysis reveals that scanning attacks remain the hardest to detect (F1: 69.8%) and cross-device generalization depends critically on feature similarity. These findings establish foundation models as viable components for time-sensitive IoT security operations
Read the full abstract ▾
All authors Asma Al-Dahmani, Abdulla Bin Safwan, Mohammad Obeidat, Belal Alsinglawi
Cryptography and Security
How to reconstruct (anonymously) a secret cellular automaton
Luca Mariot, Federico Mazzone, Luca Manzoni et al. (+1 more)
We consider threshold secret sharing schemes based on cellular automata (CA) that allows for anonymous reconstruction, meaning that the secret can be recovered only as a function of the shares, without knowing the participants' identities. To this end, we revisit the basic characterization of $(2,n)$ threshold schemes based on CA in terms of Mutually Orthogonal Latin Squares (MOLS), and redefine the secret space as the MOLS family itself, showing that the new resulting scheme enables anonymous reconstruction of secret CA rules. Finally, we discuss the trade-off between the number of secret CA that can be shared and the computational complexity of the recovery phase.
Read the full abstract ▾
All authors Luca Mariot, Federico Mazzone, Luca Manzoni, Alberto Leporati
Cryptography and Security
Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service
Zhimin Chen, Xiaojie Liang, Wenbo Xu et al. (+2 more)
Embedding-as-a-Service (EaaS) has become an important semantic infrastructure for natural
language and multimedia applications, but it is highly vulnerable to model stealing and copyright infringement. Existing EaaS watermarking methods face a fundamental robustness–utility–verifiability tension: trigger-based methods are fragile to paraphrasing, transformation-based methods are sensitive to dimensional perturbation, and region-based methods may incur false positives due to coincidental
geometric affinity. To address this problem, we propose GeoMark, a geometry-aware localized watermarking framework for EaaS copyright protection. GeoMark uses a natural in-
manifold embedding as a shared watermark target, constructs geometry-separated anchors with explicit target–anchor margins, and activates watermark injection only within adaptive local neighborhoods. This design decouples where watermarking is triggered from what ownership is attributed to, achieving localized triggering and centralized attribution. Experiments on four
benchmark datasets show that GeoMark preserves downstream utility and
geometric fidelity while maintaining robust copyright verification under paraphrasing, dimensional perturbation, and CSE (Clustering, Selection, Elimination) attacks, with improved verification stability and low false-positive risk.
Read the full abstract ▾
All authors Zhimin Chen, Xiaojie Liang, Wenbo Xu, Yuxuan Liu, Wei Lu
Cryptography and Security
BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection
Ammar Bhilwarawala, Likhamba Rongmei, Harsh Sharma et al. (+4 more)
IoT botnet detection has advanced, yet most published systems are validated on a single
dataset and rarely generalise across environments. Heterogeneous feature spaces make multi-
dataset training practically impossible without discarding semantic interpretability or introducing data integrity violations. No prior work has addressed both problems with a formally specified, reproducible methodology. This paper does. We introduce BRIDGE (
Benchmark Reference for IoT Domain Generalisation Evaluation), the first formally specified heterogeneous multi-
dataset benchmark for IoT intrusion detection, unifying CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT through a 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only feature mapping, explicit zero-filling, and per-
dataset coverage from 15% to 93%. A leave-one-
dataset-out (LODO) protocol makes the generalisation gap precisely measurable: all five evaluated architectures achieve mean LODO F1 between 0.39 and 0.47, and we establish the first community generalisation baseline at mean LODO F1 = 0.5577, a result that shifts the agenda from single-
benchmark optimisation toward cross-environment generalisation. We propose TCH-Net, a multi-branch network fusing a three-path Temporal branch (residual convolutional-BiGRU, stride-downsampled BiGRU, pre-LayerNorm
Transformer), a provenance-conditioned Contextual branch, and a Statistical branch via Cross-Branch Gated
Attention Fusion (CB-GAF) with learnable sigmoid gates for dynamic feature-wise mixing. Across five random seeds, TCH-Net achieves F1 = 0.8296 +/- 0.0028, AUC = 0.9380 +/- 0.0025, and MCC = 0.6972 +/- 0.0056, outperforming all twelve baselines (p < 0.05, Wilcoxon) and recording the highest LODO F1 overall. BRIDGE and the full pipeline are at https://github.com/Ammar-ss/TCH-Net.
