Cryptography and Security
The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems
Tanzim Ahad, Ismail Hossain, Md Jahangir Alam et al. (+3 more)
Multi-
agent AI pipelines typically assume that
agent misconduct originates from model misalignment. We identify a structural failure in this assumption, the Misattribution Gap, where
memory-layer attacks produce behaviors indistinguishable from model failure, causing defenders to apply the wrong remediation. We formalize Semantic Norm Drift (SND) as a third path to
agent misconduct, distinct from emergent misalignment and collusion. In SND, a policy-formatted document enters a shared vector store through normal uploads and later reappears as trusted system context after provenance is lost through a Trust Laundering Chain. Across 64 documented failures, attribution systems consistently blamed the model. Four safety classifiers, including one trained on
memory poisoning, produced zero detections across 510 checkpoints. In 59 of 65 valid cases,
agents explicitly cited the injected document as normative authority before complying. The attack requires no trigger, model access, or repeated interaction, achieves full effect within five sessions, and persists indefinitely. We introduce Counterfactual Composition Testing, which identifies the causal entry with 87.5% accuracy and zero false positives, while a forensics baseline fails across all 25 scenarios. We further prove the
Retrieval-Coverage Dilemma, showing that stronger evasion inherently weakens the attack, limiting adaptive bypass strategies. Finally, we propose
Memory-Persistent Information-Flow Control, which blocks 97% of attacks at the cross-session boundary where prior defenses fail. We release the SND Corpus, the first
adversarial memory benchmark with temporal persistence and multi-
agent composition across financial and Health Care domains.
Read the full abstract ▾
All authors Tanzim Ahad, Ismail Hossain, Md Jahangir Alam, Sai Puppala, Syed Bahauddin Alam, Sajedul Talukder
Cryptography and Security · Cross-listed from cs.LG
Zibo Diao, Jingchu Gai, Xinyue Ai et al. (+3 more)
Frontier commercial generative models face a growing threat from
distillation, whereby a distiller harvests generated responses and trains a competing model at drastically lower cost. Existing defenses either modify the generation to degrade
distillation performance, sacrificing response quality, or rely on behavioral detection mechanisms that can be readily bypassed through multi-account querying. In this work, we propose Lossless Anti-
Distillation Sampling (LADS), which leaves the generation itself unchanged while substantially reducing the effectiveness of
distillation. Concretely, LADS controls the latent randomness underlying inference through a coupling mechanism that preserves within-account generation independence while inducing cross-account dependence. By construction, each benign user, who typically holds only a single account, receives the same experience under LADS as they would without any defense, thereby enjoying a lossless experience. However, for a multi-account task-specific distiller, semantically similar queries submitted across different accounts are assigned coupled randomness, inducing dependence in the harvested data and thereby degrading the generalization performance of the distilled model. Using uniform convergence theory, we show that LADS provably degrades the distiller's generalization gap relative to standard i.i.d. sampling. Experiments on image generation, mathematical
reasoning, and code generation confirm that LADS substantially degrades the performance of distilled students while preserving exact statistical fidelity for individual users.
Read the full abstract ▾
All authors Zibo Diao, Jingchu Gai, Xinyue Ai, Zhang Zhang, Zhenyu He, Di He
Cryptography and Security · Cross-listed from cs.LG
Quantum Adversarial Machine Learning: From Classical Adaptations to Quantum-Native Methods
Roozbeh Razavi-Far, Mohammad Meymani, Erfan Mahmoudinia et al. (+6 more)
Machine learning has revolutionized numerous industrial domains. Despite recent advances, machine learning models remain vulnerable to
adversarial threats.
Adversarial machine learning is a field that studies these vulnerabilities to build robust machine learning models.
Quantum machine learning is an interdisciplinary field that bridges
quantum computing and classical machine learning. While
quantum machine learning shows potentials to outperform classical machine learning in complex tasks such as regression, classification, and generative modeling, it remains vulnerable to
adversarial attacks. Given the recent advancements in
quantum computing and machine learning, the
quantum adversarial machine learning field has emerged to study the vulnerabilities of
quantum machine learning, possible attacks, and novel
quantum-enhanced defense strategies. In this survey, we provide a detailed overview on
quantum adversarial machine learning and explore the existing attacks and countermeasures. We also review the theoretical underpinnings of this area, emerging trends, and critical challenges.