Read the full abstract ▾
All authors Ammar Bhilwarawala, Likhamba Rongmei, Harsh Sharma, Arya Jena, Kaushal Singh, Jayashree Piri, Raghunath Dey
Cryptography and Security
The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems
Yihao Zhang, Kai Wang, Jiangrong Wu et al. (+7 more)
Large
Language Models (LLMs) face prominent security risks from jailbreaking, a practice that manipulates models to bypass built-in security constraints and generate unethical or unsafe content. Among various jailbreak techniques, multi-turn jailbreak attacks are more covert and persistent than single-turn counterparts, exposing critical vulnerabilities of LLMs. However, existing multi-turn jailbreak methods suffer from two fundamental limitations that affect the actual impact in real-world scenarios: (a) As models become more context-aware, any explicit harmful trigger is increasingly likely to be flagged and blocked; (b) Successful final-step triggers often require finely tuned, model-specific contexts, making such attacks highly context-dependent. To fill this gap, we propose Salami Slicing Risk, which operates by chaining numerous low-risk inputs that individually evade
alignment thresholds but cumulatively accumulate harmful intent to ultimately trigger high-risk behaviors, without heavy reliance on pre-designed contextual structures. Building on this risk, we develop Salami Attack, an automatic framework universally applicable to multiple model types and modalities. Rigorous experiments demonstrate its state-of-the-art performance across diverse models and modalities, achieving over 90% Attack Success Rate on GPT-4o and Gemini, as well as robustness against real-world
alignment defenses. We also proposed a defense strategy to constrain the Salami Attack by at least 44.8% while achieving a maximum blocking rate of 64.8% against other multi-turn jailbreak attacks. Our findings provide critical insights into the pervasive risks of multi-turn jailbreaking and offer actionable mitigation strategies to enhance LLM security.
Read the full abstract ▾
All authors Yihao Zhang, Kai Wang, Jiangrong Wu, Haolin Wu, Yuxuan Zhou, Zeming Wei, Dongxian Wu, Xun Chen, Jun Sun, Meng Sun
Cryptography and Security · Cross-listed from cs.AI
Mobile GUI Agent Privacy Personalization with Trajectory Induced Preference Optimization
Zhixin Lin, Jungang Li, Dongliang Xu et al. (+5 more)
Mobile GUI
agents powered by
Multimodal Large
Language Models (MLLMs) can execute complex tasks on mobile devices. Despite this progress, most existing systems still optimize task success or efficiency, neglecting users'
privacy personalization. In this paper, we study the often-overlooked problem of
agent personalization. We observe that personalization can induce systematic structural heterogeneity in execution trajectories. For example,
privacy-first users often prefer protective actions, e.g., refusing permissions, logging out, and minimizing exposure, leading to logically different execution trajectories from utility-first users. Such variable-length and structurally different trajectories make standard preference optimization unstable and less informative. To address this issue, we propose Trajectory Induced Preference Optimization (TIPO), which uses preference-intensity weighting to emphasize key
privacy-related steps and padding gating to suppress
alignment noise. Results on our
Privacy Preference
Dataset show that TIPO improves persona
alignment and distinction while preserving strong task executability, achieving 65.60% SR, 46.22 Compliance, and 66.67% PD, outperforming existing optimization methods across various GUI tasks. The code and
dataset will be publicly released at https://github.com/Zhixin-L/TIPO.
Read the full abstract ▾
All authors Zhixin Lin, Jungang Li, Dongliang Xu, Shidong Pan, Yibo Shi, Yuchi Liu, Yuecong Min, Yue Yao
Cryptography and Security
Hardware-Efficient Compound IC Protection with Lightweight Cryptography
Levent Aksoy, Muhammad Sohaib Munir and Sedat Akleylek
Over the years, many techniques have been introduced to protect integrated
circuits (ICs) from hardware security threats that emerged in the globalized IC manufacturing supply chain, such as overproduction and piracy. However, most of these techniques have been rendered inefficient since they do not rely on provably secure
algorithms. Moreover, the previously proposed techniques using cryptography
algorithms lead to a significant increase in hardware complexity and are vulnerable to the removal and power analysis attacks. In this paper, we propose a compound IC protection mechanism that uses a lightweight cryptography
algorithm with prominent logic locking and hardware obfuscation techniques. Experimental results show that the secure designs generated by the developed tool have significantly less hardware complexity when compared to those generated by previously proposed techniques using cryptography
algorithms and are resilient to existing removal, algebraic, and logic locking attacks.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
Reducing Hallucination in Enterprise AI Workflows via Hybrid Utility Minimum Bayes Risk (HUMBR)
Chenhao Fang, Jordi Mola, Mark Harman et al. (+10 more)
Although LLMs drive automation, it is critical to ensure immense consideration for high-stakes enterprise workflows such as those involving legal matters, risk management, and
privacy compliance. For Meta, and other organizations like ours, a single hallucinated clause in such high stakes workflows risks material consequences. We show that by framing
hallucination mitigation as a Minimum Bayes Risk (MBR) problem, we can dramatically reduce this risk. Specifically, we introduce a Hybrid Utility MBR (HUMBR) framework that synthesizes semantic
embedding similarity with lexical precision to identify consensus without ground-truth references, for which we derive rigorous error bounds. We complement this theoretical analysis with a comprehensive empirical evaluation on widely-used public
benchmark suites (TruthfulQA and LegalBench) and also real world data from Meta production deployment. The results from our empirical study show that MBR significantly outperforms standard Universal Self-Consistency. Notably, 81% of the pipeline's suggestions were preferred over human-crafted ground truth, and critical recall failures were virtually eliminated.
Read the full abstract ▾
All authors Chenhao Fang, Jordi Mola, Mark Harman, Jason Nawrocki, Vaibhav Shrivastava, Yue Cheng, Jay Minesh Shah, Katayoun Zand, Mansi Tripathi, Arya Pudota, Matthew Becker, Hervé Robert, Abhishek Gulati
Cryptography and Security
Studying Detection Rule Generation as a Unified Task
Cheng Meng, Wenxin Le, Xinyi Li et al. (+4 more)
Security systems use detection rules to identify suspicious activity. Existing studies often investigate rule generation for specific security systems, devoting substantial effort to developing dedicated methods and evaluation setups. Such customization contributes to fragmented research, limiting method reuse and result comparability across systems. We therefore study detection rule generation as a unified task across diverse natural
language inputs and rule
languages. To support method reuse, we propose UniRule, which abstracts diverse rules into shared natural
language representations for
retrieval. To enable consistent evaluation, we introduce a protocol that compares rules under shared criteria and aggregates the results into method scores. Experiments demonstrate the effectiveness of UniRule and the reliability of the evaluation protocol. They also show that method performance in one setting can be predicted from results in others, with average error close to that obtained using that setting's own data. These findings support studying detection rule generation as a unified task.