Read the full abstract ▾
All authors Roozbeh Razavi-Far, Mohammad Meymani, Erfan Mahmoudinia, Dorsa Vazirzade, Peyman Paknezhad, Fateme Ghasemi, Saeed Saravani, Somayeh Nikkhoo, Kimia Haghjooei
Cryptography and Security
GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
Kaixiang Zhao, Bolin Shen, Yuyang Dai et al. (+2 more)
Graph neural networks (GNNs) deployed as cloud services can be stolen through model-extraction attacks, which train a surrogate from query responses to reproduce the target's behavior, and a growing line of ownership defenses tries to prevent or trace such theft. This paper asks two questions: how hard is it to steal a GNN, and can we stop it? Prior work cannot answer either, because experiments use inconsistent
datasets, threat models, and metrics. We introduce GraphIP-Bench, a unified
benchmark that evaluates both sides under a single black-box protocol. GraphIP-Bench integrates twelve extraction attacks, twelve defenses spanning watermarking, output perturbation, and query-pattern detection, ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks. It reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack-and-defense track that runs every attack on every defended target and measures watermark verification on the resulting surrogate, exposing how much protection a defense retains after extraction. The empirical picture is clear: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, exposing a gap that single-model evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross-architecture mismatch between target and surrogate reduces but does not prevent extraction. We release GraphIP-Bench with reproducible scripts and configurations, and integrate the attacks and defenses into the PyGIP library. Code: https://github.com/LabRAI/GraphIP-Bench. Library: https://labrai.github.io/PyGIP/index.html.
Read the full abstract ▾
All authors Kaixiang Zhao, Bolin Shen, Yuyang Dai, Shayok Chakraborty, Yushun Dong
Cryptography and Security · Cross-listed from cs.CL
REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations
Buyun Liang, Jinqi Luo, Liangzu Peng et al. (+6 more)
Large
language models (LLMs) achieve strong performance across many tasks but remain vulnerable to
hallucinations, making it important to systematically evaluate their reliability under realistic
adversarial inputs. We formulate
hallucination elicitation as a constrained optimization problem, where the goal is to find semantically coherent
adversarial prompts that are equivalent to benign user
prompts. Existing attack methods remain limited: discrete
prompt-based attacks preserve semantic equivalence and coherence but search only over a limited set of
prompt variations, while continuous latent-space attacks explore a richer space but often decode into
prompts that are no longer valid rephrasings. To address these limitations, we propose REALISTA, a realistic latent-space attack framework. REALISTA constructs an input-dependent dictionary of valid editing directions, each corresponding to a semantically equivalent and coherent rephrasing, and optimizes continuous combinations of these directions in latent space. This design combines the optimization flexibility of continuous attacks with the semantic realism of discrete rephrasing-based attacks. Experiments demonstrate that REALISTA achieves superior or comparable performance to state-of-the-art realistic attacks on open-source LLMs and, crucially, succeeds in attacking large
reasoning models under free-form response settings, where prior realistic attacks fail. Code is available at https://github.com/Buyun-Liang/REALISTA.
Read the full abstract ▾
All authors Buyun Liang, Jinqi Luo, Liangzu Peng, Kwan Ho Ryan Chan, Darshan Thaker, Kaleab A. Kinfu, Fengrui Tian, Hamed Hassani, René Vidal
Cryptography and Security · Cross-listed from cs.GT
Dynamic Transaction Scheduling and Pricing in the Ethereum Mempool
Fatemeh Fardno and S. Rasoul Etesami
The Ethereum blockchain utilizes the EIP-1559
algorithm to manage transaction inclusion and block assembly. However, EIP-1559 and much of the existing literature study this problem from a static perspective, focusing on price
evolution without modelling transaction dynamics within the mempool. Motivated by this limitation, we study a dynamic transaction scheduling problem in which transactions with heterogeneous sizes and per-unit values arrive over time and remain in the mempool until scheduled. To capture the
stochastic mempool
evolution, we formulate the problem as a Markov Decision Process (MDP) whose state represents the mempool configuration and whose actions correspond to block prices. We first provide a primal-dual interpretation of the static EIP-1559 mechanism, showing that block prices arise naturally as dual variables of a social-welfare maximization problem. Building on this perspective, we extend the framework to the dynamic setting and formulate an objective that maximizes long-run discounted reward while incorporating holding costs and overshoot penalties. We then employ a Natural Policy Gradient (NPG)
algorithm to compute the optimal policy. Our results show that dynamic pricing stabilizes the mempool while maximizing long-run discounted reward. In particular, as the overshoot penalty increases, the average scheduled transaction volume converges to the target block capacity, and the resulting NPG updates closely resemble the EIP-1559 price update rule. Finally, we study two special cases of the MDP formulation: homogeneous transactions and uniform arrivals. In the homogeneous setting, where the protocol directly controls scheduled volume, we show that the optimal policy has a threshold structure. We then propose a bang-bang pricing mechanism for uniform arrivals and derive a lower bound on the block capacity needed to ensure system stability.