Read the full abstract ▾
All authors Cheng Meng, Wenxin Le, Xinyi Li, Qiuyun Wang, Fangli Ren, Zhengwei Jiang, Baoxu Liu
Cryptography and Security
QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits
Navid Azimi, Aditya Prakash, Yao Wang et al. (+1 more)
Deep neural networks remain highly vulnerable to
adversarial perturbations, limiting their reliability in security- and safety-critical applications. To address this challenge, we introduce QShield, a modular hybrid
quantum-classical neural network (HQCNN) architecture designed to enhance the
adversarial robustness of classical deep learning models. QShield integrates a conventional convolutional neural network (CNN) backbone for feature extraction with a
quantum processing module that encodes the extracted features into
quantum states, applies structured
entanglement operations under realistic noise models, and outputs a hybrid prediction through a dynamically weighted fusion mechanism implemented via a lightweight multilayer perceptron (MLP). We systematically evaluate both classical and hybrid
quantum-classical models on the MNIST, OrganAMNIST, and CIFAR-10
datasets, using a comprehensive set of robustness, efficiency, and computational performance metrics. Our results demonstrate that classical models are highly vulnerable to
adversarial attacks, whereas the proposed hybrid models with
entanglement patterns maintain high predictive accuracy while substantially reducing attack success rates across a wide range of
adversarial attacks. Furthermore, the proposed hybrid architecture significantly increased the computational cost required to generate
adversarial examples, thereby introducing an additional layer of defense. These findings indicate that the proposed modular hybrid architecture achieves a practical balance between predictive accuracy and
adversarial robustness, positioning it as a promising approach for secure and reliable machine learning in sensitive and safety-critical applications.
Read the full abstract ▾
All authors Navid Azimi, Aditya Prakash, Yao Wang, Li Xiong
Cryptography and Security
Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models
Shuhao Zhang, Yuli Chen, Jiale Han et al. (+2 more)
Watermarking provides a critical safeguard for large
language model (LLM) services by facilitating the detection of LLM-generated text. Correspondingly, stealing watermark
algorithms (SWAs) derive watermark information from watermarked texts generated by victim LLMs to craft highly targeted
adversarial attacks, which compromise the reliability of watermarks. Existing SWAs rely on fixed strategies, overlooking the non-uniform distribution of stolen watermark information and the dynamic nature of real-world LLM generation processes. To address these limitations, we propose Adaptive Stealing (AS), a novel SWA featuring enhanced design flexibility through Position-Based Seal Construction and Adaptive Selection modules. AS operates by defining multiple attack perspectives derived from distinct activation states of contextually ordered
tokens. During attack execution, AS dynamically selects the optimal perspective based on watermark compatibility, generation priority, and dynamic generation relevance. Our experiments demonstrate that AS significantly increases steal efficiency against target watermarks under identical experimental conditions. These findings highlight the need for more robust LLM watermarks to withstand potential attacks. We release our code to the community for future research\footnote{https://github.com/DrankXs/AdaptiveStealingWatermark}.
Read the full abstract ▾
All authors Shuhao Zhang, Yuli Chen, Jiale Han, Bo Cheng, Jiabao Ma
Cryptography and Security · Cross-listed from quant-ph
Answering Counting Queries with Differential Privacy on a Quantum Computer
Arghya Mukherjee, Hassan Jameel Asghar and Gavin K. Brennen
Differential
privacy is a mathematical notion of data
privacy that has fast become the de facto standard in
privacy-preserving data analysis. Recently a lot of work has focused on differential
privacy in the
quantum setting. Continuing on this line of study, we investigate how to answer counting queries on a
quantum encoded
dataset with differential
privacy. An example of a counting query is “How many people in the
dataset are over the age of 25 and with a university education?” Counting queries form the most basic but nonetheless rich set of statistics extractable from a
dataset. We show that answering these queries on a
quantum encoded
dataset reduces to measuring the amplitude of one of two orthogonal states. We then analyze the differential
privacy properties of two
algorithms from literature to measure amplitude: one which performs repeated measurements in the computational basis, and the other which utilizes the classic amplitude estimation
algorithm. For the first technique, we prove
privacy results for the case of counting queries that improve on previously known results on general queries, and show that the mechanism in fact amplifies
privacy due to inherent randomness. For the second method, we derive a tight bound on maximum possible change in the amplitude if we add or remove a single item in the
dataset, a quantity called global sensitivity which is central in making an
algorithm differentially private. We then show a differentially private version of the amplitude estimation
algorithm for counting queries. We also discuss how these methods can be outsourced to a
quantum server to blindly compute counting queries with differential
privacy.
Read the full abstract ▾