Read the full abstract ▾
Cryptography and Security
CoT-Guard: Small Models for Strong Monitoring
Nirav Diwan, Han Wang, Berkcan Kapusuzoglu et al. (+6 more)
Monitoring the chain-of-thought (CoT) of
reasoning models is a promising approach for detecting covert misbehavior (i.e., hidden objectives) in code generation tasks. While large models (GPT-5, Gemini-3-Flash) can serve as effective CoT monitors, they are expensive to deploy due to the lengthy
reasoning traces and high API cost, emphasizing the need for smaller, cheaper alternatives. Nevertheless, we find that current small models (4B–8B) struggle to detect hidden objectives despite access to the CoT, frequently misattributing them as part of the user query. To address this, we propose a post-training pipeline combining supervised fine-tuning (SFT) and reinforcement learning (RL), where SFT narrows the gap for in-domain tasks by distilling detection behavior from stronger monitors, and RL on hard and subtly crafted hidden objectives helps the model generalize to out-of-domain monitoring tasks. To validate this generalization, we evaluate under a realistic threat model motivated by practical supply-chain attacks, where the adversary is a third-party LLM router injecting hidden objectives into code-generation requests through either
prompt manipulation or code manipulation attacks. To push beyond objectives that large monitors already saturate, we also introduce four new challenging tasks even for strong monitors. Finally, we introduce CoT-Guard, a 4B-parameter monitor that demonstrates superior generalization performance under both
prompt and code manipulation attacks, achieving a G-mean^2 (i.e., TNR x TPR) of 75% and outperforming GPT-5.4 (56%), GPT-5-mini (41%), and Qwen3-32B (54%), while closing the gap to Gemini-3-Flash (83%). These results demonstrate that CoT-Guard provides a practical and cost-effective user-side defense, substantially improving hidden-objective detection while avoiding the deployment cost of large monitors.
Read the full abstract ▾
All authors Nirav Diwan, Han Wang, Berkcan Kapusuzoglu, Ramin Moradi, Supriyo Chakraborty, Giri Iyengar, Sambit Sahu, Huan Zhang, Gang Wang
Cryptography and Security
Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving
Shuo Ju, Qingzhao Zhang, Huashan Chen et al. (+6 more)
Existing physical
adversarial attacks on
vision-based autonomous driving induce time-evolving perception errors, including biased object tracking or trajectory prediction, through (i) sophisticated physical patch inducing detection box drift when entering the view distance, or (ii) dynamically changing patches that cause different perception errors at different time. In both cases, viewing-angle variation is treated as a challenge, requiring
adversarial patches to remain effective across frames under varying views, leading to complex multi-view optimization. In contrast, we show that viewing-angle variation itself can be turned into an attack tool. We design a new attack paradigm where a static, passive
adversarial camouflage is mounted on a vehicle whose view-dependent appearance naturally evolves with relative motion, inducing consistent feature drift across frames. This causes the system to infer a physically plausible but incorrect trajectory, such as a false cut-in, which propagates to downstream decision-making and triggers unnecessary braking. Unlike prior approaches that require multi-view robustness or active intervention, our attack emerges from normal driving dynamics and is easy to deploy: a parked vehicle with a natural camouflage can induce hard braking in passing autonomous vehicles. We demonstrate the novel attack on nuScenes
dataset, showing the effectiveness with an end-to-end success rate of up to 87.5%, measured by hard-braking events, and robustness across different scene backgrounds, victim vehicle speeds, and perception models.
Read the full abstract ▾
All authors Shuo Ju, Qingzhao Zhang, Huashan Chen, Xuheng Wang, Haotang Li, Wanqian Zhang, Feng Liu, Kebin Peng, Sen He
Cryptography and Security · Cross-listed from cs.NI
Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety
Muhammad Bilal, Jon Crowcroft, Ruizhi Wang et al. (+2 more)
Large
language models (LLMs) are increasingly being used in network operations (NetOps) and artificial intelligence for IT operations (AIOps) for tasks ranging from telemetry
retrieval and incident diagnosis to configuration planning and bounded remediation. As these systems acquire greater access to operational tools, a central question is whether operational assurance develops commensurately with the authority granted to them. This survey examines that question through a structured, evidence-stratified review of agentic NetOps and AIOps, spanning directly evaluated LLM systems, operational mechanisms, transferred evidence, and normative guidance. We organise the field around autonomy, tool scope, evidence traces, assurance controls, evaluation, security, and governance, and introduce an operational assurance contract that links each autonomy level to permitted tools, required evidence, independent gates, execution budgets, rollout and rollback duties, and audit requirements. The synthesis indicates a capability-assurance gap: evidence is comparatively strong for read-oriented assistance and tool-grounded diagnosis, but becomes substantially less complete as systems approach configuration change, bounded execution, and closed-loop operation. We therefore develop a workflow-level evaluation framework covering evidence quality, tool use, policy and invariant compliance, staged execution, recovery, calibration, cost, and human intervention, together with a threat model for
prompt-borne attacks, compromised operational evidence, excessive agency, privilege boundaries, and auditability. The resulting view treats agentic NetOps and AIOps as constrained operational control, in which increasing autonomy requires correspondingly stronger evidence, independently enforced safeguards, and recovery mechanisms.
Read the full abstract ▾
All authors Muhammad Bilal, Jon Crowcroft, Ruizhi Wang, Xiaolong Xu, Schahram Dustdar
Cryptography and Security · Cross-listed from cs.AI
Do Androids Dream of Breaking the Game? Systematically Auditing AI Agent Benchmarks with BenchJack
Hao Wang, Hanchen Li, Qiuyang Mang et al. (+3 more)
Agent benchmarks have become the de facto measure of frontier AI competence, guiding model selection, investment, and deployment. However, reward hacking, where
agents maximize a score without performing the intended task, emerges spontaneously in frontier models without overfitting. We argue that
benchmarks must be secure by design. From past incidents of reward hacks, we derive a taxonomy of eight recurring flaw patterns and compile them into the
Agent-Eval Checklist for
benchmark designers. We condense the insights into BenchJack, an automated red-teaming system that drives coding
agents to audit
benchmarks and identify possible reward-hacking exploits in a clairvoyant manner. Moreover, we extend BenchJack to an iterative generative-
adversarial pipeline that discovers new flaws and patches them iteratively to improve
benchmark robustness. We apply BenchJack to 10 popular
agent benchmarks spanning software engineering, web
navigation, desktop computing, and terminal operations. BenchJack synthesizes reward-hacking exploits that achieve near-perfect scores on most of the
benchmarks without solving a single task, surfacing 219 distinct flaws across the eight classes. Moreover, BenchJack's extended pipeline reduces the hackable-task ratio from near 100% to under 10% on four
benchmarks without fatal design flaws, fully patching WebArena and OSWorld within three iterations. Our results show that evaluation pipelines have not internalized an
adversarial mindset, and that proactive
auditing could help close the security gap for the fast-paced benchmarking space.
Read the full abstract ▾
All authors Hao Wang, Hanchen Li, Qiuyang Mang, Alvin Cheung, Koushik Sen, Dawn Song
Cryptography and Security
Persona-Conditioned Adversarial Prompting (PCAP): Multi-Identity Red-Teaming for Enhanced Adversarial Prompt Discovery
Cristian Morasso, Anisa Halimi, Muhammad Zaid Hameed et al. (+1 more)
Existing automated red-teaming pipelines often miss attacks that depend on attacker identity, framing, or multi-turn tactics. This under-coverage underestimates real-world risk. We introduce Persona-Conditioned
Adversarial Prompting (PCAP), which conditions
adversarial search on attacker personas and strategy cards and runs parallel persona-conditioned beam searches to discover diverse, transferable jailbreaks. PCAP is orthogonal to the underlying search
algorithm and substantially increases attack success rate (ASR) and
prompt diversity (e.g., ASR on GPT-OSS~120B from $\approx58\% \rightarrow \approx97\%$), improving attack strategy coverage and diversity.
Read the full abstract ▾
All authors Cristian Morasso, Anisa Halimi, Muhammad Zaid Hameed, Douglas Leith
Cryptography and Security
OverrideFuzz: Semantic-Aware Grammar Fuzzing for Script-Runtime Vulnerabilities
Yiran Qiu
Script-
language runtimes such as Python, Lua, and JavaScript are widely deployed in security sensitive contexts, yet they remain difficult to test because valid inputs must satisfy syntax, dynamic type constraints, and object-level semantics. Existing grammar and reflection-based fuzzers improve syntactic validity and interface reachability, but they rarely model override hooks, dynamic rebinding, and attribute-resolution behavior that can redirect built-in operations across the script-native boundary and trigger use-after-free or type-confusion bugs. We present OverrideFuzz, a two-phase, semantic-aware grammar fuzzer for script-
language runtimes. Its declaration phase constructs objects with overriding methods, while its execution phase generates operations that route through those hooks. Active reflection tracks runtime types, and passive reflection learns from error messages to remove invalid operation shapes, allowing generation to approach semantic correctness without manual API specification. We evaluate OverrideFuzz on CPython, Lua, and QuickJS. All three targets show consistent coverage growth, with rapid early expansion followed by slower incremental gains, and Lua benefits most from its pervasive metamethod dispatch mechanism. Although OverrideFuzz did not discover novel vulnerabilities during the bounded evaluation period, corpus analysis shows that it reconstructs inputs matching known vulnerability patterns, which suggests that semantic-aware generation reaches the intended script-native boundary behaviors.
Read the full abstract ▾
Cryptography and Security
TextSeal: A Localized LLM Watermark for Provenance & Distillation Protection
Tom Sander, Hongyan Chang, Tomáš Souček et al. (+10 more)
We introduce TextSeal, a state-of-the-art watermark for large
language models. Building on Gumbel-max sampling, TextSeal introduces dual-key generation to restore output diversity, along with
entropy-weighted scoring and multi-region localization for improved detection. It supports serving optimizations such as speculative decoding and multi-
token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID-text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion-free, and evaluation across
reasoning benchmarks confirms that it preserves downstream performance; while a
multilingual human evaluation (6000 A/B comparisons, 5
languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also “radioactive”: its watermark signal transfers through model
distillation, enabling detection of unauthorized use.
Read the full abstract ▾
All authors Tom Sander, Hongyan Chang, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Sylvestre-Alvise Rebuffi, Alexandre Mourachko, Surya Parimi, Christophe Ropers, Rashel Moritz, Vanessa Stark, Hady Elsahar, Pierre Fernandez
Cryptography and Security
Attacks and Mitigations for Distributed Governance of Agentic AI under Byzantine Adversaries
Matthew D. Laws, Alina Oprea and Cristina Nita-Rotaru
Agentic AI governance is a critical component of agentic AI infrastructure ensuring that
agents follow their owner's communication and interaction policies, and providing protection against attacks from malicious
agents. The state-of-the-art solution, SAGA, assumes a logically centralized point of trust, the Provider, which serves as a repository for user and
agent information and actively enforces policies. While SAGA provides protection against malicious
agents, it remains vulnerable to a malicious Provider that deviates from the protocol, undermining the security of the identity and access control infrastructure. Deployment on both private and public clouds, each susceptible to insider threats, further increases the risk of Provider compromise. In this work, we analyze the attacks that can be mounted from a compromised Provider, taking into account the different system components and realistic deployments. We identify and execute several concrete attacks with devastating effects: undermining
agent attributability, extracting private data, or bypassing access control. We then present three types of solutions for securing the Provider that offer different trade-offs between security and performance. We first present SAGA-BFT, a fully byzantine-resilient architecture that provides the strongest protection, but incurs significant performance degradation, due to the high-cost of byzantine resilient protocols. We then propose SAGA-MON and SAGA-AUD, two novel solutions that leverage lightweight server-side monitoring or client-side
auditing to provide protection against most classes of attacks with minimal overhead. Finally, we propose SAGA-HYB, a hybrid architecture that combines byzantine-resilience with monitoring and
auditing to trade-off security for performance. We evaluate all the architectures and compare them with SAGA. We discuss which solution is best and under what conditions.
Read the full abstract ▾
Cryptography and Security
Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Models
Sae Furukawa and Alina Oprea
Supervised Finetuning (SFT) has become one of the primary methods for adapting a large
language model (LLM) with extensive pre-trained knowledge to domain-specific, instruction-following tasks. SFT
datasets, composed of instruction-response pairs, often include user-provided information that may contain sensitive data such as personally identifiable information (PII), raising
privacy concerns. This paper studies the problem of targeted PII reconstruction from models fine- tuned on proprietary SFT data, in which an adversary attempts to recover PII associated with a specific identity. We construct multi-turn, user-centric Q&A
datasets in sensitive domains, specifically medical and legal settings, that incorporate PII to enable realistic evaluation of leakage. We then propose COVA, a coverage-aware decoding
algorithm for targeted PII reconstruction under prefix-based attacks. Using COVA, we study how the amount of information available about a target user affects the recovery of their PII from SFT models. Across
datasets, COVA consistently improves PII reconstruction over baseline decoding methods, and even limited contextual knowledge can substantially increase an adversary's success. Our findings demonstrate that small, proprietary SFT
datasets can induce meaningful
privacy leakage through the reconstruction of target-PII associations learned during fine-tuning.
Read the full abstract ▾
Cryptography and Security · Cross-listed from cs.LG
No More, No Less: Task Alignment in Terminal Agents
Sina Mavali, David Pape, Jonathan Evertz et al. (+5 more)
Terminal
agents are increasingly capable of executing complex, long-horizon tasks autonomously from a single user
prompt. To do so, they must interpret instructions encountered in the environment (e.g., README files, code comments, stack traces) and determine their relevance to the task. This creates a fundamental challenge: relevant cues must be followed to complete a task, whereas irrelevant or misleading ones must be ignored. Existing
benchmarks do not capture this ability. An
agent may appear capable by blindly following all instructions, or appear robust by ignoring them altogether. We introduce TAB (Task
Alignment Benchmark), a suite of 89 terminal tasks derived from Terminal-Bench 2.1. Each task is intentionally underspecified, with missing information provided as a necessary cue embedded in a natural environmental artifact, alongside a plausible but irrelevant distractor. Solving these tasks requires selectively using the cue while ignoring the distractor. Applying TAB to ten frontier
agents reveals a systematic gap between task capability and task
alignment. The strongest Terminal-Bench
agent achieves high task completion but low task
alignment on TAB. Evaluating six
prompt-injection defenses further shows that suppressing distractor execution also suppresses the cues required for task completion. These results demonstrate that task-aligned
agents require selective use of environmental instructions rather than blanket acceptance or rejection.
Read the full abstract ▾
All authors Sina Mavali, David Pape, Jonathan Evertz, Samira Abedini, Devansh Srivastav, Thorsten Eisenhofer, Sahar Abdelnabi, Lea Schönherr
Cryptography and Security
ORCHID: Orchestrated Reduction Consensus for Hash-based Integrity in Distributed Ledgers
Abraham Itzhak Weinberg
We present ORCHID (Orchestrated Reduction Consensus for Hash-based Integrity in Distributed Ledgers), a novel bio-inspired consensus protocol that maps the neuroscientific binding problem – how the
brain integrates distributed neural oscillations into a unified conscious percept – onto the distributed systems consensus problem, how blockchain nodes agree on a single ledger state under Byzantine faults. Grounded in the Penrose–Hameroff Orchestrated Objective Reduction (Orch~OR) hypothesis and the Kuramoto synchronisation model, ORCHID equips each node with a
quantum-noisy phase oscillator; consensus is triggered when the network's order parameter $r(t)$ crosses a binding threshold $\theta_b$, mirroring the gamma-band binding event in conscious perception. ORCHID is further strengthened by a coherence-weighted
Quantum Secret Sharing (QSS) layer, extending the survey framework of Weinberg to a concrete consensus application. Simulation results on Watts–Strogatz small-world networks ($n=10$–$150$) demonstrate: (i)~the Kuramoto order parameter reaches $r_{\max}=0.988$ under coupling $K=3.0$, well above the theoretical critical coupling $K_c \approx 1.41$; (ii)~a sharp QSS fidelity phase transition at coherence $c^*\approx 0.82$, confirming
Theorem~2; (iii)100% consensus rate at all tested Byzantine fractions (0%–40%), with median convergence under 4~s for $n=30$; and (iv)~ORCHID achieves $O(n{\cdot}k)$ message complexity, outperforming PBFT's $O(n^2)$ at $n\geq150$. These results establish ORCHID as a scalable, biologically plausible, and
quantum-augmented consensus mechanism for post-
quantum distributed ledgers.
Read the full abstract ▾
Cryptography and Security
ACTING: A Platform for Cyber Ranges Federation
Kyriakos Christou, Maria Michalopoulou, Stefano Taggi et al. (+21 more)
Cyber Defence (CD) training requires interoperable cyber-range environments capable of supporting complex, multidomain exercises across distributed infrastructures. This paper presents three main contributions addressing this challenge. First, we introduce the Exercise Description
Language - First Generation (EDL-FG), a structured
language for formally describing cyber-range training services and exercises. EDL-FG captures both the technical infrastructure required to emulate ICT/OT environments and the scenario logic governing cyber events, injects, and participant interactions, enabling interoperable and automated scenario deployment across
federated Cyber Ranges (CRs). Second, the ACTING platform introduces automated PE and scoring mechanisms that assess trainee actions during exercises through coordinated data collection and analysis across participating CRs. Third, the platform enables multi-domain cyber training scenarios that combine civilian and military operational contexts. Building upon federation capabilities established under the H2020 ECHO project, ACTING demonstrates how interoperable scenario description and automated evaluation support scalable and realistic CD training.
Read the full abstract ▾
All authors Kyriakos Christou, Maria Michalopoulou, Stefano Taggi, Matteo Merialdo, Nikolai Stoianov, Vasilis Ieropoulos, Theofanis Eleftheriadis, Philippos Isaia, Eleni Darra, Ilias Koritsas, Antonis Voulgaridis, Giorgos Rizos, Dimitris Kavallieros, Stefanos Vrochidis, Konstantinos Votis, Liliana Medina, Joao Camacho, Tim Gerling, Aimilia-Bantounax, Pavel Varbanov, George Sharkov, Christos Laoudias, Jose Borges, Maria K. Michael
Cryptography and Security
PrivacySIM: Evaluating LLM Simulation of User Privacy Behavior
James Flemings and Murali Annavaram
Large
language models (LLMs) are increasingly used to simulate human behavior, but their ability to simulate $individual$
privacy decisions is not well understood. In this paper, we address the problem of evaluating whether a core set of user persona attributes can drive LLMs to simulate individual-level
privacy behavior. We introduce PrivacySIM, an evaluation suite that
benchmarks LLM simulation of user
privacy behavior against the ground-truth responses of 1,000 users. These users are drawn from five published user studies on
privacy spanning LLM healthcare consultations, conversational
agents, and chatbots. Drawing on these user studies, we hypothesize three persona facets as plausible predictors of
privacy decision-making: demographics, previous experiences, and stated
privacy attitudes. We condition nine frontier LLMs on subsets of these three facets and measure how often each model's response to a data-sharing scenario matches the user's actual response. Our findings show that (1)
privacy persona conditioning consistently improves simulation quality over no-persona conditioning, but even the strongest model (40.4% accuracy) remains far from faithfully simulating individual
privacy decisions. (2) A user's stated
privacy attitudes alone may not be the best predictor because they often diverge from the user's actual
privacy behavior. (3) Users with high AI/chatbot experience but low stated
privacy attitudes are the most challenging to simulate. PrivacySIM is a first step toward understanding and improving the capabilities of LLMs to simulate user
privacy decisions. We release PrivacySIM to enable further evaluation of LLM
privacy simulation.
Read the full abstract ▾
Cryptography and Security
The Deepfakes We Missed: We Built Detectors for a Threat That Didn't Arrive
Shaina Raza
Nearly a decade of Machine Learning (ML) research on deepfake detection has been organized around a threat model inherited from 2017–2019, revolving around face-swap and talking-head manipulation of public figures, motivated by concerns about large-scale misinformation and
video-evidence fraud. This position paper argues that the threat the field prepared for did not arrive, and the threats that did arrive are substantially different. An accounting of deepfake incidents in 2022–2026 shows that the dominant observed harms are peer-generated Non-Consensual Intimate Imagery (NCII), voice-clone scam calls targeting families and finance workers, and emotional-manipulation fraud. The predicted large-scale public-figure deepfake catastrophe did not materialize during the 2024 global information environment despite extensive preparation. Meanwhile, research effort,
benchmarks, and detection methods remain concentrated on the inherited threat model. The central claim of this paper is that this misalignment is now the dominant bottleneck on real-world deepfake defense, not model capability. We argue the ML research community should substantially rebalance its research agenda toward the harm categories that are actually growing. We support this position with empirical accounting of research effort and harm distribution, identify the structural reasons the misalignment persists, and outline three concrete technical research agendas for the under-defended harm categories.
Read the full abstract ▾
Cryptography and Security
SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces
Chang Jin, An Wang, Zeming Wei et al. (+7 more)
Reusable skills are becoming a common interface for extending large
language model
agents, packaging procedural guidance with access to files, tools,
memory, and execution environments. However, this modularity introduces attack surfaces that are largely missed by existing safety evaluations: even when the user request is benign, unsafe influence may reside in skill guidance, local artifacts, or execution-environment files that steer the
agent toward unsafe actions. We present SkillSafetyBench, a runnable
benchmark for evaluating such skill-facing safety failures. SkillSafetyBench includes 155
adversarial cases across 47 tasks, 6 risk domains, and 30 safety categories, each evaluated with a case-specific rule-based verifier. Experiments with multiple CLI
agents and model backends show that non-user attacks can consistently induce unsafe behavior, with distinct failure patterns across domains, attack methods, and scaffold-model pairings. Our findings suggest that
agent safety depends not only on model-level
alignment, but also on how
agents interpret skills, trust workflow context, and act through executable environments. The complete
benchmark is available at https://github.com/AI45Lab/skill-safety-bench.
Read the full abstract ▾
All authors Chang Jin, An Wang, Zeming Wei, Kai Wang, Biaojie Zeng, Qiaosheng Zhang, Chao Yang, Jingjing Qu, Xia Hu, Xingcheng Xu
Cryptography and Security
A microservices-based endpoint monitoring platform with predictive NLP models for real-time security and hate-speech risk alerting
Darlan Noetzold, Anubis Graciela De Moraes Rossetto, Juan Francisco De Paz Santana et al. (+1 more)
Organizations increasingly depend on endpoint devices and corporate communication channels, yet they still face critical risks such as sensitive data leakage, suspicious user behavior, and the circulation of hateful or harmful
language in workplace contexts. Current solutions frequently address these issues in isolation (e.g., productivity tracking, data loss prevention, or hate-
speech detection), limiting correlation across signals and delaying incident response. This work proposes a unified, microservices-based platform that collects endpoint telemetry and applies predictive natural
language processing models to support real-time security and compliance alerting. The architecture is modular and scalable, relying on RabbitMQ for event ingestion and routing and Redis for low-latency data access and alert delivery. For text classification,
transformer-based models such as BERT are evaluated for hate-
speech risk detection, achieving an average accuracy of 87%. Experimental results indicate that the proposed platform can promptly surface indicators of data exfiltration and policy violations while centralizing alert management, providing an integrated framework that combines monitoring, security analytics, and predictive capabilities.
Read the full abstract ▾
All authors Darlan Noetzold, Anubis Graciela De Moraes Rossetto, Juan Francisco De Paz Santana, Valderi Reis Quietinho Leithardt
Cryptography and Security · Cross-listed from cs.DB
PROTECT-DB: Protecting Data using Replicated State Machines: Efficient Corruption Detection & Recovery
Anant Utgikar and S. Sudarshan
Data is critical for the operation of any organization and needs to be protected, especially against attacks that compromise the state of the database. In this paper, we explore an approach based on Byzantine-fault tolerant replicated state machines, built on top of a deterministic extension of PostgreSQL. Each replica deterministically executes transactions recorded in a shared log/blockchain. Our focus is on creating a practical system that is designed for efficient and quick detection of corruption, as well as quick repair concurrent with execution of transactions. We also present a performance study showing the efficiency and practicality of our approach. We believe our work lays the foundations for the practical use of the BFT replicated state machine approach in the context of databases.
Read the full abstract ▾
Cryptography and Security
AccLock: Unlocking Identity with Heartbeat Using In-Ear Accelerometers
Lei Wang, Jiangxuan Shen, Xi Zhang et al. (+6 more)
The widespread use of earphones has enabled various sensing applications, including activity recognition, health monitoring, and context-aware computing. Among these, earphone-based user authentication has become a key technique by leveraging unique biometric features. However, existing earphone-based authentication systems face key limitations: they either require explicit user interaction or active speaker output, or suffer from poor accessibility and vulnerability to environmental noise, which hinders large-scale deployment. In this paper, we propose a passive authentication system, called AccLock, which leverages distinctive features extracted from in-ear BCG signals to enable secure and unobtrusive user verification. Our system offers several advantages over previous systems, including zero-involvement for both the device and the user, ubiquitous, and resilient to environmental noise. To realize this, we first design a two-stage denoising scheme to suppress both inherent and sporadic interference. To extract user-specific features, we then propose a disentanglement-based deep learning model, HIDNet, which explicitly separates user-specific features from shared nuisance components. Lastly, we develop a scalable authentication framework based on a Siamese network that eliminates the need for per-user classifier training. We conduct extensive experiments with 33 participants, achieving an average FAR of 3.13% and FRR of 2.99%, which demonstrates the practical feasibility of AccLock.
Read the full abstract ▾
All authors Lei Wang, Jiangxuan Shen, Xi Zhang, Dalin Zhang, Jingyu Li, Haipeng Dai, Chenren Xu, Daqing Zhang, He Huang